Update 2

Author: ihatesea69

content/1-prerequisite/_index.md

@@ -79,9 +79,9 @@ Root
 ├── Sandbox account 1
 └── Sandbox account 2
 ```
-![architect](/images/anh2.jpg "Architect")
+![architect](/resources/_gen/images/anh2.jpg "Architect")
 
-![architect](/images/Anh1.jpg "Architect")
+![architect](/resources/_gen/images/Anh1.jpg "Architect")
 
 - Check in the Settings section of AWS Organizations console:
   - Consolidated billing is enabled

content/2-Deploy the Solution/_index.md

@@ -37,7 +37,7 @@ Consists of 4 stacks
 
 Each CloudFormation stack has dependencies with other stacks and is deployed on different accounts, ensuring solution components work in coordination.
 
-![architect](/images/stack-relationships.png "Architect")
+![architect](/resources/_gen/images/stack-relationships.png "Architect")
 
 #### CloudFormation Templates
 
@@ -71,7 +71,7 @@ Deploying the AccountPool stack will create the organization structure and polic
 - **HubAccountId:** This is the AWS account ID where you will deploy two of the four stacks. To see all accounts in the organization, go to AWS Organizations in the console, choose an account as hub and note the ID for use in step 5 and subsequent steps.
 - **ParentOuID:** This is the ID of the root or organizational unit (OU) where Innovation Sandbox OUs will be created. To find this ID, open AWS Organizations, the organization structure will display the ID under each OU name. You can also use the root organization ID.
 
-![architect](/images/organiza.jpg "Architect")
+![architect](/resources/_gen/images/organiza.jpg "Architect")
 
 **Initialize stack**
 

content/3-Configure the Solution/_index.md

@@ -79,7 +79,7 @@ Configuring SAML 2.0 integration between AWS IAM Identity Center and Innovation
 
 #### Important note
 
-- Perform all steps below in the **organization management account** – where you have configured AWS IAM Identity Center.
+- Perform all steps below in the **organization management account** – where you have configured AWS IAM Identity Center.
 - Ensure you are in the correct **home Region** chosen for the entire system.
 
 #### Configuration steps
@@ -89,32 +89,32 @@ Configuring SAML 2.0 integration between AWS IAM Identity Center and Innovation
 - Open **AWS IAM Identity Center console** with organization management account.
 - In navigation bar, choose **Applications**.
 - Switch to **Customer managed** tab.
-![architect](/images/organiza.jpg "Architect")
+![architect](/resources/_gen/images/organiza.jpg "Architect")
 
 **2. Add new application**
 
 - Choose **Add application**.
 - Choose **I have an application I want to set up**.
 - Choose **SAML 2.0**, then click **Next**.
 
-![architect](/images/Buoc3.png "Architect")
+![architect](/resources/_gen/images/Buoc3.png "Architect")
 
 **3. Configure application**
 
 - On configuration page, enter **Display name** (example: MyISB app) and description for application.
 - 
-![architect](/images/Buoc5.png "Architect")
+![architect](/resources/_gen/images/Buoc5.png "Architect")
 
 - In **IAM Identity Center metadata** section:
   - Download **SAML metadata file** (identity provider metadata).
   - Download **certificate** (identity provider certificate).
 
-![architect](/images/Buoc6.png "Architect")
+![architect](/resources/_gen/images/Buoc6.png "Architect")
 
 
-- Note the **Sign-in URL** and **Sign-out URL** – will be needed when configuring on hub account.
+- Note the **Sign-in URL** and **Sign-out URL** – will be needed when configuring on hub account.
 
-![architect](/images/Buoc7.png "Architect")
+![architect](/resources/_gen/images/Buoc7.png "Architect")
 
 **4. Enter metadata information for application**
 
@@ -125,7 +125,7 @@ Configuring SAML 2.0 integration between AWS IAM Identity Center and Innovation
   |-------------------------|-------------------------------------------------------------------------------------------------------|
   | Application ACS URL     | `{ISB_WEB_URL}/api/auth/login/callback`  (Replace `{ISB_WEB_URL}` with saved CloudFrontDistributionUrl, example: `https://duyXXXXXXXeh.cloudfront.net/api/auth/login/callback`) |
   | Application SAML audience | Application identifier value (can use namespace name or initial stack name, example: `Isb-dev-namespace-Audience`). Save this value to configure AppConfig on hub account. |
-![architect](/images/Buoc8.png "Architect")
+![architect](/resources/_gen/images/Buoc8.png "Architect")
 **5. Complete configuration**
 
 - Click **Submit**.
@@ -178,7 +178,7 @@ Setting up users and groups in AWS IAM Identity Center helps control access and
   - `{NAMESPACE}_IsbAdminsGroup`
 - Click **Add user to 1 group** to complete.
 
-![architect](/images/users-and-groups.png "Architect")
+![architect](/resources/_gen/images/users-and-groups.png "Architect")
 
 **Note:**  
 To test all three user roles (user personas), ensure you have at least three users, each belonging to a different group.
@@ -198,7 +198,7 @@ Configuring the Innovation Sandbox on AWS web application helps activate user au
 - Choose **Create** to create a new hosted configuration version.
 
 
-![architect](/images/appconfig.png "Architect")
+![architect](/resources/_gen/images/appconfig.png "Architect")
 
 **Update configuration:**
 - Set `maintenanceMode` value to `false` to open application for users.
@@ -242,7 +242,7 @@ Onboarding sandbox accounts is the final configuration step to complete the Inno
 
 #### Important note
 
-- Perform these steps in the **organization management account** – where you have configured AWS IAM Identity Center.
+- Perform these steps in the **organization management account** – where you have configured AWS IAM Identity Center.
 - Ensure you are in the correct **home Region** chosen for the entire system.
 
 #### Steps to Onboard Sandbox Accounts
@@ -257,7 +257,7 @@ Onboarding sandbox accounts is the final configuration step to complete the Inno
 - Find the accounts you want to move into sandbox environment. You can browse by OU structure or choose **List** to see flat account list.
 - **Note:** Do not select organization management account or hub account.
 
-![architect](/images/account-onboarding.png "Architect")
+![architect](/resources/_gen/images/account-onboarding.png "Architect")
 
 **3. Move accounts to Entry OU**
 
@@ -272,4 +272,4 @@ Onboarding sandbox accounts is the final configuration step to complete the Inno
 - Sandbox accounts have been moved to the correct OU in the Innovation Sandbox on AWS organization structure.
 - Related control policies and configurations will automatically be applied to these accounts.
 
-Properly onboarding accounts into Entry OU ensures the sandbox environment operates separately, securely and complies with organization governance policies.
+Properly onboarding accounts into Entry OU ensures the sandbox environment operates separately, securely and complies with organization governance policies.