Update Your AWS Onboarding

Overview

As Upwind Cloud Scanner introduces support for new scanning capabilities and additional resource types, your existing AWS onboarding configuration may require additional IAM permissions to allow those resources to be discovered and scanned.

You can update your existing onboarding deployment in place to apply the latest Upwind roles and permissions, without disconnecting your AWS accounts or repeating the onboarding process.

This ensures that your existing Cloud Scanners have the permissions required to use newly supported scanning capabilities as they become available.

When You Need to Update

Update your AWS onboarding when you need to:

• Enable a new Cloud Scanner capability that requires additional IAM permissions, such as Data Security or support for additional resource types.
• Apply updates or improvements to the IAM roles and permissions used by your existing deployment.

Updating vs. migrating

This guide applies when your environment is already using the Combined Stack onboarding model and you only need to update the existing roles or permissions.

If you are moving from single-account onboarding or the legacy three-stack model to Combined Stack organizational onboarding, follow the Migration guide instead.

If your AWS Organization has not yet been connected to Upwind, follow the onboarding instructions.

Before You Begin

Before updating your deployment:

• Confirm that your Cloud Scanner uses the Outpost deployment model and that your environment is already connected using the Combined Stack onboarding flow. If Upwind hosts your Cloud Scanner infrastructure, follow the SaaS update guide instead.
• Locate your existing onboarding resources:
  • CloudFormation: the stack is typically named UpwindCombinedOrg.
  • Terraform: the root module that applies upwind_aws_org_onboarding to the accounts in scope.
• Make sure the identity performing the update has permission to update the relevant CloudFormation stack or apply Terraform changes.

Update Steps

CloudFormation

Step 1. Open the Existing Stack

1. Sign in to the AWS Management Console .
2. Open CloudFormation.
3. Select your existing Upwind onboarding stack, typically named UpwindCombinedOrg.
4. Choose Update → Make a direct update.

Step 2. Use the Latest Upwind Template

1. Select Replace existing template.

2. Select Amazon S3 URL, and enter:

   https://get.upwind.io/cfn/templates/iam/cross-account-roles/v2/upwind-combined-org-onboarding.yaml

3. Choose Next.

4. Keep the existing stack parameters unchanged unless Upwind Support has instructed you to update them.

5. Review the changes and acknowledge that the template may create or modify IAM resources.

6. Submit the update.

Wait until the stack reaches UPDATE_COMPLETE. The update duration may vary depending on the size and structure of your AWS Organization.

Terraform

Step 1. Update the Module Source

In each AWS account where the onboarding module is already applied, update the module source to the latest Upwind version. Keep all of your existing module arguments unchanged.

provider "aws" {
  region = "us-east-1"
}

module "upwind_aws_org_onboarding" {
  source = "https://get.upwind.io/terraform/modules/aws-org-onboarding/aws-org-onboarding-1.2.1.tar.gz"

  # Keep your existing module arguments,
  # such as external_id and orchestrator_account_id.
}

If you maintain a local or vendored copy of the module, merge the latest Upwind module changes into your copy before continuing.

Step 2. Upgrade Terraform Dependencies

Initialize the configuration and retrieve the updated module and provider versions:

terraform init --upgrade

Step 3. Apply the Update

1. Before applying the updated module to an organization that is already registered with Upwind, disable Org Discovery Role registration:

   upwind_disable_org_discovery_role_registration = true

   This prevents Terraform from attempting to register the existing Org Discovery Role again during the update.

2. Then apply the configuration:

   terraform apply

3. Review the Terraform plan and confirm the changes before applying them.

Step 4. Update Each Account in Scope

Repeat the update for every AWS account where the upwind_aws_org_onboarding module is currently deployed.

Apply the update to every account in scope

Unlike the CloudFormation organizational deployment, the Terraform module is not automatically propagated across your AWS accounts. Each account that already uses the onboarding module must be updated.

If you manage a large number of accounts, you can use an IaC orchestration tool such as Terragrunt to coordinate the update.

After the Update

After the CloudFormation update or Terraform apply completes successfully:

• The updated IAM roles and permissions become available to Upwind.
• Existing Cloud Scanners can use the updated permissions without requiring you to reconnect your AWS accounts.
• To use a newly supported scanning capability enabled by the updated permissions, open the relevant Cloud Scanner in the Upwind Management Console, go to Capabilities in Scope, and configure or enable the capability.
• Verify that your AWS accounts remain connected under Organizations and accounts.

Need Help?

If you need assistance with the update, contact Upwind through:

• 24/7 live chat in the Upwind Management Console.
• Email at support@upwind.io.
• Your shared Slack channel with Upwind.