How can I ensure all newly created accounts under an AWS Organization are flagged to be added to PGB configurations?

Products

• CloudHealth

Issue/Introduction

The best approach to manage this is likely to use a combination of Perspectives and Account status filters to set up a subscription or policy to alert when new accounts are added.
 
AWS accounts when they first incur a cost within the Billing Account CUR will show up in our platform as linked to the Payer account within 24–48 hours, but as they have not had any API access configured, their status will be listed as "Unknown". 

Reference: Why are my linked accounts not being displayed in the platform?
 
This can be used to identify and alert on accounts that have not been configured within the tenant.
 
The first problem to solve, however, is when there are a large # of linked accounts that are not configured with API access, as this would make any policy alerting on "Unknown" status accounts difficult.
 
To solve this, it is recommend you first review all existing linked accounts that are in an unknown status and take the following approach.

1. Configure AWS API access (e.g. IAM role) for any linked accounts you plan on adding to a PGB billing block. Configuring API access will have two benefits. It will remove it from an Unknown state and any AWS IAM credentials you configure at the partner level will be passed down to the customer tenant when you first add the linked account to a PGB consolidated billing block (this only works if the API access is in place when you first add the account to a billing block).
2. (optional) Once you have reviewed all existing accounts and configured API access for any that require it. I would also suggest you create a new Perspective to help segment the accounts that have already been onboarded into PGB. How to achieve this will depend on your own business logic, but if you need help with this, please sync with your Technical Account Manager.

 

NOTE: This Perspective does not need to be enabled for Advanced Integration (it should remain as standard integration as it's only to be used for non OLAP reporting) - 
 
 
3. You could then set up a subscription under https://apps.cloudhealthtech.com/aws_accounts with a filter that will report on linked accounts that have been created in the past 24 hours / 1 week as per - 
 

 
If you subscribe to this report and review any accounts with a status of 'UNKNOWN', these are accounts that will require review if they are part of PGB, as they do not have AWS API access configured, and they were recently derived from a Billing Account. 
 
 
4. If this Subscribed report does not meet your requirements, you could also create a governance policy to alert on accounts in an unknown Status as per - 
 

 
NOTE: Due to the number of existing accounts that are already in an Unknown Status, I would not recommend using this option unless you first create a Perspective to help you filter the Policy.

 

5. In the Perspective config, you could use something similar to the following to pull the already configured linked accounts into a group. 
 

 
Then manually move any other accounts that is already part of PGB into this same group (from AnA).
 
This should allow any other existing or new linked accounts with a Status of 0 (unknown) to be configured to be added to AnA.