Incorporating superwerker into an Existing AWS Organization with Multiple Accounts?

[Shamshiel]

I'm currently operating an AWS Organization with the structure below:

Root
    Management account
    Team-A-Development
    Team-A-Staging
    Team-A-Production

My organization is fairly new and I'm exploring the possibility of integrating "superwerker" into this existing setup.

Could someone provide guidance on whether this is feasible? And if it is, what are the specific considerations or potential challenges I should be aware of when introducing "superwerker" to an AWS Organization that already consists of multiple accounts?

Any insights would be highly appreciated.

[Shamshiel]

For those who have the same query in the future, here's what I've discovered. The README.md of superwerker already suggests whether it can be integrated with an existing AWS Organization:

"Can I use superwerker for existing AWS set-ups?
superwerker is primarily designed for new AWS set-ups and can be used if AWS Control Tower is available in the respective region. superwerker will then attempt to set up services including Security Hub and GuardDuty. If these services are already present in your setup, you may need to clear the set-up accordingly beforehand."

Given that my AWS Organization was completely new, with the exception of three existing AWS accounts added to this AWS Organization, I managed to integrate superwerker with a few exceptions. Here are the steps I undertook:

1. Execute the superwerker CloudFormation script on my AWS Organization root account.
2. Wait for all stacks to be deployed. Note that the Backup-Stack may fail due to Issue #402 with superwerker.
3. Address the issue using the workaround mentioned for superwerker v0.15.0.
4. "Update" the superwerker CloudFormation script and wait for all stacks to be deployed. At this point, the Backup-Stack might fail again due to the lack of enrollment of X accounts in AWS Control Tower.
5. Manually enroll the X AWS Accounts into the AWS Control Tower that was set up by superwerker.
6. "Update" the superwerker CloudFormation script once again and wait for all stacks to be deployed successfully.
7. Enable GuardDuty on the X AWS Accounts that were enrolled earlier via the Audit account.

Hopefully, this information proves useful to someone dealing with a similar situation.