Updating a Landing Zone

Procedure

1. Log in to Huawei Cloud as the RGC administrator, and navigate to the RGC console.
2. Access the Landing Zone Settings page, and click the Versions tab.
3. Select the source version you want to update.
   Figure 1 Selecting a source version
   

4. Click Update Version.
   Figure 2 Updating a landing zone
   
   NOTICE:

   After completing a landing zone update, you cannot undo the update or downgrade to a previous version.

5. Update the core OU and accounts.
   • Updating the management account
     • Enable: RGC will create an IAM Identity Center user as the administrator. If IAM Identity Center is connected to an external identity provider, the default IAM Identity Center user in RGC will lose access to the cloud.
     • Skip: RGC will not create a user as the RGC administrator, any user groups, or permission sets in IAM Identity Center.
   • Updating the alert email

     Enter an email address for the audit account. It is used to receive alerts preset by RGC. This email address cannot be currently used for any Huawei Cloud accounts. It can have a maximum of 64 characters.

   Figure 3 Updating the core OU and accounts
   

6. Click Next.
7. Update log configurations.
   • Enabling or disabling CTS

     If you do not enable CTS, RGC will not manage your CTS audit logs. It is strongly recommended that you enable CTS. Preconfigured mandatory governance policies will check whether CTS is enabled for enrolled accounts.

   • Updating OBS log configurations
     • Create new bucket: If you choose this option, you need to configure a retention period for logs in the OBS bucket. Logs are automatically stored in the two default OBS buckets, and you cannot rename them.
       • OBS Bucket Retention for Log Aggregation: The default period is one year, but you can change this to up to 15 years.

         This bucket is used to store operation audit logs recorded by CTS for all accounts in an organization and resource snapshots recorded by Config for managed accounts. It is stored in the bucket named rgcservice-managed-audit-logs-{Management account ID}. {Management account ID} represents the actual ID of the management account.

       • OBS Bucket Retention for Access Logs: The default period is 10 years, but you can change this to up to 15 years.

         The logs for accessing the log aggregation bucket are stored in the bucket rgcservice-managed-access-logs-{management account ID}.

     • Use existing bucket: If you choose this option, you need to enter the name of the OBS bucket created by the log archive account. If you use another bucket name, landing zone setup will fail. To ensure data security, you are advised to use a private OBS bucket.
   Figure 4 Updating log configurations
   

8. Click Next.
9. Review and confirm the updated settings, and click OK. RGC will start updating the landing zone.

   After the update is complete, a success message will be displayed.

   If the update fails, the landing zone will not be downgraded to a previous version and may enter an undefined state. In this case, submit a service ticket.

Related Operations

If you need to update accounts individually, refer to Updating an Account.