Skip to main content
Latest Documentation
This is the latest documentation for the Cloud Posse Reference Architecture. To determine which version you're currently using, please see Version Identification.
Version: Latest
Sponsor @cloudposse

Legacy Account Map

The account-map component has been deprecated. The reference architecture now uses Atmos Auth for authentication and Atmos Functions for dynamic values, eliminating the need for account-map entirely.

Why Deprecate Account Map?​

The account-map component was originally designed to store AWS account metadata in Terraform state and provide dynamic lookups for account IDs, IAM roles, and other configuration. While functional, this approach had several limitations:

  1. Tight coupling — Components depended on account-map remote state, creating deployment dependencies
  2. Greenfield only — The pattern assumed Cloud Posse deployed all accounts, making brownfield adoption difficult
  3. Slower operations — Every Terraform run required remote state lookups
  4. Complex bootstrapping — Cold start required careful ordering of component deployments

The New Approach​

The refactored architecture replaces account-map with:

  1. Atmos stack variables — Account IDs and configuration stored directly in stack configuration (no remote state)
  2. Atmos Auth — Authentication handled before Terraform runs via atmos auth login
  3. Atmos Functions — Dynamic values resolved at plan time using !terraform.output and other functions
  4. Simplified components — Components work in both greenfield and brownfield environments

This approach enables all Cloud Posse components to work in brownfield environments where accounts already exist.

Current Documentation​

The accounts layer documentation has been updated for the new approach:

  1. Prepare AWS Organization — ClickOps setup before Terraform
  2. Initialize Terraform Backend — Set up the S3 state backend
  3. Deploy Accounts — Create AWS accounts and configure settings
  4. Setup CloudTrail — Enable organization-wide audit logging

Migrating from Account Map​

If you have an existing deployment using the account-map component, see the migration guide:

See Also​

  1. Atmos Auth — Authentication commands
  2. Atmos Functions — Dynamic value resolution
  3. Identity Layer — IAM Identity Center and access management