Why create account manually for landing zone and the Reference Architecture?

[gruntwork-support]

This message was extracted from a discussion that originally took place in Gruntwork Community Slack. Names and URLs have been removed where appropriate

From a customer

Hello!
Why account creating be part of landing zone or reference architecture? Why do I need to provide account numbers and pre-provision them ?

[gruntwork-support]

From a customer

There are things delivered as part of the RefArch that need to be bootstrapped and it's easiest to have the accounts already created with Route53 zones already setup.

In particular, you'll need to have the domains, Route53 zones, and accounts pre-created

Gruntwork provides tools to make this bootstrapping process more straight-forward

[gruntwork-support]

From a grunt

+1 on what person said. The current process for the Reference Architecture is that you create several accounts for us, configure Route 53 in them, and then we deploy everything else into them. We provide the gruntwork CLI tool to automate much of this process.

In the future, we will switch to having customers use the account-baseline-root landing zone module to create the child accounts for the Reference Architecture, but we need to do some more work before that's possible (especially for larger companies, where there are separate owners for account creation, network creation, etc). So for now, the gruntwork CLI remains the recommended option for the Ref Arch.

[gruntwork-support]

From a customer

Can we do on an existing organisation where main/root account is already available ?

[gruntwork-support]

From a grunt

Yes! You should be creating new accounts that are children of your existing root account.

(using AWS Organizations)

[drafie]

Is this still the best practice (using gruntwork CLI tool) at the close of 2022?

[Etiene]

Yes, this is still the recommended practice.