Have Lots of AWS Accounts
src-bin.com
Have Lots of AWS Accounts
1–9 of 9 posts
Re: Have Lots of AWS Accounts
#2But then if yoy pay for support it only works in one account
Re: Have Lots of AWS Accounts
#3But then if yoy pay for support it only works in one account
Enterprise support agreements are organization-wide.
Although, you can gamify Business support (which is priced as a percentage of your bill) to not include things like your CloudTrail account, which probably never require support, but can get expensive across a large enough organization.
Re: Have Lots of AWS Accounts
#4But then if yoy pay for support it only works in one account
Assuming you're playing the "only pay for a business support plan when you actually need to file a ticket" game like me, with a very slight amount of effort this works in your favor instead of being a downside. Put your expensive-but-reliable stuff (e.g. large 24/7 EC2 instances, your S3 buckets) in one account and your cheap-but-fiddly stuff (e.g. your EKS cluster) in another account. When you need support on the fiddly stuff you're only paying a percent of that account.
At work we did not follow this advice, so we have a single account and we're vulnerable to an unnecessarily high support bill if we happen to need to file a ticket in an expensive month. We could have avoided this with account segmentation; our expensive stuff tends not to be the stuff we need support on.
Re: Have Lots of AWS Accounts
#5But then if yoy pay for support it only works in one account
Assuming you're playing the "only pay for a business support plan when you actually need to file a ticket" game like me, with a very slight amount of effort this works in your favor instead of being a downside. Put your expensive-but-reliable stuff (e.g. large 24/7 EC2 instances, your S3 buckets) in one account and your cheap-but-fiddly stuff (e.g. your EKS cluster) in another account. When you need support on the fi…
This seems like a ton of work
Re: Have Lots of AWS Accounts
#6If you use aws control tower to set up your stuff, this will happen sort of automatically.
Its been recommended practice for ages...
Use SCP (service control policy) to disable any services and regions you dont use. Tada. Much harder to get unexpected bill, much easier to enforce audit etc.
Re: Have Lots of AWS Accounts
#7Earlier quoted context omitted.
Assuming you're playing the "only pay for a business support plan when you actually need to file a ticket" game like me, with a very slight amount of effort this works in your favor instead of being a downside. Put your expensive-but-reliable stuff (e.g. large 24/7 EC2 instances, your S3 buckets) in one account and your cheap-but-fiddly stuff (e.g. your EKS cluster) in another account. When you need support on the fi…
This seems like a ton of work
That's always the case with AWS: reducing costs takes legwork, and by the same token, you can avoid legwork by accepting a higher bill.
Re: Have Lots of AWS Accounts
#8Root account for billing and AWS Identity Center. Dev account for all the crap and lax permissions so people can try stuff. Production account with only production and extremely strict permissions where changes can only be made with terraform or a god mode account.
Re: Have Lots of AWS Accounts
#9Thank god I was saved from having to read the first two words of that headline. We should have faulty paternalistic algorithms governing even more of our lives.