Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have lots of AWS accounts

src-bin.com

Post reply on HN
Print view View original

41–50 of 176 posts

Re: Have lots of AWS accounts

#41

Post by rcrowley »

traspler wrote: post #40

At the company I work they just built their „Landing Zone“ as AWS calls it with all the on-prem connectivity, shared VPCs, Product Catalogs, IAM restrictions to the moon and so on and every team gets their own account linked to that one. It‘s an enormous amount of work to get all of that to work nicely together but when it works it‘s very nice and allows for a great way to partition responsibilities. For smaller depl…

Substrate [1] is meant to help folks not make a mess of lots of AWS accounts. Would love to know if it feels less enormous.

[1] https://src-bin.com/substrate/>

Re: Have lots of AWS accounts

#42

Post by moralestapia »

tomrod wrote: post #35
moralestapia wrote: post #28

Every serious project I engage on has its own: * domain (obviously) * emails also for every provider I have a different email like (google@domain, twilio@domain, etc...) * credit cards (my bank makes it super easy to just create new ones) * phone no. (I just buy a burner phone) It's a bit of a PITA but the benefits outweigh the cons. I have a clear understanding of how much each of them costs me, for instance. Plus,…

For phone, what are your thoughts on something like Google Voice instead? For emails, how do you handle email? Outlook/Google Workspace? Something else?

I've never used Google Voice so I cannot say about that. Where I'm at you can buy a cheap phone for like $20 and it comes with a prepaid SIM that never expires. I have about 10 of those on a drawer on my desk LOL, it goes well with the hacker vibe B). Funny thing is I don't have them labeled, so when I need it I have to turn on all of them to see which one gets an SMS.

For email, my domain provider handles email for me as well, I have a Google Workspace account and first thing I do when I set up an email is to link it there so I have a single Inbox for everything. (Although my real Inbox is the Spam folder, where a lot of genuine emails land now).

Re: Have lots of AWS accounts

#43

Post by rcrowley »

twblalock wrote: post #30

I've seen this tried. It required a considerable investment in tooling and people to run it, because the dev teams just want to run their apps and don't want to manage accounts. And that's just the management complexity -- cross-account network adds a ton of complexity to other stuff, including VPC management, transit gateways, and sometimes DNS. Compared to having fewer accounts, the difference in complexity is enor…

Substrate [1] is meant to lessen the investment required to use lots of AWS accounts. Would love to know how it looks to you.

[1] https://src-bin.com/substrate/>

Re: Have lots of AWS accounts

#44

Post by bilalq »

traspler wrote: post #36
Havoc wrote: post #9

Isn’t that against terms since it activates a free tier credit?

Multi Account is a normal pattern for AWS. They even have tools to handle that better like AWS Control Tower. Someone from AWS we talked to even mentioned it as a perk (to get the free tier on every account).

That person was misinformed or maybe the context was outside the scope of business needs. If you use link accounts within an AWS Organization, one of them becomes the payer account with consolidated billing. There's a shared free tier across all accounts. If you actually spin them up as completely separate accounts and don't link within an org, you do get extra free tiers, but most corporations would rather not have the headache that comes with that.

Re: Have lots of AWS accounts

#45

Post by moralestapia »

simonw wrote: post #32
moralestapia wrote: post #28

Every serious project I engage on has its own: * domain (obviously) * emails also for every provider I have a different email like (google@domain, twilio@domain, etc...) * credit cards (my bank makes it super easy to just create new ones) * phone no. (I just buy a burner phone) It's a bit of a PITA but the benefits outweigh the cons. I have a clear understanding of how much each of them costs me, for instance. Plus,…

Which bank is that?

BBVA (operates in LATAM and Spain)

They give you an app where you can create virtual credit cards. Quite neat, I literally waited for something like that for decades.

Coincidentally, I just set up a Mercury account last week and I think they have a similar feature but haven't explored it yet.

Re: Have lots of AWS accounts

#46

Post by forgomonika »

simonw wrote: post #29

This is fascinating. One thing that worries me: billing. If I have six different AWS accounts will I have to update six different places any time my credit card expires?

AWS Organizations (https://aws.amazon.com/organizations/) is supposed to solve this for you. If all your accounts are in the same Organization then you get one bill instead of six.

Re: Have lots of AWS accounts

#47

Post by rcrowley »

malcolp wrote: post #21

I love this approach, although I'm yet to work anywhere that does this. I guess the million (thousand?) dollar questios now become where do you draw the boundary across accounts? Presumably there are many bad ways to slice accounts up. And what happens when accounts do need to communicate? I can imagine three major scenarios for cross account permissions: * Cross account iam policies (painful in my experience) * Addi…

Author here: I have settled on account per service per environment with a couple of exceptions.

Sometimes I run multiple services in one account if they’re so tightly coupled as to be useless as a group if any one is down. (This has practically come up when two services are codesigned to multiplex TCP connections to support tens of millions of clients.)

Sometimes I run a single stateless production service in two accounts and route 10% of traffic to the canary account and 90% to the other one.

Re: Have lots of AWS accounts

#48

Post by rcrowley »

simonw wrote: post #29

This is fascinating. One thing that worries me: billing. If I have six different AWS accounts will I have to update six different places any time my credit card expires?

As the other commenter notes, no, you still have just one bill.

Better, though, that one bill is broken down by account so you can see where the money’s going.

Re: Have lots of AWS accounts

#49

Post by forgomonika »

mattpallissard wrote: post #18

> AWS accounts are the most complete form of isolation on offer. Because it's a pretty brutal namespace. While I usually wind up with separate accounts for multiple reasons, I strongly prefer to get rbac/iam properly implemented in a single account wherever possible.

> I strongly prefer to get rbac/iam properly implemented in a single account wherever possible.

This can really help manage complexity but it the more this account grows the riskier it becomes if a bad actor breaks into the account (ranging from fraudsters/hackers to disgruntled employees).

Re: Have lots of AWS accounts

#50

Post by jackson1442 »

forgomonika wrote: post #46
simonw wrote: post #29

This is fascinating. One thing that worries me: billing. If I have six different AWS accounts will I have to update six different places any time my credit card expires?

AWS Organizations ( https://aws.amazon.com/organizations/ ) is supposed to solve this for you. If all your accounts are in the same Organization then you get one bill instead of six.

You can also use AWS SSO (IAM Identity Center now) in conjunction with Organizations to federate into your AWS accounts using any SAML IdP.
Post reply on HN