AWS Organizations account discovery mode

When Workload Discovery on AWS is deployed in an AWS Organization, the discovery of accounts is no longer managed through the solution’s web UI. In this case, you don’t need to manage the deployment of CloudFormation templates to discover accounts.

Instead, the solution uses an AWS Organization-wide AWS Config aggregator to discover resources in all accounts in the organization that have AWS Config enabled.

For resource types that aren’t supported by AWS Config, the solution automatically deploys an IAM role in each account in the organization using AWS CloudFormation StackSets. This role allows the discovery process to make SDK calls in all the organization’s accounts to discover these supplementary resources.

This StackSet is configured to automatically deploy the role in any new accounts that are added to the organization and delete the role from any accounts removed from the organization.