This presentation focus on evolution of AWS Account & the need for multi-account. What is AWS Organizations, how do you setup and use it effectively as well as efficiently create and manage multiple AWS accounts with consolidated billing, centralized logging, security and controlled policy. We will have look at the Service Control Policy, a sample multi-account strategy and the best practices while dealing with multi-accounts.

1. PUNE

2. AWS Organizations &
Service Control Policy
Bhuvaneswari Subramani | Feb 2020

3. Bhuvaneswari Subramani (Bhuvana)
Director, Engineering Operations, Infor
AWS Community Hero
Currently working on Cloud Computing, DevOps &,
Performance QA
https://installjournal.blogspot.com

4. Agenda
• Evolution of AWS Adoption
• Why you need multi-account ?
• AWS Organizations
• AWS Organizations - Setup
• Service Control Policies
• Multi-account Strategy

5. Evolution of AWS Adoption

6. What is an AWS Account?
A Container for your AWS Resources
You can create / manage resources in
your account
Access controlled through Identity &
Access Management

7. Evolution of AWS Adoption
Incrementally
& Organically
Mergers &
Acquisition
Security &
Compliance
Isolation of
Application or
Environment

8. Why you need AWS Multi-
Account?

9. Why you need multi-account?

10. You need multi-account for ..
Cost optimization and billing
Security & governance
Limit the blast radius
Resource grouping
Defining business units

11. Single vs Multiple AWS accounts
Dev
Test
Prod

12. Single vs Multiple AWS accounts
Dev
Test
Prod
Dev
Test
Prod

13. AWS Organizations

14. What is AWS Organizations?
Central governance and management across all
your AWS accounts

15. AWS Organizations - Key Features
Manage & define your organization and
accounts
Control access and permissions
Audit, monitor, and secure your
environment for compliance
Share resources across accounts
Centrally manage costs and billing

16. AWS Organizations – Steps to Create & Configure
Create
organization
Create
organizational
units
Create
or
Invite
member
Account
Create
service
control
policies
Test
Restrictions
AWS Organizations creates OrganizationalAccountAccessRole in member account
Member account to request for root user password

17. Root
OU
AWS
Account
AWS
Account
AWS
Account
AWS
Account
AWS
Account
AWS
Account
Policy Policy Policy
OU
OU
AWS
Account
OU
AWS Organizations - Components

18. Root
OU
AWS
Account
AWS
Account
AWS
Account
AWS
Account
AWS
Account
AWS
Account
Policy Policy Policy
OU
OU
AWS
Account
OU
AWS Organizations
Account
Limits 1
1000
1000
5
5

19. AWS Organizations – Components …
Ø Invitation - The process of asking another account to join your organization
Ø Handshake - A multi-step process of exchanging information between two parties
Ø Feature Set
Ø All Features - shared billing functionality + all features (default)
Ø Consolidated billing - shared billing functionality
Note: All features enabled back to consolidated billing features is not allowed
Ø Service Control Policies
Ø Tag Policies
Ø Allow lists vs Deny lists
Ø Default is FullAWSAccess; replace with desired set of permissions
Works with All Features

20. AWS Organizations – Access Mechanisms
AWS Management
Console
AWS Command Line
Tools
AWS SDKs
AWS Organizations
HTTPS Query API

21. AWS Organizations – Setup

22. Master account: AWS Organizations

23. Master account: Invite an existing account

24. Master account: Invite an existing account

25. Member account: Invitation notification

26. Member account: View member details

27. Master account: Notification to registered email id

28. Master account: Member accepted Invite

29. Master account: Member Declined Status

30. Master account: Create OUs

31. Master account: Move member to OU

32. Master account: Remove a member account

33. Master account: Remove a member account

34. Service Control Policies

35. Service Control Policies
• SCPs can be enabled or Disabled in the root
• No impact on master account; impacts linked
accounts only
• Don’t grant permissions; only ALLOW or DENY
• Example:
• SCP for Master OU to DENY CloudTrail for member
accounts;
All logs will be recorded by CloudTrail in master account
• SCP for "database" account to allow only database service
access
Any user, group, or role in "database" account is denied
access to any other service's operations.

36. Service
Control
Permissions
IAM
Permissions
What users can actually do ?

37. AWS Multi-Account Strategy

38. Multi-Account Strategy Account
Structure
Consolidated
Billing
Network
Architecture
Central Logging
Identity & Access
Management
Let’s discuss how best an
enterprise can have isolated
environments on separate AWS
accounts with consolidated
billing, centralized logging,
security and controlled policy.

39. Account Structure
Master
account
(root OU)
OU_1
Security &
audit
account
OU_2
Shared
services
account
OU_3
Application
account(s)

40. Account Structure
Master
account
(root OU)
OU_1
Security &
audit
account
OU_2
Shared
services
account
OU_3
Application
account(s)
How many accounts?
Well, No one-size-fits-all answer

41. Account Structure
Master
account
(root OU)
OU_1
Security &
audit
account
OU_2
Shared
services
account
OU_3
Application
account(s)

42. Account Structure
Master
account
(root OU)
OU_1
Security &
audit
account
OU_2
Shared
services
account
OU_3
Application
account(s)
Dev
Test
Prod

43. How do you apply SCPs?
Master
account
(root OU)
OU_1
Security &
audit
account
OU_2
Shared
services
account
OU_3
Application
account(s)

44. Consolidated Billing

45. Networking Architecture

46. Log Everything
Centrally

47. Log Everything
Centrally
AWS
CloudTrail
• Enable in All regions
• Log to central bucket in security
account
AWS
Config
• Turn on & log to central
bucket in security account
• Include global resources
VPC
Flowlogs
Application
Logs
Amazon S3
Amazon
Glacier

48. Log Everything
Centrally
AWS
CloudTrail
•Enable in All regions
•Log to central bucket in security
account
AWS
Config
•Turn on & log to central bucket in
security account
•Include global resources
VPC
Flowlogs
Application
Logs
Amazon
ElasticSearch
Amazon S3
Amazon
Glacier
Amazon EC2 Amazon
CloudWatch

49. Identity & Access Management
• IAM
• AWS Active Directory
Service
Cross-
account
Roles
• SAML
• Custom Identity Providers
• Web IdentitiesFederation

50. IAM
Security

51. Managing Multi-Accounts – Best Practice
Ø Use a group alias rather than an individual email address as the
account email address
Ø Create and implement AWS tagging standards across your
accounts
Ø Verify Compliance regularly
Ø Leverage compliance monitoring scripts to monitor your accounts

52. https://installjournal.blogspot.com
https://www.linkedin.com/in/bhuvanas/
@installjournal
Let’s harness the power of multi-
account through AWS Organization..