docs: deprecate account-map and related components

[Dan Miller (milldr)]

Summary

Deprecate account-map, aws-teams, aws-team-roles, and legacy GitHub Actions GitOps in favor of Atmos Auth, AWS SSO Permission Sets, Atmos Pro, and RunsOn.

---

Site Structure

 Getting Started/
 ├── Introduction
 ├── Quickstart (DIY)
 └── Jumpstart Customers

 Build Your Foundation/
 ├── Setup your project/
 │   ├── Create Repository
 │   ├── Toolbox
 │   ├── Design Decisions/
 │   └── Tutorials/
+│       └── Migrate from Account Map              # NEW - migration guide
 │
 ├── Manage Accounts/
 │   ├── Accounts (index)
 │   ├── Prepare AWS Organization
 │   ├── Initialize Terraform Backend
 │   ├── Deploy Accounts
+│   ├── Setup CloudTrail                         # NEW
-│   ├── Account Baseline                         # REMOVED
 │   ├── FAQ
 │   ├── Design Decisions/
 │   └── Tutorials/
-│       ├── Cold Start                           # REMOVED
-│       ├── Deprecated Cold Start Components     # REMOVED
-│       ├── Manual Configuration                 # REMOVED
+│       ├── Create Account Root Users            # NEW
+│       ├── Legacy Account Map                   # NEW - reference for migration
 │       ├── How to Add a New OU
 │       ├── How to Add or Mirror a Region
 │       ├── How to Adopt/Import Legacy Accounts
 │       ├── How to Create and Setup AWS Accounts
 │       ├── How to Create SuperAdmin User
 │       ├── How to Delete AWS Accounts
 │       ├── How to Manage Account Settings
 │       ├── How to Register Pristine AWS Root Account
 │       ├── How to Set Up AWS Email Notifications
 │       └── Terraform S3 State
 │
 ├── Identity and Authentication/
 │   ├── Identity (index)
 │   ├── Setup Identity Center (AWS SSO)
+│   ├── Centralize Root Access                   # NEW
 │   ├── Deploy IAM Roles
+│   ├── Configure Atmos Auth                     # NEW - replaces Leapp
 │   ├── Login to AWS
-│   ├── Centralized Terraform Access             # REMOVED
-│   ├── FAQ                                      # REMOVED
 │   ├── Design Decisions/
-│   ├── Docs/                                    # REMOVED folder
-│   │   ├── AWS Access Control Architecture
-│   │   ├── AWS Access Control Evolution
-│   │   ├── AWS Access Control
-│   │   ├── AWS Restricting Admin Access
-│   │   └── Dynamic Terraform Roles
-│   ├── Optional/                                # REMOVED folder
-│   │   └── AWS SAML
 │   └── Tutorials/
+│       ├── Access Control Evolution             # NEW (content from docs/)
+│       ├── AWS SAML                             # NEW (moved from optional/)
 │       ├── How to Setup SAML Login from Office 365
-│       ├── Expanding IAM Roles                  # REMOVED
-│       ├── How to Create a Delegated Role       # REMOVED
-│       ├── How to Easily Switch AWS Account Roles # REMOVED
-│       └── Leapp/                               # REMOVED folder
-│           ├── Leapp
-│           └── How to Setup Windows
 │
 └── Network and DNS/
     ├── Network (index)
     ├── Deploy VPCs
     ├── Connect Network (Transit Gateway)        # REWRITTEN
     ├── Access Network (VPN)
     ├── DNS Setup
     ├── FAQ
     └── Design Decisions/

 Set Up Your Platform/
 ├── Configure GitHub Actions/
 │   ├── GitHub Actions (index)
 │   ├── Design Decisions/
 │   ├── GitHub OIDC with AWS
 │   ├── Setup RunsOn                            # UPDATED - now primary option
+│   └── Tutorials/                              # NEW folder
+│       ├── Philips Labs Runners                # MOVED + deprecated notice
+│       └── EKS ARC Runners                     # MOVED + deprecated notice
-│   ├── Philips Labs GitHub Runners             # MOVED to tutorials/
-│   └── EKS GitHub Actions Controller           # MOVED to tutorials/
 │
 ├── Orchestrate Containers/
 │   ├── Use ECS/
 │   └── Use EKS/
 │
 └── Automate Terraform (Atmos Pro)/
     ├── Atmos Pro (index)
     ├── Setup Atmos Pro                         # REWRITTEN
+    ├── Deploy with Terraform                   # NEW (was in tutorials/)
+    ├── Drift Detection                         # NEW
     └── Tutorials/
-        ├── Deploy with Terraform               # MOVED up to main level
+        └── Migrate from GitHub Actions GitOps  # NEW

 Deploy Your Apps/
 ├── Provision Databases/
 └── Implement CI/CD (Software Delivery)/
     └── EKS with ArgoCD/

 Monitor Everything/
 ├── Implement Telemetry/
 │   ├── Datadog/
 │   └── Grafana/
 └── Security and Compliance/

 GitOps/                                         # ALL PAGES DEPRECATED
 ├── GitOps (index)                              # + deprecation notice
 ├── Setup                                       # + deprecation notice
 ├── Example Workflows                           # + deprecation notice
 └── FAQ                                         # + deprecation notice

---

Layer Changes Summary

Layer	Added	Removed	Modified
Accounts	setup-cloudtrail, tutorials/create-account-root-users, tutorials/legacy-account-map	account-baseline, tutorials/cold-start, tutorials/deprecated-cold-start-components, tutorials/manual-configuration	accounts, deploy-accounts, initialize-tfstate, prepare-aws-organization, faq, how-to-create-superadmin-user
Identity	atmos-auth, centralized-root-access, tutorials/access-control-evolution, tutorials/aws-saml	centralized-terraform-access, faq, docs/, optional/, tutorials/expanding-iam-roles, tutorials/how-to-create-delegated-role, tutorials/how-to-easily-switch-roles, tutorials/leapp/*	identity, aws-sso, deploy, how-to-log-into-aws
Network	-	-	connect-network (rewritten), access-network, deploy-vpcs, dns-setup
GitHub Actions	tutorials/tutorials.mdx	-	runs-on, github-actions, design-decisions/decide-on-self-hosted-runner-architecture; MOVED: philips-labs-github-runners, eks-github-actions-controller → tutorials/
Atmos Pro	deploy-with-terraform, drift-detection, tutorials/migrate-from-github-actions-gitops	tutorials/deploy-with-terraform (moved up)	atmos-pro, setup
GitOps	-	-	All pages get deprecation notices
Project	tutorials/migrate-from-account-map	-	toolbox

---

Workflow Snippets

Updated examples/snippets/stacks/workflows/quickstart/:

 quickstart/
 ├── app/
 │   ├── app-on-ecs.yaml
 │   └── app-on-eks-with-argocd.yaml
 ├── foundation/
 │   ├── accounts.yaml                           # UPDATED (merged baseline)
+│   ├── atmos-pro.yaml                          # NEW (renamed from gitops.yaml)
-│   ├── baseline.yaml                           # REMOVED (merged into accounts)
-│   ├── github.yaml                             # REMOVED (OIDC → identity)
-│   ├── gitops.yaml                             # RENAMED → atmos-pro.yaml
 │   ├── identity.yaml                           # UPDATED (added OIDC deployment)
+│   └── runs-on.yaml                            # NEW (runner deployment only)
 ├── monitor/
-│   └── compliance.yaml                         # RENAMED
+│   └── security-and-compliance.yaml            # RENAMED from compliance.yaml
+├── network/                                    # NEW folder
+│   └── network.yaml                            # MOVED from foundation/
-├── foundation/network.yaml                     # MOVED → network/network.yaml
 └── platform/
-    └── argocd.yaml                             # RENAMED
+    └── software-delivery.yaml                  # RENAMED from argocd.yaml

---

Why

• Transition to Atmos Auth, AWS SSO Permission Sets, and Atmos Pro
• Simplify IAM architecture by removing aws-teams/aws-team-roles
• Better GitOps experience through Atmos Pro vs custom GitHub Actions
• RunsOn provides simpler self-hosted runners without Kubernetes dependency
• Workflow file naming aligns with docs site layer structure

References

• Related: refarch-scaffold PR #818
• Atmos Auth Documentation
• RunsOn Documentation

[Copilot]

Pull request overview

This PR deprecates the legacy account-map, aws-teams, aws-team-roles components and GitHub Actions GitOps workflows in favor of a simplified architecture using Atmos Auth, AWS SSO Permission Sets, IAM roles, Atmos Pro, and RunsOn for self-hosted runners.

Key changes:

• Deprecates legacy identity components (account-map, aws-teams, aws-team-roles)
• Introduces new authentication with Atmos Auth and IAM Identity Center Permission Sets
• Replaces GitHub Actions GitOps with Atmos Pro
• Adds migration guide and legacy reference documentation
• Updates workflow file references to match new structure

Reviewed changes

Copilot reviewed 93 out of 94 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/css/mermaid.css	Adds Mermaid color theme variables for diagrams
sidebars.js	Restructures Atmos Pro section, removes GitOps subcategory
scripts/*.sh	Fixes script paths to work from any directory
plugins/staticRedirects/redirects/*.json	Updates redirects for moved/deprecated pages
package-lock.json	Auto-generated dependency updates
internal/prd/*.md	New PRD documents for the restructure
docs/resources/legacy/fundamentals/leapp.mdx	Adds deprecation notice for Leapp
docs/layers/identity/**/*	Major rewrite of identity layer documentation
docs/layers/gitops/**/*	Adds deprecation notices to GitOps pages
New migration guides	Adds documentation for migrating from legacy approach

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Dan Miller (milldr)]

before we merge this we need to

1. Merge the version tab into this PR, https://github.com/cloudposse/docs/pull/838/files
2. Remove github workflow for publishing version -- replace with simple doc on how to do it manually
3. Update admonitions both on later and v1
a. just say what version they're on and link to doc on how to determine
4. 1 page on Here's how to tell what version you're on and here's how to upgrade
5. 1 blog post on major upgrade -- migration and what's change and what they should do.

Done