diff --git a/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/__tests__/aws-account-mgmt-plugin.test.js b/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/__tests__/aws-account-mgmt-plugin.test.js
new file mode 100644
index 0000000000..aef8065241
--- /dev/null
+++ b/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/__tests__/aws-account-mgmt-plugin.test.js
@@ -0,0 +1,165 @@
+/*
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License").
+ *  You may not use this file except in compliance with the License.
+ *  A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ *  or in the "license" file accompanying this file. This file is distributed
+ *  on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ *  express or implied. See the License for the specific language governing
+ *  permissions and limitations under the License.
+ */
+
+const ServicesContainer = require('@aws-ee/base-services-container/lib/services-container');
+
+// Mocked dependencies
+jest.mock('@aws-ee/base-services/lib/plugin-registry/plugin-registry-service');
+const PluginRegistryService = require('@aws-ee/base-services/lib/plugin-registry/plugin-registry-service');
+
+jest.mock('@aws-ee/base-services/lib/settings/env-settings-service');
+const SettingsServiceMock = require('@aws-ee/base-services/lib/settings/env-settings-service');
+
+jest.mock('@aws-ee/base-raas-services/lib/environment/service-catalog/environment-sc-service');
+const EnvironmentScServiceMock = require('@aws-ee/base-raas-services/lib/environment/service-catalog/environment-sc-service');
+
+jest.mock('@aws-ee/base-raas-services/lib/indexes/indexes-service');
+const IndexesServiceMock = require('@aws-ee/base-raas-services/lib/indexes/indexes-service');
+
+const plugin = require('../aws-account-mgmt-plugin');
+
+// CHECKed Functions: getActiveNonAppStreamEnvs
+describe('awsAccountMgmtPlugin', () => {
+  let container;
+  let settings;
+  let environmentScService;
+  let indexesService;
+  beforeEach(async () => {
+    // Initialize services container and register dependencies
+    container = new ServicesContainer();
+    container.register('pluginRegistryService', new PluginRegistryService());
+    container.register('settings', new SettingsServiceMock());
+    container.register('environmentScService', new EnvironmentScServiceMock());
+    container.register('indexesService', new IndexesServiceMock());
+
+    await container.initServices();
+    settings = await container.find('settings');
+    environmentScService = await container.find('environmentScService');
+    indexesService = await container.find('indexesService');
+  });
+
+  describe('getActiveNonAppStreamEnvs', () => {
+    const requestContext = { principalIdentifier: { uid: 'u-testuser' } };
+    it('should return empty list if AppStream is disabled', async () => {
+      // BUILD
+      const awsAccountId = 'sampleAwsAccountId';
+      settings.getBoolean = jest.fn(() => {
+        return false;
+      });
+      const expected = [];
+
+      // OPERATE
+      const retVal = await plugin.getActiveNonAppStreamEnvs({ awsAccountId }, { requestContext, container });
+
+      // CHECK
+      expect(retVal).toEqual(expected);
+    });
+
+    it('should return a list of active non-AppStream environments for an account if AppStream is enabled', async () => {
+      // BUILD
+      const awsAccountId = 'sampleAwsAccountId';
+      settings.getBoolean = jest.fn(() => {
+        return true;
+      });
+      const scEnvs = [
+        { id: 'env1', indexId: 'index1', isAppStreamConfigured: true, status: 'COMPLETED' },
+        { id: 'env2', indexId: 'index1', isAppStreamConfigured: false, status: 'COMPLETED' }, // This will be returned
+        { id: 'env3', indexId: 'index1', isAppStreamConfigured: false, status: 'FAILED' },
+        { id: 'env4', indexId: 'index1', isAppStreamConfigured: false, status: 'TERMINATED' },
+        { id: 'env5', indexId: 'index1', isAppStreamConfigured: false, status: 'UNKNOWN' },
+      ];
+      const indexes = [
+        { id: 'index1', awsAccountId },
+        { id: 'index2', awsAccountId: 'someOtherAccount' },
+      ];
+      environmentScService.list = jest.fn(() => {
+        return scEnvs;
+      });
+      indexesService.list = jest.fn(() => {
+        return indexes;
+      });
+
+      const expected = [{ id: 'env2', indexId: 'index1', isAppStreamConfigured: false, status: 'COMPLETED' }];
+
+      // OPERATE
+      const retVal = await plugin.getActiveNonAppStreamEnvs({ awsAccountId }, { requestContext, container });
+
+      // CHECK
+      expect(retVal).toEqual(expected);
+    });
+
+    it('should return an empty list if no active non-AppStream environments for an account are found', async () => {
+      // BUILD
+      const awsAccountId = 'sampleAwsAccountId';
+      settings.getBoolean = jest.fn(() => {
+        return true;
+      });
+      const scEnvs = [
+        { id: 'env1', indexId: 'index1', isAppStreamConfigured: true, status: 'COMPLETED' },
+        { id: 'env2', indexId: 'index1', isAppStreamConfigured: false, status: 'TERMINATED' },
+        { id: 'env3', indexId: 'index1', isAppStreamConfigured: false, status: 'FAILED' },
+        { id: 'env4', indexId: 'index1', isAppStreamConfigured: false, status: 'UNKNOWN' },
+      ];
+      const indexes = [
+        { id: 'index1', awsAccountId },
+        { id: 'index2', awsAccountId: 'someOtherAccount' },
+      ];
+      environmentScService.list = jest.fn(() => {
+        return scEnvs;
+      });
+      indexesService.list = jest.fn(() => {
+        return indexes;
+      });
+
+      const expected = [];
+
+      // OPERATE
+      const retVal = await plugin.getActiveNonAppStreamEnvs({ awsAccountId }, { requestContext, container });
+
+      // CHECK
+      expect(retVal).toEqual(expected);
+    });
+
+    it('should return an empty list if active non-AppStream environments exist but for a different account', async () => {
+      // BUILD
+      const awsAccountId = 'sampleAwsAccountId';
+      settings.getBoolean = jest.fn(() => {
+        return true;
+      });
+      const scEnvs = [
+        { id: 'env1', indexId: 'index1', isAppStreamConfigured: true, status: 'COMPLETED' },
+        { id: 'env2', indexId: 'index1', isAppStreamConfigured: false, status: 'STOPPED' },
+      ];
+      const indexes = [
+        { id: 'index1', awsAccountId: 'someOtherAccount' },
+        { id: 'index2', awsAccountId },
+      ];
+      environmentScService.list = jest.fn(() => {
+        return scEnvs;
+      });
+      indexesService.list = jest.fn(() => {
+        return indexes;
+      });
+
+      const expected = [];
+
+      // OPERATE
+      const retVal = await plugin.getActiveNonAppStreamEnvs({ awsAccountId }, { requestContext, container });
+
+      // CHECK
+      expect(retVal).toEqual(expected);
+    });
+  });
+});
diff --git a/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/__tests__/env-sc-connection-url-plugin.test.js b/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/__tests__/env-sc-connection-url-plugin.test.js
index 592aaa0009..64dec8baf3 100644
--- a/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/__tests__/env-sc-connection-url-plugin.test.js
+++ b/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/__tests__/env-sc-connection-url-plugin.test.js
@@ -25,15 +25,15 @@ const PluginRegistryService = require('@aws-ee/base-services/lib/plugin-registry
 jest.mock('@aws-ee/base-services/lib/settings/env-settings-service');
 const SettingsServiceMock = require('@aws-ee/base-services/lib/settings/env-settings-service');
 
-jest.mock('../../appstream/appstream-sc-service');
-const AppStreamScService = require('../../appstream/appstream-sc-service');
-
 jest.mock('@aws-ee/base-raas-services/lib/environment/service-catalog/environment-sc-connection-service');
 const EnvironmentScConnectionServiceMock = require('@aws-ee/base-raas-services/lib/environment/service-catalog/environment-sc-connection-service');
 
+jest.mock('../../appstream/appstream-sc-service');
+const AppStreamScService = require('../../appstream/appstream-sc-service');
+
 const plugin = require('../env-sc-connection-url-plugin');
 
-// Tested Functions: create, update, delete
+// Tested Functions: createConnectionUrl
 describe('envScConnectionUrlPlugin', () => {
   let container;
   let appStreamScService;
@@ -60,7 +60,7 @@ describe('envScConnectionUrlPlugin', () => {
       // BUILD
       const connection = { scheme: 'http', operation: 'create' };
       const envId = 'sampleEnvId';
-      settings.optionalBoolean = jest.fn(() => {
+      settings.getBoolean = jest.fn(() => {
         return false;
       });
 
@@ -75,7 +75,7 @@ describe('envScConnectionUrlPlugin', () => {
       // BUILD
       const connection = { scheme: 'http', operation: 'list' };
       const envId = 'sampleEnvId';
-      settings.optionalBoolean = jest.fn(() => {
+      settings.getBoolean = jest.fn(() => {
         return true;
       });
 
@@ -90,7 +90,7 @@ describe('envScConnectionUrlPlugin', () => {
       // BUILD
       const connection = { scheme: 'random', operation: 'create' };
       const envId = 'sampleEnvId';
-      settings.optionalBoolean = jest.fn(() => {
+      settings.getBoolean = jest.fn(() => {
         return true;
       });
       appStreamScService.getStreamingUrl = jest.fn();
@@ -110,7 +110,7 @@ describe('envScConnectionUrlPlugin', () => {
       const destinationUrl = 'originalPublicDestinationUrl';
       let connection = { scheme: 'http', operation: 'create', url: destinationUrl, type: 'SageMaker' };
       const envId = 'sampleEnvId';
-      settings.optionalBoolean = jest.fn(() => {
+      settings.getBoolean = jest.fn(() => {
         return true;
       });
       environmentScConnectionService.createPrivateSageMakerUrl = jest.fn(() => {
@@ -152,7 +152,7 @@ describe('envScConnectionUrlPlugin', () => {
       const destinationUrl = 'destinationUrl';
       let connection = { scheme: 'http', operation: 'create', url: destinationUrl };
       const envId = 'sampleEnvId';
-      settings.optionalBoolean = jest.fn(() => {
+      settings.getBoolean = jest.fn(() => {
         return true;
       });
       const streamingUrl = 'sampleAppStreamUrl';
@@ -185,7 +185,7 @@ describe('envScConnectionUrlPlugin', () => {
       const destinationUrl = 'destinationUrl';
       let connection = { scheme: 'ssh', operation: 'create', url: destinationUrl };
       const envId = 'sampleEnvId';
-      settings.optionalBoolean = jest.fn(() => {
+      settings.getBoolean = jest.fn(() => {
         return true;
       });
       const streamingUrl = 'sampleAppStreamUrl';
@@ -216,7 +216,7 @@ describe('envScConnectionUrlPlugin', () => {
       // BUILD
       let connection = { scheme: 'rdp', operation: 'create', instanceId: 'sampleInstanceId' };
       const envId = 'sampleEnvId';
-      settings.optionalBoolean = jest.fn(() => {
+      settings.getBoolean = jest.fn(() => {
         return true;
       });
       const streamingUrl = 'sampleAppStreamUrl';
diff --git a/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/aws-account-mgmt-plugin.js b/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/aws-account-mgmt-plugin.js
new file mode 100644
index 0000000000..5033ead9f8
--- /dev/null
+++ b/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/aws-account-mgmt-plugin.js
@@ -0,0 +1,57 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ * http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+const _ = require('lodash');
+
+const settingKeys = {
+  isAppStreamEnabled: 'isAppStreamEnabled',
+};
+
+/**
+ * Returns a list of active non-AppStream environments linked to a given AWS Account ID
+ * This check is only performed when the deployment has AppStream enabled,
+ * and is triggered if the user attempts to update the AWS account using SWB APIs.
+ * A similar check is performed on the UI components (AccountUtils) as well.
+ */
+async function getActiveNonAppStreamEnvs({ awsAccountId }, { requestContext, container }) {
+  const settings = await container.find('settings');
+  const isAppStreamEnabled = settings.getBoolean(settingKeys.isAppStreamEnabled);
+  if (!isAppStreamEnabled) return [];
+
+  const nonActiveStates = ['FAILED', 'TERMINATED', 'UNKNOWN'];
+  const environmentScService = await container.find('environmentScService');
+  const indexesService = await container.find('indexesService');
+
+  const indexes = await indexesService.list(requestContext);
+  const indexesIdsOfInterest = _.map(
+    _.filter(indexes, index => index.awsAccountId === awsAccountId),
+    'id',
+  );
+
+  const scEnvs = await environmentScService.list(requestContext);
+  const retVal = _.filter(
+    scEnvs,
+    scEnv =>
+      _.includes(indexesIdsOfInterest, scEnv.indexId) &&
+      !scEnv.isAppStreamConfigured &&
+      !_.includes(nonActiveStates, scEnv.status),
+  );
+
+  return retVal;
+}
+
+const plugin = { getActiveNonAppStreamEnvs };
+
+module.exports = plugin;
diff --git a/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/env-sc-connection-url-plugin.js b/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/env-sc-connection-url-plugin.js
index a83e035928..398d453288 100644
--- a/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/env-sc-connection-url-plugin.js
+++ b/addons/addon-base-raas-appstream/packages/base-raas-appstream-services/lib/plugins/env-sc-connection-url-plugin.js
@@ -28,7 +28,7 @@ async function createConnectionUrl({ envId, connection }, { requestContext, cont
   const appStreamScService = await container.find('appStreamScService');
   const environmentScConnectionService = await container.find('environmentScConnectionService');
   const settings = await container.find('settings');
-  const isAppStreamEnabled = settings.optionalBoolean(settingKeys.isAppStreamEnabled, false);
+  const isAppStreamEnabled = settings.getBoolean(settingKeys.isAppStreamEnabled);
 
   // This plugin will only contribute to URL creation when AppStream is enabled
   // Since this plugin is also called upon during listConnections cycle
diff --git a/addons/addon-base-raas-ui/packages/base-raas-ui/src/models/environments-sc/ScEnvironment.js b/addons/addon-base-raas-ui/packages/base-raas-ui/src/models/environments-sc/ScEnvironment.js
index 71b174111a..4c0130dde8 100644
--- a/addons/addon-base-raas-ui/packages/base-raas-ui/src/models/environments-sc/ScEnvironment.js
+++ b/addons/addon-base-raas-ui/packages/base-raas-ui/src/models/environments-sc/ScEnvironment.js
@@ -167,6 +167,7 @@ const ScEnvironment = types
     studyIds: types.frozen([]),
     cidr: types.frozen([]),
     outputs: types.frozen([]),
+    isAppStreamConfigured: types.optional(types.boolean, false),
   })
   .actions(self => ({
     setScEnvironment(rawEnvironment) {
diff --git a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/accounts/AccountCard.js b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/accounts/AccountCard.js
index 0ec912bb94..42a08cf23d 100644
--- a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/accounts/AccountCard.js
+++ b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/accounts/AccountCard.js
@@ -19,10 +19,9 @@ import { observer, inject } from 'mobx-react';
 import { withRouter } from 'react-router-dom';
 import { Header, Segment, Accordion, Icon, Label, Table, Button } from 'semantic-ui-react';
 import c from 'classnames';
-
 import { createLink } from '@aws-ee/base-ui/dist/helpers/routing';
-
 import { displayWarning } from '@aws-ee/base-ui/dist/helpers/notification';
+import { isAppStreamEnabled } from '../../helpers/settings';
 
 const { getAccountIdsOfActiveEnvironments } = require('./AccountUtils');
 
@@ -54,12 +53,8 @@ class AccountCard extends React.Component {
     return this.props.account;
   }
 
-  get isAppStreamEnabled() {
-    return process.env.REACT_APP_IS_APP_STREAM_ENABLED === 'true';
-  }
-
   get appStreamStatusMismatch() {
-    return this.isAppStreamEnabled && !this.account.isAppStreamConfigured;
+    return isAppStreamEnabled && !this.account.isAppStreamConfigured;
   }
 
   get awsAccountsStore() {
@@ -181,7 +176,7 @@ class AccountCard extends React.Component {
                 : `Service Workbench is waiting for the CFN stack to complete. 
                 Please wait a few minutes for provisioning to complete. 
                 If you did not create a CFN stack for this account, click
-                 "Re-Onboard Account" to return to the account onboarding page.`}
+                 "Re-Onboard Account" to return to the account onboarding page.`}
             </div>
           )}
         </Accordion.Content>
diff --git a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/accounts/AccountUtils.js b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/accounts/AccountUtils.js
index 7e3c892962..da1d0ccbcf 100644
--- a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/accounts/AccountUtils.js
+++ b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/accounts/AccountUtils.js
@@ -1,9 +1,9 @@
 import _ from 'lodash';
 
 function getAccountIdsOfActiveEnvironments(scEnvs, projects, indexes) {
-  const nonActivateStates = ['FAILED', 'TERMINATED', 'UNKNOWN'];
+  const nonActiveStates = ['FAILED', 'TERMINATED', 'UNKNOWN'];
   const activeEnvs = scEnvs.filter(env => {
-    return !nonActivateStates.includes(env.status);
+    return !nonActiveStates.includes(env.status);
   });
   const projectToActiveEnvs = _.groupBy(activeEnvs, 'projectId');
 
diff --git a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/ScEnvironmentCard.js b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/ScEnvironmentCard.js
index c42d23f5bf..84e9721cae 100644
--- a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/ScEnvironmentCard.js
+++ b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/ScEnvironmentCard.js
@@ -7,6 +7,7 @@ import { Header, Label, Popup, Icon, Divider, Message, Table, Grid, Segment } fr
 import TimeAgo from 'react-timeago';
 import { niceNumber } from '@aws-ee/base-ui/dist/helpers/utils';
 
+import { isAppStreamEnabled } from '../../helpers/settings';
 import By from '../helpers/By';
 import ScEnvironmentButtons from './parts/ScEnvironmentButtons';
 import ScEnvironmentCost from './parts/ScEnvironmentCost';
@@ -40,6 +41,7 @@ class ScEnvironmentCard extends React.Component {
         {this.renderStatus(state)}
         {this.renderTitle(env)}
         {this.renderError(env)}
+        {this.renderWarning(env)}
         <Divider className="mt1 mb1" />
         {this.renderButtons(env)}
         <Divider className="mt1" />
@@ -120,6 +122,20 @@ class ScEnvironmentCard extends React.Component {
     );
   }
 
+  renderWarning(env) {
+    if (isAppStreamEnabled && !env.isAppStreamConfigured && env.state.canTerminate) {
+      return (
+        <Message
+          icon="warning"
+          header="Non-AppStream workspace found"
+          content="Please terminate this workspace as soon as possible. This workspace is not supported by AppStream."
+        />
+      );
+    }
+
+    return null;
+  }
+
   renderError(env) {
     if (_.isEmpty(env.error)) return null;
 
diff --git a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/ScEnvironmentsList.js b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/ScEnvironmentsList.js
index 4f445a7ab0..8c737a0189 100644
--- a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/ScEnvironmentsList.js
+++ b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/ScEnvironmentsList.js
@@ -112,7 +112,7 @@ class ScEnvironmentsList extends React.Component {
     } else if (isStoreEmpty(store)) {
       content = this.renderEmpty();
     } else if (isStoreNotEmpty(store)) {
-      content = this.renderMain(appStreamProjectIds);
+      content = this.renderMain();
     } else {
       content = null;
     }
@@ -143,11 +143,10 @@ class ScEnvironmentsList extends React.Component {
     );
   }
 
-  renderMain(appStreamProjectIds) {
+  renderMain() {
     const store = this.envsStore;
     const selectedFilter = this.selectedFilter;
-    let list = store.filtered(selectedFilter);
-    list = this.isAppStreamEnabled ? _.filter(list, env => _.includes(appStreamProjectIds, env.projectId)) : list;
+    const list = store.filtered(selectedFilter);
     const isEmpty = _.isEmpty(list);
 
     return (
diff --git a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/parts/ScEnvironmentButtons.js b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/parts/ScEnvironmentButtons.js
index 5452a3f428..f35725aa9d 100644
--- a/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/parts/ScEnvironmentButtons.js
+++ b/addons/addon-base-raas-ui/packages/base-raas-ui/src/parts/environments-sc/parts/ScEnvironmentButtons.js
@@ -194,7 +194,11 @@ class ScEnvironmentButtons extends React.Component {
             </Button>
           )}
 
-          {canConnect && (
+          {/* Only let users connect to the environment if either of these conditions is true:
+            1. AppStream is not enabled and environment can be connected to
+            2. AppStream is enabled, environment is linked to an AppStream-configured account, and environment can be connected to 
+          */}
+          {canConnect && (!isAppStreamEnabled || env.isAppStreamConfigured) && (
             <Button
               floated="left"
               basic
diff --git a/addons/addon-base-raas/packages/base-raas-cfn-templates/src/templates/onboard-account.cfn.yml b/addons/addon-base-raas/packages/base-raas-cfn-templates/src/templates/onboard-account.cfn.yml
index 171b9f160c..ea859c3622 100644
--- a/addons/addon-base-raas/packages/base-raas-cfn-templates/src/templates/onboard-account.cfn.yml
+++ b/addons/addon-base-raas/packages/base-raas-cfn-templates/src/templates/onboard-account.cfn.yml
@@ -427,7 +427,7 @@ Resources:
       ManagedPolicyArns:
         - !Ref PolicyCfnStatus
       PermissionsBoundary: !Ref PolicyCfnStatus
-  
+
   PolicyCfnStatus:
     Type: AWS::IAM::ManagedPolicy
     Properties:
@@ -441,8 +441,6 @@ Resources:
               - cloudformation:GetTemplate
             Resource: !Sub 'arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/initial-stack*'
 
-
-
   # VPC for launching EMR clusters into
   # Just one AZ as we're aiming for transient low-cost clusters rather than HA
   VPC:
@@ -805,11 +803,11 @@ Outputs:
   EncryptionKeyArn:
     Description: KMS Encryption Key Arn
     Value: !GetAtt [EncryptionKey, Arn]
-  
+
   OnboardStatusRoleArn:
     Description: The arn of the role SWB uses to check permissions status
     Value: !GetAtt [CfnStatusRole, Arn]
-    
+
   #------------AppStream Output Below-------
   PrivateAppStreamSubnet:
     Description: AppStream subnet
@@ -867,4 +865,4 @@ Outputs:
     Condition: isAppStream
     Value: !Ref SagemakerNotebookEndpoint
     Export:
-      Name: !Join ['', [Ref: Namespace, '-SageMakerVPCE']]
\ No newline at end of file
+      Name: !Join ['', [Ref: Namespace, '-SageMakerVPCE']]
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/__tests__/aws-accounts-service.test.js b/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/__tests__/aws-accounts-service.test.js
index 694a336dd1..72a9ff68a8 100644
--- a/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/__tests__/aws-accounts-service.test.js
+++ b/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/__tests__/aws-accounts-service.test.js
@@ -41,6 +41,9 @@ const S3ServiceMock = require('@aws-ee/base-services/lib/s3-service');
 jest.mock('@aws-ee/base-services/lib/aws/aws-service');
 const AwsServiceMock = require('@aws-ee/base-services/lib/aws/aws-service');
 
+jest.mock('@aws-ee/base-services/lib/plugin-registry/plugin-registry-service');
+const PluginRegistryService = require('@aws-ee/base-services/lib/plugin-registry/plugin-registry-service');
+
 const AwsAccountService = require('../aws-accounts-service');
 
 describe('AwsAccountService', () => {
@@ -48,6 +51,8 @@ describe('AwsAccountService', () => {
   let dbService = null;
   let s3Service = null;
   let lockService = null;
+  let pluginService = null;
+  let settingsService = null;
   beforeEach(async () => {
     // Initialize services container and register dependencies
     const container = new ServicesContainer();
@@ -58,6 +63,7 @@ describe('AwsAccountService', () => {
     container.register('settings', new SettingsServiceMock());
     container.register('lockService', new LockServiceMock());
     container.register('s3Service', new S3ServiceMock());
+    container.register('pluginRegistryService', new PluginRegistryService());
     container.register('awsAccountService', new AwsAccountService());
     container.register('aws', new AwsServiceMock());
     await container.initServices();
@@ -67,6 +73,8 @@ describe('AwsAccountService', () => {
     dbService = await container.find('dbService');
     s3Service = await container.find('s3Service');
     lockService = await container.find('lockService');
+    pluginService = await container.find('pluginRegistryService');
+    settingsService = await container.find('settings');
 
     // Skip authorization by default
     service.assertAuthorized = jest.fn();
@@ -369,4 +377,56 @@ describe('AwsAccountService', () => {
       );
     });
   });
+
+  describe('checkForActiveNonAppStreamEnvs', () => {
+    it('should not throw error if plugin returns empty array', async () => {
+      // BUILD
+      const requestContext = {};
+      settingsService.getBoolean = jest.fn(() => {
+        return true;
+      });
+      pluginService.visitPlugins = jest.fn(() => {
+        return [];
+      });
+      const awsAccountId = 'sampleAwsAccountId';
+
+      // OPERATE & CHECK
+      await service.checkForActiveNonAppStreamEnvs(requestContext, awsAccountId);
+    });
+
+    it('should not throw error if AppStream is disabled', async () => {
+      // BUILD
+      const requestContext = {};
+      settingsService.getBoolean = jest.fn(() => {
+        return false;
+      });
+      const awsAccountId = 'sampleAwsAccountId';
+
+      // OPERATE & CHECK
+      await service.checkForActiveNonAppStreamEnvs(requestContext, awsAccountId);
+    });
+
+    it('should throw error if AppStream is enabled and plugin returns non-empty array', async () => {
+      // BUILD
+      const requestContext = {};
+      settingsService.getBoolean = jest.fn(() => {
+        return true;
+      });
+      pluginService.visitPlugins = jest.fn(() => {
+        return [{ id: 'env1' }];
+      });
+      const awsAccountId = 'sampleAwsAccountId';
+
+      // OPERATE
+      try {
+        await service.checkForActiveNonAppStreamEnvs(requestContext, awsAccountId);
+        expect.hasAssertions();
+      } catch (err) {
+        // CHECK
+        expect(err.message).toEqual(
+          'This account has active non-AppStream environments. Please terminate them and retry this operation',
+        );
+      }
+    });
+  });
 });
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/__tests__/aws-cfn-service.test.js b/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/__tests__/aws-cfn-service.test.js
index 20a3d1e136..ce495c9fc9 100644
--- a/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/__tests__/aws-cfn-service.test.js
+++ b/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/__tests__/aws-cfn-service.test.js
@@ -41,6 +41,9 @@ const Logger = require('@aws-ee/base-services/lib/logger/logger-service');
 jest.mock('@aws-ee/base-services/lib/aws/aws-service');
 const AwsService = require('@aws-ee/base-services/lib/aws/aws-service');
 
+jest.mock('@aws-ee/base-services/lib/plugin-registry/plugin-registry-service');
+const PluginRegistryService = require('@aws-ee/base-services/lib/plugin-registry/plugin-registry-service');
+
 jest.mock('../aws-accounts-service');
 const AwsAccountsServiceMock = require('../aws-accounts-service');
 
@@ -152,6 +155,7 @@ describe('AwsAccountService', () => {
     container.register('cfnTemplateService', new CfnTemplateMock());
     container.register('aws', new AwsService());
     container.register('log', new Logger());
+    container.register('pluginRegistryService', new PluginRegistryService());
     container.register('awsAccountsService', new AwsAccountsServiceMock());
     container.register('awsCfnService', new AwsCfnService());
     await container.initServices();
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/aws-accounts-service.js b/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/aws-accounts-service.js
index ec27f4bf06..ba86ee9fa3 100644
--- a/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/aws-accounts-service.js
+++ b/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/aws-accounts-service.js
@@ -40,6 +40,7 @@ class AwsAccountsService extends Service {
       'lockService',
       's3Service',
       'auditWriterService',
+      'pluginRegistryService',
       'aws',
     ]);
   }
@@ -261,6 +262,28 @@ class AwsAccountsService extends Service {
     return result;
   }
 
+  async checkForActiveNonAppStreamEnvs(requestContext, awsAccountId) {
+    if (!this.settings.getBoolean(settingKeys.isAppStreamEnabled)) return;
+
+    const pluginRegistryService = await this.service('pluginRegistryService');
+    const activeNonAppStreamEnvs = await pluginRegistryService.visitPlugins(
+      'aws-account-mgmt',
+      'getActiveNonAppStreamEnvs',
+      {
+        payload: {
+          awsAccountId,
+        },
+      },
+      { requestContext, container: this.container },
+    );
+
+    if (!_.isEmpty(activeNonAppStreamEnvs))
+      throw this.boom.badRequest(
+        'This account has active non-AppStream environments. Please terminate them and retry this operation',
+        true,
+      );
+  }
+
   async update(requestContext, rawData) {
     // ensure that the caller has permissions to update the account
     // Perform default condition checks to make sure the user is active and is admin
@@ -278,6 +301,9 @@ class AwsAccountsService extends Service {
     const by = _.get(requestContext, 'principalIdentifier.uid');
     const { id, rev } = rawData;
 
+    // Verify active Non-AppStream environments do not exist
+    await this.checkForActiveNonAppStreamEnvs(requestContext, id);
+
     // Prepare the db object
     const dbObject = _.omit(this._fromRawToDbObject(rawData, { updatedBy: by }), ['rev']);
 
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/aws-cfn-service.js b/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/aws-cfn-service.js
index 9763750182..69284b87c4 100644
--- a/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/aws-cfn-service.js
+++ b/addons/addon-base-raas/packages/base-raas-services/lib/aws-accounts/aws-cfn-service.js
@@ -127,6 +127,7 @@ class AwsCfnService extends Service {
       'jsonSchemaValidationService',
       'authorizationService',
       'auditWriterService',
+      'pluginRegistryService',
       'cfnTemplateService',
       'awsAccountsService',
       's3Service',
@@ -183,6 +184,9 @@ class AwsCfnService extends Service {
     const cfnTemplateService = await this.service('cfnTemplateService');
     const s3Service = await this.service('s3Service');
 
+    // Verify active Non-AppStream environments do not exist
+    await awsAccountsService.checkForActiveNonAppStreamEnvs(requestContext, accountId);
+
     const account = await awsAccountsService.mustFind(requestContext, { id: accountId });
     cfnTemplateInfo.template = await cfnTemplateService.getTemplate('onboard-account');
     cfnTemplateInfo.region = this.settings.get(settingKeys.awsRegion);
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/__tests__/environment-sc-service.test.js b/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/__tests__/environment-sc-service.test.js
index 28a579dc01..a6e3a477a4 100644
--- a/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/__tests__/environment-sc-service.test.js
+++ b/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/__tests__/environment-sc-service.test.js
@@ -1399,8 +1399,8 @@ describe('EnvironmentSCService', () => {
     });
   });
 
-  describe('filterAppStreamProjectEnvs function', () => {
-    it('should filter out envs by AppStream config', async () => {
+  describe('markAppStreamConfigured function', () => {
+    it('should mark envs by AppStream config', async () => {
       // BUILD
       const requestContext = {
         principal: {
@@ -1426,11 +1426,17 @@ describe('EnvironmentSCService', () => {
         {
           id: 'env-1',
           projectId: 'proj-1',
+          isAppStreamConfigured: true,
+        },
+        {
+          id: 'env-2',
+          projectId: 'proj-2',
+          isAppStreamConfigured: false,
         },
       ];
 
       // OPERATE
-      const retVal = await service.filterAppStreamProjectEnvs(requestContext, envs);
+      const retVal = await service.markAppStreamConfigured(requestContext, envs);
 
       // CHECK
       expect(retVal).toEqual(expected);
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-connection-service.js b/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-connection-service.js
index 3f78999bbf..955eaed3f4 100644
--- a/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-connection-service.js
+++ b/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-connection-service.js
@@ -92,10 +92,13 @@ class EnvironmentScConnectionService extends Service {
       'pluginRegistryService',
     ]);
     // The following will succeed only if the user has permissions to access the specified environment
-    const env = await environmentScService.mustFind(requestContext, { id: envId });
+    const { outputs, projectId } = await environmentScService.mustFind(requestContext, { id: envId });
+
+    // Verify environment is linked to an AppStream project when application has AppStream enabled
+    await environmentScService.verifyAppStreamConfig(requestContext, projectId);
 
     // TODO: Handle case when connection is about an auto scaling group instead of specific instance
-    const result = await cfnOutputsToConnections(env.outputs);
+    const result = await cfnOutputsToConnections(outputs);
 
     // Give plugins chance to adjust the connection (such as connection url etc)
     const adjustedConnections = await Promise.all(
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-service.js b/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-service.js
index f4ce05b23f..f035f6ab03 100644
--- a/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-service.js
+++ b/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-service.js
@@ -97,13 +97,13 @@ class EnvironmentScService extends Service {
       });
 
     if (this.isAppStreamEnabled()) {
-      envs = await this.filterAppStreamProjectEnvs(requestContext, envs);
+      envs = await this.markAppStreamConfigured(requestContext, envs);
     }
 
     return this.augmentWithConnectionInfo(requestContext, envs);
   }
 
-  async filterAppStreamProjectEnvs(requestContext, envs) {
+  async markAppStreamConfigured(requestContext, envs) {
     const projectService = await this.service('projectService');
     const projects = await projectService.list(requestContext);
     const appStreamProjectIds = _.map(
@@ -111,7 +111,10 @@ class EnvironmentScService extends Service {
       'id',
     );
 
-    return _.filter(envs, env => _.includes(appStreamProjectIds, env.projectId));
+    return _.map(envs, env => {
+      env.isAppStreamConfigured = _.includes(appStreamProjectIds, env.projectId);
+      return env;
+    });
   }
 
   async pollAndSyncWsStatus(requestContext) {
@@ -513,9 +516,6 @@ class EnvironmentScService extends Service {
       existingEnvironment,
     );
 
-    // Verify environment is linked to an AppStream project when application has AppStream enabled
-    await this.verifyAppStreamConfig(requestContext, existingEnvironment.projectId);
-
     const by = _.get(requestContext, 'principalIdentifier.uid');
     const { id, rev } = environment;
 
@@ -670,6 +670,9 @@ class EnvironmentScService extends Service {
 
     const { status, outputs, projectId } = existingEnvironment;
 
+    // Verify environment is linked to an AppStream project when application has AppStream enabled
+    await this.verifyAppStreamConfig(requestContext, projectId);
+
     // expected environment run state based on operation
     let expectedStatus;
     switch (operation) {
diff --git a/main/solution/backend/config/infra/cloudformation.yml b/main/solution/backend/config/infra/cloudformation.yml
index 727814998c..d6aa348e5d 100644
--- a/main/solution/backend/config/infra/cloudformation.yml
+++ b/main/solution/backend/config/infra/cloudformation.yml
@@ -562,8 +562,8 @@ Resources:
               - 'arn:aws:iam::*:role/SC-*'
               - 'arn:aws:iam::*:role/swb-*'
               - 'arn:aws:iam::*:role/analysis-*'
-              - !Sub 'arn:aws:iam::*:role/*-cross-account-role' # This is required since when users onboard the main account as a member account, the onboard CFN stack would also reside there
-              - !Sub 'arn:aws:iam::*:role/*-xacc-env-mgmt'
+              - 'arn:aws:iam::*:role/*-cross-account-role' # This is required since when users onboard the main account as a member account, the onboard CFN stack would also reside there
+              - 'arn:aws:iam::*:role/*-xacc-env-mgmt'
               - 'arn:aws:iam::*:role/*-cfn-status-role'
           - Effect: Allow
             Action:
@@ -746,8 +746,9 @@ Resources:
               - 'arn:aws:iam::*:role/SC-*'
               - 'arn:aws:iam::*:role/analysis-*'
               - 'arn:aws:iam::*:role/swb-*'
-              - !Sub 'arn:aws:iam::*:role/*-cross-account-role' # This is required since when users onboard the main account as a member account, the onboard CFN stack would also reside there
-              - !Sub 'arn:aws:iam::*:role/*-xacc-env-mgmt'
+              - 'arn:aws:iam::*:role/*-cross-account-role' # This is required since when users onboard the main account as a member account, the onboard CFN stack would also reside there
+              - 'arn:aws:iam::*:role/*-xacc-env-mgmt'
+              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/${self:custom.settings.namespace}-prep-raas-master-MasterRole-*'
           - Effect: Allow
             Action:
               - logs:CreateLogGroup
@@ -761,11 +762,6 @@ Resources:
               - xray:PutTelemetryRecords
             Resource:
               - '*'
-          - Effect: Allow
-            Action:
-              - sts:AssumeRole
-            Resource:
-              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/${self:custom.settings.namespace}-prep-raas-master-MasterRole-*'
           - Effect: Allow
             Action:
               - appstream:UpdateImagePermissions
@@ -911,7 +907,7 @@ Resources:
       ManagedPolicyArns:
         - !Ref PolicyDataSourceReachabilityHandler
       PermissionsBoundary: !Ref PolicyDataSourceReachabilityHandler
-  
+
   PolicyAwsAccountOnboardingHandler:
     Type: AWS::IAM::ManagedPolicy
     Properties:
diff --git a/main/solution/backend/src/lambdas/api-handler/plugins/plugin-registry.js b/main/solution/backend/src/lambdas/api-handler/plugins/plugin-registry.js
index f075931d95..a2d39bf298 100644
--- a/main/solution/backend/src/lambdas/api-handler/plugins/plugin-registry.js
+++ b/main/solution/backend/src/lambdas/api-handler/plugins/plugin-registry.js
@@ -34,6 +34,7 @@ const legacyStrategyPlugin = require('@aws-ee/base-raas-services/lib/plugins/leg
 const baseRaasAppstreamServicesPlugin = require('@aws-ee/base-raas-appstream-rest-api/lib/plugins/services-plugin');
 const baseRaasAppstreamEnvTypeVarsPlugin = require('@aws-ee/base-raas-appstream-services/lib/plugins/env-sc-provisioning-plugin');
 const baseRaasAppStreamConnectionUrlPlugin = require('@aws-ee/base-raas-appstream-services/lib/plugins/env-sc-connection-url-plugin');
+const baseRaasAppStreamAwsAccountMgmtPlugin = require('@aws-ee/base-raas-appstream-services/lib/plugins/aws-account-mgmt-plugin');
 
 const routesPlugin = require('./routes-plugin');
 
@@ -72,6 +73,7 @@ const extensionPoints = {
 
   'schema': [baseRaasSchemaPlugin],
   'env-sc-connection-url': [baseRaasAppStreamConnectionUrlPlugin],
+  'aws-account-mgmt': [baseRaasAppStreamAwsAccountMgmtPlugin],
   'study-access-strategy': [legacyStrategyPlugin, rolesOnlyStrategyPlugin],
 };