Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have lots of AWS accounts

src-bin.com

Post reply on HN
Print view View original

151–160 of 176 posts

Re: Have lots of AWS accounts

#151

Post by traspler »

bilalq wrote: post #44
traspler wrote: post #36

Earlier quoted context omitted.

Multi Account is a normal pattern for AWS. They even have tools to handle that better like AWS Control Tower. Someone from AWS we talked to even mentioned it as a perk (to get the free tier on every account).

That person was misinformed or maybe the context was outside the scope of business needs. If you use link accounts within an AWS Organization, one of them becomes the payer account with consolidated billing. There's a shared free tier across all accounts. If you actually spin them up as completely separate accounts and don't link within an org, you do get extra free tiers, but most corporations would rather not have…

Ah thanks, I wasn't aware of the finer details then.

Re: Have lots of AWS accounts

#152

Post by rpep »

tomrod wrote: post #35
moralestapia wrote: post #28

Every serious project I engage on has its own: * domain (obviously) * emails also for every provider I have a different email like (google@domain, twilio@domain, etc...) * credit cards (my bank makes it super easy to just create new ones) * phone no. (I just buy a burner phone) It's a bit of a PITA but the benefits outweigh the cons. I have a clear understanding of how much each of them costs me, for instance. Plus,…

For phone, what are your thoughts on something like Google Voice instead? For emails, how do you handle email? Outlook/Google Workspace? Something else?

Google Voice only works in the US so not an option for most people.

Re: Have lots of AWS accounts

#153

Post by MayeulC »

rcrowley wrote: post #86
sameg14 wrote: post #81

Multiple AWS accounts makes life a living nightmare. We have 38 AWS accounts and it is incredibly difficult to maintain each one of them. IAM and even worse cross account IAM is horrible to author and maintain! Keeping track of resource limits and billing sucks. When using SSO, which we do, you cannot have more than one account open in the same browser at the same time. Use GCP instead, segregate your infra by projec…

Curious / product research: Are your 38 accounts all in the same organization? Do you have any human IAM users left or is it all IdP, all the time? Do you use Terraform or anything like it? Also, yes, a pox on the single-player AWS Console. I’ve at least found a way to logout from one account and login to another in the same motion but it’s still a poor experience.

I guess you could use Firefox container tabs?

Re: Have lots of AWS accounts

#154

Post by eddie8848 »

sameg14 wrote: post #81

Multiple AWS accounts makes life a living nightmare. We have 38 AWS accounts and it is incredibly difficult to maintain each one of them. IAM and even worse cross account IAM is horrible to author and maintain! Keeping track of resource limits and billing sucks. When using SSO, which we do, you cannot have more than one account open in the same browser at the same time. Use GCP instead, segregate your infra by projec…

This open source project might just be what you are looking for https://docs.commonfate.io/granted/introduction/

Re: Have lots of AWS accounts

#155

Post by vdm »

pan69 wrote: post #87
yonixw wrote: post #53

My anecdote on how we do it: - We have AWS Org - Each account has no root IAM and cost/pricing goes through root AWS Org Account - You move between accounts with AWS SSO (now IAM Federation) - No more password per account - AWS SSO standardizes boundaries across account with IAM policies, like eu-centeral-1 only for dev IAM etc. - Inside Account more granular access with IAM Assume Roles - Each account Cloudtrail to…

> You move between accounts with AWS SSO (now IAM Federation) - No more password per account The only thing I really hate about this is that it is tied/bound to your browser. If you switch browsers or use an incognito window you have to through the whole dance of setting up your account switching set up. Imagine you're in multiple orgs that are set up this way...

Chrome user profiles each have their own cookies and work quite well for this.

Re: Have lots of AWS accounts

#156

Post by belter »

gw99 wrote: post #38

I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…

This is wrong advice.

You need multiple accounts, and that has always been the best practice: [1] and [2].

Where are you keeping your Cloudtrail logs? On a Bucket on the same account!!? That is the first thing that will be wiped out, in case of a security compromise of the role, or user, that set it up.

You can also, and should, use AWS Organizations for consolidated billing [3].

Even without AWS Organizations, with a single account, particularly at an Enterprise level, you are just a step away from loosing everything. And the reason why you might loose everything, has nothing to do, with the best practice of only using the root user, (with MFA) only for the very few required tasks that force you to use the root user. [4]

One possible scenario, is if for example, the persons that have acess to the root user credentials, ( and there always be some...) are going rouge, blackmailed, or getting compromised in another way. All gone, including your remote backups in other regions...

S3 Object Lock [5] will mitigate the risks of a compromised root user but don't use only one account. Have more than one, even for your personal projects.

[1] - "Benefits of using multiple AWS accounts" - https://docs.aws.amazon.com/whitepapers/latest/organizing-yo...

[2] - "Organizing Your AWS Environment Using Multiple Accounts" - https://docs.aws.amazon.com/whitepapers/latest/organizing-yo...

[3] - "Consolidated billing for AWS Organizations" - https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2...

[4] - "Tasks that require root user credentials" - https://docs.aws.amazon.com/accounts/latest/reference/root-u...

[5] - "Protecting data with Amazon S3 Object Lock" - https://aws.amazon.com/pt/blogs/storage/protecting-data-with...

Re: Have lots of AWS accounts

#157

Post by CoolCold »

noahmasur wrote: post #104
pid-1 wrote: post #10

> My favorite way to create a network between all my services hosted in different AWS accounts is to share a VPC from a network account into all my service accounts and use security groups to authorize service-to-service communication. There’s no per-byte tax, zonal architectures are easy to reason about, and security groups work just like you expect. That's gold advice. I wish AWS RAM supported more services (like A…

> My current solution is to share my ~/aws/config with everyone so we all have the same profile names and scripts can work for everyone. If you're on Mac/Linux you could have everyone use direnv. Add a .envrc file in each git repo (or your script's subdirectory) with `export AWS_PROFILE=profilename`. Now everyone is working with the same profile names without having to pass around config files.

Just in case, can be used in WSL too, if one is on Windows

Re: Have lots of AWS accounts

#158

Post by scarface74 »

Aeolun wrote: post #127
gw99 wrote: post #38

I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…

> You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. Yeah. So you are saying it’s a great idea for 80% of all companies? > My favourite thing doing is spending 2 days opening support tickets in 10 different accounts to get a limit raised and then tracking the state of all the tickets and limit changes I agree this sucks balls t…

Then don’t do that.

There are APIs to both list all of the accounts in the organization and request service limits. It’s a three line bash script.

Let me take that back, you have to assume the role in each account using either the autogenerated Organization role or Control Tower role.

Re: Have lots of AWS accounts

#159

Post by psanford »

DangitBobby wrote: post #149
psanford wrote: post #109

Earlier quoted context omitted.

I don't know. I've found it to be pretty difficult to answer the question "which of these 1000 gcp projects are running a production workload and which are random one offs created by a dev messing around or by a google sheet script?"

So the problem is the abstraction is so easy to use to get a project going that people just litter them everywhere... how is that a problem with the platform? At least they are actually in one searchable location. How do you find your production workloads if you have 1000 AWS accounts?

In AWS we divide things up into child accounts that roughly match our org tree. Each team or service gets dev, staging, and prod child accounts. Teams have access to their child accounts and its fairly obvious what they all do, or at least, who to talk to to find out.

I think my main complaint with GCP is that it is often tied directly to an org's gsuite account. And doing things in gsuite (used to?) automatically create GCP projects behind the scenes. So you could easily get thousands of projects that the users themselves didn't even know that they had created.

If I were starting from scratch with GCP I'd use a third party IdP and not let users access it via their gsuite accounts. I suspect that would avoid most of the issues I've run into.

Re: Have lots of AWS accounts

#160

Post by andreacavagna »

sameg14 wrote: post #81

Multiple AWS accounts makes life a living nightmare. We have 38 AWS accounts and it is incredibly difficult to maintain each one of them. IAM and even worse cross account IAM is horrible to author and maintain! Keeping track of resource limits and billing sucks. When using SSO, which we do, you cannot have more than one account open in the same browser at the same time. Use GCP instead, segregate your infra by projec…

That nightmare is the reason why I started my OSS project https://github.com/Noovolari/leapp
Post reply on HN