Skip to content

Do Deadline Cloud farms survive deletion of an IAM Identity Center account instance?

0

We have an AWS account with:

  • an IAM Identity Center account instance (standalone, no AWS Organizations)
  • a Deadline Cloud farm created under a monitor linked to that Identity Center instance

We want to migrate to an IAM Identity Center organization instance for developer CLI and console access via SSO. Since only one Identity Center instance is allowed per account, we need to delete the existing account instance first.

Question: If we delete the Identity Center account instance, do the Deadline Cloud farms and their configuration (queues, fleets, queue environments, run logs etc.) get deleted too, or do they persist and become inaccessible through DC monitor until a new monitor is connected?

The IAM Identity Center deletion docs only describe what gets deleted within Identity Center itself (permission sets, users, application assignments) with no mention of impact on Deadline Cloud resources. However, the Deadline Cloud UpdateFarm API does not accept an Identity Center parameter, so re-associating an existing farm with a new instance does not appear to be possible.

1 Answer
7
Accepted Answer

Yes, your Deadline Cloud farms will survive.

Deadline Cloud farms and their configurations (queues, fleets, queue environments, run logs, etc.) are account-level resources. They are not tied to the lifecycle of the IAM Identity Center instance. If you delete the Identity Center account instance, the underlying farm infrastructure remains fully intact.

However, you will temporarily lose access to them via the Deadline Cloud monitor, and the existing access associations will break.

Because the UpdateMonitor API does not allow you to change the identityCenterInstanceArn, here is the required migration path:

  1. Clean up: Delete the existing Deadline Cloud monitor (optional, but recommended to avoid stale resources).
  2. Delete the existing IAM Identity Center account instance.
  3. Set up your new IAM Identity Center organization instance and provision your new users/groups.
  4. Create a new Monitor: Create a new Deadline Cloud monitor and associate it with the new Identity Center instance during creation.
  5. Re-associate Members: The existing farms will still be visible to you as an AWS administrator in the console. Because the previous farm associations referenced the old Identity Center's PrincipalIds, you must grant your new SSO users/groups access to the existing farms. You can do this via the console or the CLI using aws deadline associate-member-to-farm.

In short: No need to rebuild your farms. You "only" need to rebuild the monitor and re-map the access permissions.

See also:

EXPERT

answered 2 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.