Have lots of AWS accounts

I love this approach, although I'm yet to work anywhere that does this.

I guess the million (thousand?) dollar questios now become where do you draw the boundary across accounts? Presumably there are many bad ways to slice accounts up. And what happens when accounts do need to communicate?

I can imagine three major scenarios for cross account permissions:

* Cross account iam policies (painful in my experience) * Adding trust policies to enable cross account assuming roles (better but limited) * Limiting cross account policies to specific easy to configure services. E.g. S3 (best option, I've seen but maybe too limited)

Would love to hear the author's view.

> Would love to hear the author's view.

Instead you can hear AWS's view, which is to have one account per stage per region per service.

I can't find a source but I work for Amazon and this is what was recommended to us by ProServe (the contracting branch of AWS) when we talked with them.

I think it's idiotic though (because regions are 100% separated within an account, and it would easily triple the number of accounts to manage), and so did my team, so we stuck with one account per stage per service.

That said, cross account permissions is really not an issue, it's very easy and straightforward to setup. You also should not need it in 90% of the cases if your application is properly split with the right ownership for each microservice.

For my current team we manage probably more than a thousand AWS accounts, and permissions are never an issue. Neither is anything else actually. We aggregate metrics in a single account for the stuff that needs to be aggregated, we have small CLI scripts that automate tedious steps like requesting limit increases, etc.

Each account within the organization gets the limits of the free tier, just as a single account would. I think the reasoning is that if you're going to go through the hassle of setting up orgs then you're probably an enterprise user slated to take the long haul anyway.

> But still bound to the same service limits, no?

I'm not sure what you are referring to (pricing or service quotas?, I will assume the latter), but I think it depends on the service. For some setting the service quota will be per region and for others it will be global.

One I know that is for sure regional is the limit reserved concurrent executions of Lambda functions.

This is fascinating.

One thing that worries me: billing. If I have six different AWS accounts will I have to update six different places any time my credit card expires?