This is fascinating. One thing that worries me: billing. If I have six different AWS accounts will I have to update six different places any time my credit card expires?
[deleted]
Have lots of AWS accounts
61–70 of 176 posts
Re: Have lots of AWS accounts
#62I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…
> You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with.
I would flip it around and say that historically AWS has had extremely inconsistent architecture and IAM policy design that can make it very hard, sometimes impossible, to do it the "right way".
The nice thing about using separate accounts is you don't have to get into as many of the hairy weeds and the permissions you end up might end up being much simpler to create and then also to maintain down the road, since everything is isolated by default and then you allowlist only the things you need.
I don't see why you would frame this as "you fucked up" in your design.
Re: Have lots of AWS accounts
#63Here‘s a very detailed step-by-step tutorial on how to realize resource-separation without giving up single sign-on with AWS:
https://manuel.kiessling.net/2020/12/29/single-sign-on-and-r...
Only one of several ways to achieve that, but one that works really well for me.
Re: Have lots of AWS accounts
#64I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…
> You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. I would flip it around and say that historically AWS has had extremely inconsistent architecture and IAM policy design that can make it very hard, sometimes impossible, to do it the "right way". The nice thing about using separate accounts is you don't have to get into as man…
Even if it only protects you from fuck ups, isn't that part of good design? People WILL make mistakes, limiting the blast radius of a fuck up is important.
Re: Have lots of AWS accounts
#65I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…
> You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. I would flip it around and say that historically AWS has had extremely inconsistent architecture and IAM policy design that can make it very hard, sometimes impossible, to do it the "right way". The nice thing about using separate accounts is you don't have to get into as man…
Historically yes. Your job is to evolve this configuration as security controls improve. It's not a fire and forget process, it's continuous improvement.
Re: Have lots of AWS accounts
#66Multiple AWS accounts is definitely a best practice in larger engineering orgs. We implemented a CloudFormation StackSet to ingest them into our billing tool and lay them out appropriately. This proved to be a very slick solution from AWS so it made me believe that they want their larger customers to use multiple accounts too.
If you are smaller I would not recommend it. Many things become a little more difficult, as others have pointed out. Oftentimes a devops or platform engineering org will paper over these things.
Re: Have lots of AWS accounts
#67My anecdote on how we do it: - We have AWS Org - Each account has no root IAM and cost/pricing goes through root AWS Org Account - You move between accounts with AWS SSO (now IAM Federation) - No more password per account - AWS SSO standardizes boundaries across account with IAM policies, like eu-centeral-1 only for dev IAM etc. - Inside Account more granular access with IAM Assume Roles - Each account Cloudtrail to…
AWS Control Tower is great to set all of this up. It's basically a layer on top of AWS SSO, AWS Org, Cloudtrail, AWS Config. With some sane default security policies.
Re: Have lots of AWS accounts
#68I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…
You’re absolutely right, I’ve fucked up plenty. That’s why I believe so strongly in making the right thing the easy thing. I think I’m doomed if it’s critical for tags to be perfect because they always drift, doomed if IAM policies must be least-privilege because sometimes that’s impossible, and doomed if I can’t adapt what I built yesterday to what my business needs today.
PS good job partitioning your EKS clusters, even within one account. That’ll save you some sleep one day, I’m sure.
Re: Have lots of AWS accounts
#69AWS gets many things more right, but I think GCP wins on how they handle Projects and Managed Instance Groups for auto-scaling.
GCP organization structure is such a breath of fresh air after dealing with AWS. AWS Orgs and all the complexity with VPC and DNS management at a scale of hundreds of accounts is just a complete pain in the arse. GCP makes it far easier with Shared VPC and org/folder/project structure.
Re: Have lots of AWS accounts
#70One of the things I love most about google cloud is that "projects" are easy to create and easy to link to other projects. Roles and service accounts can even reference across projects, though I'm not sure I'd recommend doing that. No more faffing about with special accounts, passwords and difficult to configure shared VPCs, it all becomes so easy. Even managing the different accounts is difficult without browser ext…
AWS SSO has made it incredibly easy for us to secure and manage access to (and switch between) all our AWS accounts in the org. I'm a huge fan and recommend it.
They recently rebranded it to the super-catchy "AWS IAM Identity Center (successor to AWS SSO)". Gotta love Seattle-based tech marketing people, presumably trained at Microsoft. :)
I guess it will soon be the default user management system, and 'proper' IAM will be the low-level one. I see this as a reaction towards GCP's IMHO superior UX/system design in this aspect. I don't think they can entirely catch up because of early and bad architectural decisions regarding projects/accounts.
Also a fan, so far.