Question

A large enterprise recently acquired a smaller company. The acquired company operates 12 standalone AWS accounts that were each created independently with separate root credentials and their own consolidated billing was never enabled. The enterprise already runs a mature AWS Organizations setup managed by AWS Control Tower with several OUs and SCPs. The security team wants these 12 accounts brought under the enterprise Organization so that governance guardrails and centralized billing apply, while minimizing disruption to running production workloads. What is the correct approach to bring these existing accounts under central management?

Accepted Answer

Send an invitation from the management account to each existing account, accept the invitation from each member account, then enroll the accounts into Control Tower by moving them into a registered OU and running the enrollment/update process.

Answer

Recreate each workload in brand-new accounts provisioned by Control Tower Account Factory, migrate the data, and decommission the original 12 accounts since existing accounts cannot join an Organization.

Answer

Use the Control Tower Account Factory to directly import the 12 accounts by supplying their root credentials, which automatically merges them and applies all SCPs immediately.

Answer

Enable consolidated billing by adding the 12 account IDs to the payer account's billing preferences; this automatically joins them to the Organization and applies the enterprise OU guardrails.