Transit Gateway behavior while moving its account from one organization to another

Question

I am moving accounts from one Organization to another and have a question around the expected behavior of Transit GWs during the move.

I am following a playbook that mentions the following:
> "Note on Resource Access Manager (RAM) shares: RAM configurations established with accounts not in the same Organization will remain in place; any configurations established while accounts were in the same Organization are treated as if the Organization ID was defined as principal even if the share was explicitly created with an account ID (this is done under the hood by RAM to allow for auto-acceptance of shares when accounts are in the same Organization). Shortcut rule: If the RAM share did not have an explicit "accept" required by the account receiving the share, it will be treated as an Organizational share and require a new share created after account migration."

What's not clear from the above is what exactly happens when the account containing the TGWs is itself migrated to the new org. The docs mention, under "Shortcut Rule" that we would have to create a new org level share from that account at the NEW org level....but only AFTER the account has moved to the new org.

Question is...at that exact moment in time, what happens? Does the old org-level share become invalid, and do we drop all routing until we re-establish that org share?

That's a critical factor, since while we can easily re-share at the NEW org level...there will be a brief interruption in routing until that new share lands....

It would also be good to confirm the order of operations too...I'm assuming we create the new org-level share as soon as possible, which should re-instate routing as the share hits the various child-accounts.

TIA!

Answer

Hi Henning,

What happens when the owner account is moved from organization varies from service to service, and you should look into each specific service to find the answer, which is in a nutshell "What happens when I unshare a X service?". 
In particular to you, TGW's behavior is described here https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-share.html#transit-gateway-unshare . Most importantly, the attachments remain functional after being unshared, so your network traffic isn't affected.

Although I may say, you can avoid any kind of unsharing with some hassle, you could go to RAM and allow resources to be shared outside your org, and then share the TGW to all the accounts that use it, by account id. That way, even if you move your RAM across orgs, no unsharing/sharing happens.

Hope this helps!

Transit Gateway behavior while moving its account from one organization to another

Relevant content