Skip to content

Need help with VPC Sharing and unsharing of it

0

I have a customer who is looking to start migrating into their Control Tower environment. They have run into an issue with resource sharing which they need guidance with. They have a VPC which is owned by Account A and is shared with Account B. They would like to transfer ownership of the VPC from Account A to Account B, then un-share it (so account B would retain control of the VPC). My understanding is that this is not possible and the correct protocol is to spin up a new VPC in account B, migrate the resources in Account B to the new VPC, then once it’s been vacated, Account A can un-share the VPC with Account B. Is there a workaround or alternative method to decouple account A and B?

1 Answer
1
Accepted Answer

You're correct in your understanding that directly transferring ownership of a shared VPC from one account to another is not possible in AWS. The process you've outlined is indeed the recommended approach for this situation. Here's a more detailed explanation of the steps:

  1. Account B should create a new VPC within their own account.

  2. Migrate all resources from the shared VPC (owned by Account A) to the newly created VPC in Account B. This includes EC2 instances, RDS databases, Lambda functions, and any other AWS resources that were deployed in the shared subnets.

  3. Once all resources have been migrated and verified in the new VPC, Account A can unshare the VPC with Account B.

  4. After unsharing, Account B will no longer be able to create new resources in the previously shared subnets, but they will still be able to modify, describe, and delete any remaining resources they might have in those subnets.

  5. It's important for Account B to ensure all their resources are removed from the shared VPC before Account A unshares it. This is because Account A cannot delete the shared subnet or the shared-subnet VPC if participants still have resources in the unshared subnet.

There isn't a direct workaround or alternative method to transfer VPC ownership between accounts. This process, while potentially time-consuming, ensures a clean separation of resources and maintains the integrity of the VPC ownership model in AWS.

To minimize disruption during this migration, careful planning and potentially using AWS migration tools or services could be beneficial. Also, consider using features like VPC peering or AWS Transit Gateway to maintain any necessary connectivity between the old and new VPCs during the migration process.
Sources
Working with shared subnets - Amazon Virtual Private Cloud
Share your VPC subnets with other accounts - Amazon Virtual Private Cloud

answered a year ago
EXPERT
reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.