wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

Two plans for one account move, and the DNS that dies on the way

A workload account is being moved into the Regulated OU for a compliance programme. It is an Organizations change — no VPC is touched, no route table, no endpoint, and the change ticket says so.

The account resolves corporate names through a Resolver forwarding rule that the network account created once and shares through Resource Access Manager. Nobody thinks of that as being in scope, because moving an account is not a networking change.

Both plans end with the account in the Regulated OU and the rule shared to it. Choose the one where DNS never stops.
!Ten minutes after an OU move, everything in the account that resolves an on-premises name starts failing. Nothing was deployed, the Resolver rule still exists, and the outbound endpoint is healthy.A rule shared to an OU follows the OU, not the account — so the order of two steps decides whether anything breaks.
Design AMove the account, then share

Boundaries, outermost first: Regulated OU: Moving account (forwards), Share to Regulated (made after) Workloads OU: Resolver rule (corp), Share to Workloads (no longer) Connections: Resolver rule controls Share to Workloads Share to Regulated controls Moving account — shares, does not associate Share to Workloads publishes to Moving account — association deleted

Resolver rulecorp
Share to Workloadsno longer
Moving accountforwards
Share to Regulatedmade after
Design BShare with the destination, then move

Boundaries, outermost first: Regulated OU: Moving account (forwards), Share to Regulated (made first) Workloads OU: Resolver rule (corp), Share to Workloads (covers it) Connections: Resolver rule controls Share to Workloads Share to Regulated controls Moving account — already covers it Share to Workloads publishes to Moving account — association held

Resolver rulecorp
Share to Workloadscovers it
Moving accountforwards
Share to Regulatedmade first
Two designs, one brief. Read both, then choose the one that meets it.