Carve-out or merger

Move data between accounts that share no Organization and no owner.

Runs on: Your machine, with a profile in each account

When the other account is not yours

Douklar holds one profile in each account, and its worker relay needs no cross-account grant. An S3 Batch job runs as a role in the destination account and needs to read the source bucket: Douklar writes that statement, and the source account's admin applies it.

Example: the S3 Batch statement for the platform-prod admin

{
  "Sid": "BatchRoleRead1521f0b6bee729b0",
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::444455556666:role/douklar-s3-batch-operations" },
  "Action": [
    "s3:GetBucketLocation",
    "s3:ListBucket",
    "s3:PutInventoryConfiguration",
    "s3:GetObject",
    "s3:GetObjectTagging",
    "s3:GetObjectVersion",
    "s3:GetObjectVersionTagging"
  ],
  "Resource": [
    "arn:aws:s3:::platform-prod-assets",
    "arn:aws:s3:::platform-prod-assets/*"
  ]
}

The steps in the console

Accounts
One profile per AWS account, signed in with access keys or an IAM Identity Center session. While the console is open, Douklar checks each account at the interval you choose.
Accounts and credentials
Accounts
Captured from the console with sample data.
Discovery
Douklar keeps a catalog of buckets and repositories for each account, and refreshes it when you ask.
Discovery and mappings
Mappings
Pair each source with a destination, per service. Renames are allowed, and mappings are grouped by app.
Discovery and mappings
Mappings
Destinations are suggested from your cross-account defaults.
ECR, S3, CodeCommit and DynamoDB each have a table, with a count on the tab.
Edit a whole table as YAML, or add mappings one by one.
Captured from the console with sample data.
Preflight
Checks before the run starts: does the destination exist, how do the encryption keys compare, does a TTL need a decision, will the credentials last. Problems show up here, not halfway through a cutover.
Preflight and Review
Run
Review the plan for each service, then start one queued run. A worker picks it up, and you can watch its logs live.
Running a sync
Sync
Every run goes through three steps: choose the scope, review the plan, then run it.
Pick the mode. Regions for ECR, CodeCommit and DynamoDB are set here; S3 bucket Regions are found for you.
One run can copy to more than one target account.
Captured from the console with sample data.
Verification
After the run, Douklar checks what arrived: image digests and referrers, refs, items, and objects copied server-side.
Running a sync
Activity
Every run is kept: counts per service, logs and the outcome of each resource. Re-run a move, or retry only what failed.
Activity and evidence
Activity
Running, completed, warning, failed or cancelled.
A failed run keeps its place beside the completed ones, newest first.
Source to destination; "+1" marks a run that went to one more target.
Captured from the console with sample data.