Update Onboarding

Overview

As Upwind adds capabilities that require additional AWS IAM permissions, you update the onboarding stack or Terraform module already deployed in your environment. This in-place update grants the new permissions without disconnecting accounts or repeating the full SaaS onboarding flow.

With SaaS, you only manage IAM resources in your AWS Organization. Updating onboarding refreshes those roles and policies so Upwind-hosted Cloud Scanners can use the latest permissions.

When to Update

Update your SaaS onboarding when you need to:

• Enable new features that require additional IAM permissions, such as Data Security (DSPM) or expanded Cloud Scanner capabilities.
• Apply refinements to the cross-account roles Upwind uses to discover and scan your accounts.

If you have not yet connected your AWS Organization, follow the Onboarding flow instead.

Before You Start

• Confirm you are on the SaaS deployment model. If Cloud Scanners run in your own AWS accounts, use the Outpost update guide.
• Locate your existing onboarding resources:
  • CloudFormation: the stack is typically named UpwindCombinedOrg in the AWS Management Account (or delegated administrator account) where you originally ran the template.
  • Terraform: the root module that applies upwind_aws_org_onboarding in each account in scope.
• Use an identity with permission to update CloudFormation stacks or apply Terraform in those accounts.

Update Steps

CloudFormation

Step 1. Locate the Existing Stack

1. Sign in to the AWS Management Console in the account that owns the onboarding stack.
2. Open CloudFormation and select the onboarding stack (typically UpwindCombinedOrg).
3. Choose Update → Make a direct update.

Step 2. Replace the Template

1. Choose Replace existing template.

2. For the Amazon S3 URL, use:

   https://get.upwind.io/cfn/templates/iam/cross-account-roles/v2/upwind-combined-org-onboarding.yaml

3. Choose Next. Keep the existing stack parameters unless Upwind Support directs you to change them.

   note

   In the SaaS model, the Upwind Client ID, Upwind Client Secret, and Upwind Auth Secret ARN parameters should remain empty. Do not change the Upwind trusted account ID or external ID values that were set at onboarding.

4. Acknowledge that the template may create IAM resources, submit the update, and wait until the stack status is UPDATE_COMPLETE. Duration depends on organization size.

Terraform

Step 1. Reference the Latest Module

In each account where the onboarding module is applied, set the module source to the current version:

module "upwind_aws_org_onboarding" {
  source = "https://get.upwind.io/terraform/modules/aws-org-onboarding/aws-org-onboarding-1.2.1.tar.gz"
  # Keep your existing module arguments (external_id, upwind_trusted_account_id, and so on).
}

Step 2. Upgrade Providers and Modules

terraform init --upgrade

If you vendor the module locally, merge the latest module changes into your copy before applying.

Step 3. Apply

1. Before applying an update to an already-registered organization, disable Org Discovery Role registration so Terraform does not attempt to re-register the role:

   upwind_disable_org_discovery_role_registration = true

2. Apply the module:

   terraform apply

3. Repeat for each AWS account in your onboarding scope. When you manage many accounts, use an IaC orchestration tool such as Terragrunt.

   Apply to each account in scope

   Unlike CloudFormation StackSets-style org rollout, the Terraform module is not automatically deployed across accounts. Update every account that already runs the module.

After You Update

• New IAM permissions are available to Upwind immediately after the stack or Terraform apply completes successfully.
• Enable or configure the related feature in the Upwind Management Console if you have not already (for example, Data Security settings or Cloud Scanner coverage).
• Review connectivity under Organizations and accounts.

If the update fails or a feature still lacks access after a successful update, see Troubleshooting or contact support@upwind.io.