Multiple AWS accounts makes life a living nightmare. We have 38 AWS accounts and it is incredibly difficult to maintain each one of them. IAM and even worse cross account IAM is horrible to author and maintain! Keeping track of resource limits and billing sucks. When using SSO, which we do, you cannot have more than one account open in the same browser at the same time. Use GCP instead, segregate your infra by project, use cloud identity/IAM and keep the head of hair you had in your 20s! You've been warned...
Have lots of AWS accounts
81–90 of 176 posts
Re: Have lots of AWS accounts
#82Earlier quoted context omitted.
We keep dev/staging/prod in different accounts, and we host some special environments for customers which is in separate accounts as well. The only reason you want to do these things is for security and liability purposes. They are not an advantage for organizing things, but rather they protect against accidental resource deletion and unauthorized / unintended access. It’s cumbersome to manage many accounts, but that…
They don't really though because in the several systems I've seen configured like that, the same staff have access to all accounts. Accidental deletion and unauthorized access should not be a possibility via policy rather than isolation, because if the former isn't done then the latter will not help. If the client demands it, sure, but charge them for the inconvenience. The main risk is hitting resource limits which…
The places I've worked just control that with SSO and groups in their auth system. Much easier to make a group in your auth software than try to create multiple permission boundaries in the same AWS account. It also makes cost allocation much easier (you don't need complicated tagging policies everywhere)
Re: Have lots of AWS accounts
#83Earlier quoted context omitted.
> Would love to hear the author's view. Instead you can hear AWS's view, which is to have one account per stage per region per service. I can't find a source but I work for Amazon and this is what was recommended to us by ProServe (the contracting branch of AWS) when we talked with them. I think it's idiotic though (because regions are 100% separated within an account, and it would easily triple the number of account…
> Instead you can hear AWS's view, which is to have one account per stage per region per service. This is exactly correct. > I think it's idiotic though (because regions are 100% separated within an account But still bound to the same service limits, no?
Service limits for regional services like EC2 are regional.
Service limits for global services like Organizations appear to only be manageable from us-east-1.
Re: Have lots of AWS accounts
#84Only if you're gonna use AWS Orgs/AWS Control Tower to help manage everything otherwise it gets wild.
Internally, Amazonians also use AWS accounts per "app" basically.
Re: Have lots of AWS accounts
#85I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…
Disagree. Shared accounts may work for a smaller org, but not for larger ones. If you need multiple accounts for isolation or data protection you can accomplish the same thing with scoped IAM policies, so you can only touch things with the correct tag or name in path, this is hard to maintain and confusing for developers. When you are large enough there's no avoiding multiple accounts as you run into API limits and h…
I worked with one of those tag based accounts a few years ago. Incredibly frustrating because it was locked down to the point you couldn't see the IAM policies and figure out what tags or metadata you were missing.
Re: Have lots of AWS accounts
#86Multiple AWS accounts makes life a living nightmare. We have 38 AWS accounts and it is incredibly difficult to maintain each one of them. IAM and even worse cross account IAM is horrible to author and maintain! Keeping track of resource limits and billing sucks. When using SSO, which we do, you cannot have more than one account open in the same browser at the same time. Use GCP instead, segregate your infra by projec…
Curious / product research: Are your 38 accounts all in the same organization? Do you have any human IAM users left or is it all IdP, all the time? Do you use Terraform or anything like it?
Also, yes, a pox on the single-player AWS Console. I’ve at least found a way to logout from one account and login to another in the same motion but it’s still a poor experience.
Re: Have lots of AWS accounts
#87My anecdote on how we do it: - We have AWS Org - Each account has no root IAM and cost/pricing goes through root AWS Org Account - You move between accounts with AWS SSO (now IAM Federation) - No more password per account - AWS SSO standardizes boundaries across account with IAM policies, like eu-centeral-1 only for dev IAM etc. - Inside Account more granular access with IAM Assume Roles - Each account Cloudtrail to…
> You move between accounts with AWS SSO (now IAM Federation) - No more password per account
The only thing I really hate about this is that it is tied/bound to your browser. If you switch browsers or use an incognito window you have to through the whole dance of setting up your account switching set up. Imagine you're in multiple orgs that are set up this way...
Re: Have lots of AWS accounts
#88Multiple AWS accounts makes life a living nightmare. We have 38 AWS accounts and it is incredibly difficult to maintain each one of them. IAM and even worse cross account IAM is horrible to author and maintain! Keeping track of resource limits and billing sucks. When using SSO, which we do, you cannot have more than one account open in the same browser at the same time. Use GCP instead, segregate your infra by projec…
You don't need to sso in each and every account, you can just have a user in the main org (or at any point in the org tree that is most appropriate) and assume the role within the account you want to manage.
Re: Have lots of AWS accounts
#89> My favorite way to create a network between all my services hosted in different AWS accounts is to share a VPC from a network account into all my service accounts and use security groups to authorize service-to-service communication. There’s no per-byte tax, zonal architectures are easy to reason about, and security groups work just like you expect. That's gold advice. I wish AWS RAM supported more services (like A…
Synchronizing ~/aws/config gets harder and harder as your team grows because there are both more people who need to receive changes and more people making changes. I think the human-readable names for AWS accounts need to be part of the account, not part of the laptop. Substrate [1] does this so that you can type commands like `substrate assume-role -domain example -environment production -quality beta` [2] to get wh…
One place I worked just committed it to the git repo (obviously just SSO and account numbers, no passwords or tokens)
Re: Have lots of AWS accounts
#90There is a practical problem: AWS has a very restrictive policy for deleting sub-accounts. From: https://docs.aws.amazon.com/organizations/latest/APIReferenc... "You can only close 10% of active member accounts within a rolling 30 day period. This quota is not bound by a calendar month, but starts when you close an account. Within 30 days of that initial account closure, you can't exceed the 10% account closure limit…
Somewhere I worked used to just run awsnuke and move them to a "deleteme" OU. I guess that's an option if you're okay with a bunch of empty accounts (they have a few hundred in there)