AWS Org Migration: RAM & Lake Formation Secrets

Bridging the Gap: A Migration Pattern

The AWS Architecture Blog article details a sophisticated "retained bridge share" pattern to maintain AWS RAM and Lake Formation permissions during AWS Organizations migrations. The core innovation lies in leveraging temporary, externally-facing RAM shares as a fallback while original organization-bound shares are disrupted by account movement. This approach is crucial for services with sensitive control plane dependencies, such as AWS Transit Gateway and AWS Glue Data Catalog, where data plane continuity might mask critical operational failures. The article effectively explains the 'why' behind the problem – organization-bound shares breaking upon account departure – and the 'how' of the solution, emphasizing the need to restore original shares post-migration to avoid permission drift and maintain a single source of truth.

The primary benefit is service continuity, preventing downtime and ensuring that infrastructure-as-code operations remain functional. The pattern's validation across multiple non-production and production waves, culminating in a successful migration of 378 accounts without customer disruption, underscores its robustness. The lessons learned, particularly the need to match validation boundaries to production and monitor control plane changes, are invaluable for other organizations undertaking similar complex cloud reorganizations. The availability of sample automation further lowers the barrier to adoption for this pattern.

However, a potential limitation is the complexity involved in implementing and managing the bridge share process, especially at scale. While the article provides a validated workflow, it still requires meticulous inventory, careful execution, and robust automation. The initial manual recovery for 21 accounts highlights that the automated solution, though developed rapidly, might not be universally plug-and-play without adaptation. Furthermore, the reliance on AWS RAM's regional nature necessitates careful inventory and execution across all relevant regions. The article could benefit from a more detailed discussion on the operational overhead and potential failure points associated with managing these temporary shares across numerous accounts and regions, particularly concerning auditing and eventual decommissioning.

Key Points

• AWS Organizations migrations can break AWS RAM organization-bound resource shares when accounts move.
• A "retained bridge share" pattern using external associations preserves access during migration.
• Original AWS Lake Formation shares must be restored post-migration to maintain a single source of truth and avoid permission drift.
• Control plane access is critical for infrastructure-as-code and services like Transit Gateway and Glue Data Catalog.
• Matching validation environments to production boundaries and monitoring control plane events are key lessons learned.

---

📖 Source: How a global payment processor preserved AWS RAM shares and Lake Formation permissions during an AWS Organizations migration