feat(CORE-1155): Add beginning of manage accounts

[MoonMoon1919]

No description provided.

[infraredgirl]

I wonder why there's no deploy preview for this PR?

[MoonMoon1919]

I wonder why there's no deploy preview for this PR?

We only get deploy previews for PRs going to master :(

[ebeneliason]

Sorry for the delay, I've finally found time to pull this down and preview it. I thought this might work better as a table, so I took a quick stab at laying it out that way. For expedience, and so as not to clobber your version here, I'll just share a screenshot and the Markdown I used to generate it:

View Markdown

# Manage your accounts

Gruntwork's Control Tower integration provides an IaC-based approach to many of your account management needs. Operations within those accounts can be grouped according to whether they may be performed in IaC, the AWS Console, or either. _When operations may be performed in either location, we strongly recommend using IaC._

## Prerequisites

- An AWS account with AWS Control Tower set up
- Access to an IAM User or Role with administrative permissions to AWS Control Tower

## How to manage your accounts

| Management Operation                                       | Terraform (IaC)  | AWS Console (ClickOps) |
| ---------------------------------------------------------- | ---------------- | ---------------------- |
| Create a new Organization Unit (OU)                        | ❌               | ✅                     |
| Delete an account (requires un-managing the account first) | ❌               | ✅                     |
| Modify account controls                                    | ❌               | ✅                     |
| Request a new account                                      | ✅               | ❌                     |
| Create a new account                                       | ✅               | ❌                     |
| Un-manage an account                                       | ✅               | ❌                     |
| Update Account Access IAM Identity Center user information | ✅ (recommended) | ✅ (discouraged)       |
| Moving an account to a new Organizational Unit             | ✅ (recommended) | ✅ (discouraged)       |

A few additional thoughts and questions:

1. Are there any other account management operations we haven't covered?
   • Renaming an account
   • Changing the primary account email
   • Managing account access
   • Changing permissions for those with access
   • Anything else that can be done in Control Tower…?
2. Are there any operations that we should emphasize should not be done in either place?
3. Note that I added "Modify account controls" to the list and indicated that it must be done via ClickOps (at least for now). Feel free to adjust phrasing or correct if I'm mistaken.
4. It might be nice to provide more context for actually performing these operations
   • We could link to e.g. the "add an account" page from the "create" and "request" an account items
   • We could link to the appropriate AWS docs for operations that can only be performed there
   • We could extend this page with additional information about actions (and use anchor links) if they don't warrant a dedicated page in our nav.
5. I went back and forth on whether to sort these based on their relationship to each other (e.g., grouping deleting an account with un-managing an account, etc.) or based on which management approach we recommend. I went with the latter since it kept the emoji looking neat and tidy, but I'm open to the alternative.

[MoonMoon1919]

Renaming an account

We can add.

Changing the primary account email

Do you mean the root email, or the email that is automatically granted access via SSO?

Managing account access

The initial SSO access, or the group access? Other than permitting the initial SSO user, account access is managed by AWS Identity Center, not Control Tower. The IAM Identity Center call out in these docs is directly modifiable by updating the account request file. For other users, it is not. Do we want to cover both cases (and thus, both AWS services) in this single doc?

Changing permissions for those with access

See above - do we want to make this doc exclusive to control tower or control tower + SSO.

EDIT - after further thought, I added it.

Anything else that can be done in Control Tower…?

My understanding is that the only other modifiable resources in Control Tower, other than what we have listed, are related to Controls. Do we want to cover those here?

Note that I added "Modify account controls" to the list and indicated that it must be done via ClickOps (at least for now).

Thanks!

It might be nice to provide more context for actually performing these operations

I'll work on this today.

[MoonMoon1919]

@ebeneliason Thanks for the helpful feedback! I've folded in the requested changes.