A major global payment technology company successfully executed a complex AWS Organizations migration involving hundreds of accounts while maintaining crucial AWS RAM shares and Lake Formation permissions. Leveraging temporary bridge shares allowed continuous control-plane access and resource sharing throughout the transition, minimizing operational disruption.
- Temporary AWS RAM bridge shares prevent permission loss during organization migration
- Restoring original shares post-migration avoids permission state duplication and drift
- Extensive wave-based deployment and contingency planning ensured smooth transition
Infrastructure signal
Migrating AWS accounts between organizations disrupts organization-bound AWS RAM shares, which inherently trust principals based on organization membership. Once accounts leave, these shares are automatically dissolved, removing control-plane access to shared resources and complicating ongoing operations such as network resource management and data catalog permissions.
This payment processor engineered a method employing temporary retained bridge shares that externally associate shared resources with migrating accounts prior to transfer. These bridge shares maintain permission continuity during the move. After migration, the system restores access by re-establishing the original RAM shares as the primary permission source, preventing duplicated and conflicting permissions.
Developer impact
The migration approach safeguarded developer workflows by ensuring that workloads dependent on shared AWS resources, including Transit Gateway, Route 53 Resolver, and AWS Lake Formation-managed Glue Data Catalog, remained operational through the control-plane transitions. Although data plane operations persisted, control-plane failures uncovered risks that the retained bridge share strategy mitigated.
Developers and infrastructure engineers were able to continue deployment and orchestration activities with minimal interruption. The process included dozens of non-production and production waves with pilots and contingencies, demonstrating the crucial importance of validation, infrastructure-as-code sanity checks, and operational readiness in large-scale AWS organization rehoming.
What teams should watch
Teams planning AWS Organizations migrations that involve AWS RAM-shared resources must implement a strategy similar to this bridge share pattern to avoid control-plane breakages and permissions loss. Simply moving accounts breaks organization-bound resource shares and causes latent failures in modifying shared infrastructure, despite ongoing data plane functionality.
It’s essential to reinstate the original RAM shares after migration to serve as the definitive permission source, avoiding divergent permission states and drift which complicate observability and governance. Teams should also adopt a phased wave approach with contingency windows to handle potential permission errors and verify resource access continuously during transition.