1. AWS Organizations
Marcelo Serpa

2. Marcelo
Serpa
● Principal Software Architect
● Youtuber :D -> DevsDeValor
● AWS and GCP
● Java & DevOps
● Github: https://github.com/marceloserpa
+++
< design + inovação + software >

3. Multi-account strategy

4. Why use the multi-account
strategy?
< design + inovação + software >
+++
❏ Best practice
❏ Security Control
❏ Reduce the blast radius of the security incident
❏ Account as a container (Isolate)
❏ Cost allocation
❏ Governance
❏ Avoid service limits
Challenges
❏ Centralize Billing
❏ Complexity to manage the accounts
❏ How to monitor all accounts?

5. AWS Organizations

6. AWS organizations
< design + inovação + software >
+++
❏ Account management service
❏ Administer multiple accounts as a single unit
❏ Create new accounts / Invite existent accounts
❏ Apply policy to accounts
❏ Centralize billing
❏ Free

7. Organizational Units - OUs
< design + inovação + software >
+++
❏ Root account
❏ Create logical group and structure an hierarchy
❏ Apply policies
❏ OUs can be nested up to 5 levels deep

8. Service Control Policies (SCPs)
< design + inovação + software >
+++
❏ Organization policy
❏ Limit the AWS services, resources and API operations
that account member can use
❏ Allow and deny list

9. SCPs - Examples
< design + inovação + software >
+++
Prevent users from disabling CloudWatch or
altering its configuration
Prevent IAM users and roles from making
certain changes

10. Well-architected
< design + inovação + software >
+++

11. Organizational Units - OUs -
Benefits
< design + inovação + software >
+++
❏ Group similar accounts based on function
❏ Management policies
❏ Apply policy on multiples based on hierarchy
❏ Share resources (AWS RAM)

12. Account structure type
< design + inovação + software >
+++

13. PoC
< design + inovação + software >
+++

14. PoC
< design + inovação + software >
+++

15. Links
< design + inovação + software >
+++
❏ https://docs.aws.amazon.com/accounts/latest/reference/welcome-multiple-accounts.html
❏ https://jaychapel.medium.com/6-benefits-to-adopting-an-aws-multi-account-strategy-31d6b0ff8521
❏ https://repost.aws/questions/QUM1bqanJzTjKLt5lCPuEdSg/should-i-use-one-account-or-multiple-ac
counts
❏ https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/recommended-o
us-and-accounts.html
❏ https://aws.amazon.com/blogs/industries/defining-an-aws-multi-account-strategy-for-telecommunica
tions-companies/
❏ https://aws.amazon.com/blogs/security/how-to-use-service-control-policies-in-aws-organizations/
❏ https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.
html

16. Thanks!
< design + inovação + software >
+++
Marcelo Serpa
Principal Software Architect
marcelo.serpa@ilegra.com