Skip to main content

Multi Account Strategy

When considering a multi-account strategy in AWS, several key elements are important to ensure an effective, secure, and manageable setup:

1. Separation of Duties and Environments​

  • Isolate environments: Create separate accounts for different environments (e.g., development, testing, staging, production). This isolation helps enforce environment-specific policies and limits the blast radius in case of security incidents or misconfigurations.
  • Separation by teams or applications: Allocate accounts based on teams, business units, or individual applications to manage resource usage, access controls, and budgets more effectively.

2. Security and Compliance​

  • Account isolation: Use individual accounts to isolate workloads and data. This helps to enforce stricter security boundaries and compliance controls.
  • Centralized identity and access management: Implement AWS Identity and Access Management (IAM) roles and AWS Organizations Service Control Policies (SCPs) to enforce account-wide policies and permissions. Consider AWS Single Sign-On (SSO) for managing user access across accounts.
  • Enable security services: Use AWS Security Hub, GuardDuty, and other security services across accounts to monitor and audit security posture.

3. Centralized Governance and Management​

  • AWS Organizations: Use AWS Organizations to manage multiple AWS accounts centrally, implement SCPs, and enforce compliance policies across accounts.
  • Service control policies (SCPs): Leverage SCPs within AWS Organizations to apply organization-wide policies, restrict or allow access to specific services, and enforce security standards.
  • Tagging and resource tracking: Establish a consistent tagging strategy across accounts to manage and identify resources for cost allocation, compliance, and automation.

4. Cost Management​

  • Consolidated billing: AWS Organizations allows consolidated billing, helping you manage and optimize costs across multiple accounts. Use AWS Cost Explorer and AWS Budgets to monitor spending in each account.
  • Cost allocation tags: Enable cost allocation tags to track expenses by different business units, projects, or teams.

5. Centralized Logging and Monitoring​

  • Centralized logging: Use a designated logging account to collect logs from other accounts using services like AWS CloudTrail, AWS Config, and Amazon CloudWatch.
  • Centralized monitoring: Implement Amazon CloudWatch and AWS Systems Manager to monitor and manage resources across multiple accounts from a central location.

6. Cross-Account Networking and Access​

  • VPC peering and Transit Gateway: Use VPC peering or AWS Transit Gateway to establish network connectivity between accounts securely.
  • Resource sharing: Utilize AWS Resource Access Manager (RAM) to share resources such as VPC subnets, Transit Gateways, or license configurations across accounts.
  • Cross-account roles: Implement cross-account IAM roles to grant access between accounts for specific tasks, reducing the need for sharing long-term credentials.

7. Automation and Scalability​

  • Infrastructure as Code: Use Infrastructure as Code (IaC) tools like AWS CloudFormation, AWS CDK, or Terraform to automate the deployment and management of resources across accounts.
  • Account vending: Consider using the AWS Control Tower service to automate the provisioning of new accounts with baseline configurations for governance, security, and networking.

8. Data Security and Encryption​

  • Data encryption: Use AWS Key Management Service (KMS) to manage and enforce encryption keys across accounts. Implement policies that require data encryption both in transit and at rest.
  • Cross-account access to data: Manage access to data resources such as Amazon S3 or DynamoDB using fine-grained access controls, ensuring that data is only accessible to the accounts that require it.

9. Operational Visibility and Incident Response​

  • Audit and logging: Enable AWS CloudTrail and AWS Config in all accounts to provide logs for auditing and tracking changes to infrastructure.
  • Security incident response: Develop an incident response plan that includes cross-account access and permissions for security teams to quickly respond to incidents.

10. Backup and Disaster Recovery​

  • Backup strategy: Use services like AWS Backup to implement a backup and disaster recovery strategy across accounts, ensuring critical data and services are recoverable.

A well-implemented multi-account strategy enhances security, simplifies management, and improves operational efficiency, providing a robust foundation for scaling AWS usage.

graph TD
    A[AWS Organization]
    subgraph SecurityOU
        B1[Log Archive Account]
        B2[Security Tooling Account]
    end
    
    subgraph SharedServicesOU
        C1[Networking Account]
        C2[Shared Services Account]
    end
    
    subgraph WorkloadsOU
        D1[Dev Account]
        D2[Test Account]
        D3[Prod Account]
        D4[Sandbox Account]
    end
    
    subgraph GovernanceOU
        E1[Management Account]
        E2[Audit Account]
    end

    A --> SecurityOU
    A --> SharedServicesOU
    A --> WorkloadsOU
    A --> GovernanceOU
    
    SecurityOU --> B1
    SecurityOU --> B2
    
    SharedServicesOU --> C1
    SharedServicesOU --> C2
    
    WorkloadsOU --> D1
    WorkloadsOU --> D2
    WorkloadsOU --> D3
    WorkloadsOU --> D4
    
    GovernanceOU --> E1
    GovernanceOU --> E2