{"id":50570,"date":"2025-07-22T09:03:39","date_gmt":"2025-07-22T09:03:39","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=50570"},"modified":"2025-07-22T09:25:20","modified_gmt":"2025-07-22T09:25:20","slug":"aws-step-by-step-guide-to-install-workload-discovery-on-aws","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/aws-step-by-step-guide-to-install-workload-discovery-on-aws\/","title":{"rendered":"AWS: Step-by-Step Guide to Install Workload Discovery on AWS"},"content":{"rendered":"\n<p>Given:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You have\u00a0<strong>Administrator access<\/strong>\u00a0to your AWS account (<code>33333333333<\/code>)<\/li>\n\n\n\n<li>This account is part of AWS Organization\u00a0<code>o-eeeeeeeee<\/code>\u00a0(Management account:\u00a0<code>66666666666666666<\/code>)<\/li>\n\n\n\n<li>Your account\u00a0<strong>is not the management account<\/strong>\u00a0(but a member account)<\/li>\n\n\n\n<li>You want to deploy Workload Discovery on AWS for visualizing\/cloud mapping<\/li>\n<\/ul>\n\n\n\n<p>This guide covers best practices for&nbsp;<strong>organizational (Org-level) deployments<\/strong>, ensuring correct visibility and permissions.<\/p>\n\n\n\n<p>Given your specific AWS Organizations setup (Organization ID: o-5jsrv4oeem, Management account: 66666666666666666, Target account: 33333333333), here&#8217;s a detailed guide to install Workload Discovery:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Verify Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm you have Administrator access to account 33333333333<\/li>\n\n\n\n<li>Check if AWS Config is properly set up in your target region (ap-northeast-1)<\/li>\n\n\n\n<li>Verify if the AWSServiceRoleForAmazonOpenSearchService role exists:\n<ul class=\"wp-block-list\">\n<li>Go to IAM console<\/li>\n\n\n\n<li>Search for &#8220;AWSServiceRoleForAmazonOpenSearchService&#8221;<\/li>\n\n\n\n<li>Note whether it exists for the CreateOpensearchServiceRole parameter later<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">2. Prepare AWS Organizations Setup<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log into the AWS Organizations management account (66666666666666666)<\/li>\n\n\n\n<li>Enable trusted access for AWS Config in your organization:\n<ul class=\"wp-block-list\">\n<li>Go to AWS Organizations console<\/li>\n\n\n\n<li>Select &#8220;Services&#8221; from the left navigation<\/li>\n\n\n\n<li>Find &#8220;AWS Config&#8221; and enable trusted access<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Designate your target account (33333333333) as a delegated administrator:\n<ul class=\"wp-block-list\">\n<li>In the AWS Organizations console, go to &#8220;AWS accounts&#8221;<\/li>\n\n\n\n<li>Select your target account<\/li>\n\n\n\n<li>Choose &#8220;Delegated administrator&#8221; and register it for AWS Config<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">3. Configure AWS Config<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In the target account (33333333333), navigate to the AWS Config console<\/li>\n\n\n\n<li>Ensure &#8220;Record all resources supported in this Region&#8221; is selected<\/li>\n\n\n\n<li>Make sure &#8220;Include global resources&#8221; is checked<\/li>\n\n\n\n<li>Complete the AWS Config setup if not already done<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">4. Launch the CloudFormation Stack<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Sign in to the AWS CloudFormation console in the ap-northeast-1 region<\/li>\n\n\n\n<li>Click &#8220;Create stack&#8221; > &#8220;With new resources&#8221;<\/li>\n\n\n\n<li>For template source, use the AWS Solutions S3 URL for Workload Discovery<\/li>\n\n\n\n<li>Set the following key parameters:\n<ul class=\"wp-block-list\">\n<li>CrossAccountDiscovery: AWS_ORGANIZATIONS<\/li>\n\n\n\n<li>AccountType: DELEGATED_ADMIN<\/li>\n\n\n\n<li>OrganizationUnitId: (Leave blank to discover all accounts or specify an OU ID to limit discovery)<\/li>\n\n\n\n<li>ConfigAggregatorName: (Optional, specify if you have an existing aggregator)<\/li>\n\n\n\n<li>CreateOpensearchServiceRole: &#8220;No&#8221; if the role exists, &#8220;Yes&#8221; if it doesn&#8217;t<\/li>\n\n\n\n<li>AdminEmail: Your email address for admin notifications<\/li>\n\n\n\n<li>VpcCIDR: Default or specify your preferred CIDR block<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Review and Create the Stack<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Review all parameters and adjust as needed for your environment<\/li>\n\n\n\n<li>Acknowledge that the template will create IAM resources<\/li>\n\n\n\n<li>Click &#8220;Create stack&#8221; and wait for deployment (approximately 30 minutes)<\/li>\n\n\n\n<li>If you encounter the ElasticIP0 error again, request an Elastic IP quota increase as discussed earlier<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. Post-Deployment Configuration<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Once the stack is created, navigate to the &#8220;Outputs&#8221; tab of the CloudFormation stack<\/li>\n\n\n\n<li>Note the &#8220;WebUiUrl&#8221; for accessing the Workload Discovery console<\/li>\n\n\n\n<li>Access the URL and complete the initial setup:\n<ul class=\"wp-block-list\">\n<li>Set up your admin password<\/li>\n\n\n\n<li>Configure discovery settings<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Verify Resource Discovery<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In the Workload Discovery console, check that resources from your organization are being discovered<\/li>\n\n\n\n<li>Resources should appear within 15-30 minutes of deployment<\/li>\n\n\n\n<li>Verify that cross-account discovery is working properly<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">8. Enable Additional Features (Optional)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Configure cost data collection if desired<\/li>\n\n\n\n<li>Set up any additional integrations you may need<\/li>\n<\/ul>\n\n\n\n<p>This setup will allow Workload Discovery to automatically discover resources across your entire AWS Organization, providing you with comprehensive visibility into your multi-account, multi-region AWS environment.<\/p>\n\n\n\n<p>Sources<\/p>\n\n\n\n<p><a target=\"_blank\" rel=\"noreferrer noopener\" href=\"https:\/\/docs.aws.amazon.com\/solutions\/latest\/workload-discovery-on-aws\/choosing-the-deployment-account.html\">Choosing the deployment account &#8211; Workload Discovery on AWS&nbsp;<\/a><\/p>\n\n\n\n<p><a target=\"_blank\" rel=\"noreferrer noopener\" href=\"https:\/\/docs.aws.amazon.com\/solutions\/latest\/workload-discovery-on-aws\/aws-organizations-account-discovery-mode.html\">AWS Organizations account discovery mode &#8211; Workload Discovery on AWS&nbsp;<\/a><\/p>\n\n\n\n<p><a target=\"_blank\" rel=\"noreferrer noopener\" href=\"https:\/\/docs.aws.amazon.com\/solutions\/latest\/workload-discovery-on-aws\/prerequisites.html\">Prerequisites &#8211; Workload Discovery on AWS&nbsp;<\/a><\/p>\n\n\n\n<p>I&#8217;ll help you check if trusted access for AWS Config is enabled and if your account is registered as a delegated administrator, all from your target account (<code>33333333333<\/code>). Let me provide you with the steps.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Given: This guide covers best practices for&nbsp;organizational (Org-level) deployments, ensuring correct visibility and permissions. Given your specific AWS Organizations setup (Organization ID: o-5jsrv4oeem, Management account: 66666666666666666, Target account: 33333333333), here&#8217;s&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-50570","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/50570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=50570"}],"version-history":[{"count":3,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/50570\/revisions"}],"predecessor-version":[{"id":50573,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/50570\/revisions\/50573"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=50570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=50570"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=50570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}