AWS Organizations is great way to mange serverless applications across different AWS Accounts (like development and production). At Moneyou we have considerable experience managing large and complex serverless application that need to adhere to the highest of standards. The tool we use to do this is called org-formation and has sparked quite some interest by other companies doing serverless.

1. Managing your
AWS Organization
using org-formation
Olaf Conijn, IT Architect

2. • Full subsidiary of ABN AMRO
• Online savings since 2008
• 0.5 mio customers in NL and DE
• Combined savings & payments product
• Small organization (<160 fte)
• Focus on UX and customer value
About Moneyou

3. Moneyou <3 Serverless
We believe Serverless greatly improves
• Time to market of solutions built
• Ability to maintain the software we built
• Cost efficiency of our IT assets
• Focus on delivering customer value
• Ability to demonstrate we are compliant

4. AWS Services typically used at Moneyou
• Some satisfy functional requirements
API GW, Lambda, DynamoDB, Step Functions
• Some satisfy nonfunctional requirements
SQS, SNS, CloudWatch
• Some satisfy IT Security requirements
Secrets Manager, IAM and AWS Organizations
Serverless, not FaaS

5. Serverless, not FaaS
Serverless services have:
• Inherently scalable
• Highly available
• Pay per use / no capacity planning
• Host security by AWS
• Compliant under PCI, SOC, ISO & others

6. AWS Organizations
• Account management service
• Provides API to create new AWS accounts
• Central insight in billing & cost analysis
• Hierarchically organize AWS accounts
• Apply policies to accounts

7. Probably for the same reason you don’t run
production software on development environments.
Why have multiple AWS accounts?

8. Why have multiple AWS accounts?
Benefits of a multi account setup
• Limited blast radius – because mistakes can happen
• Scalability – every account gets their own resource limits
• Security boundary – simplifies implementing least privilege
• Data governance – control access to GDPR governed data
• Cost monitoring – without tagging
https://dev.to/oconijn/off-to-a-great-start-with-aws-organizations-1i74
😲

9. Why have multiple AWS accounts?
Typical Serverless application design
• Components: API GW, Lambda, SNS, Dynamo DB
• Services: Unit of deployment, high cohesion (within), low coupling
• Product: Value delivered to customer, multiple environments
By default these components are accessible by all other components
within the same account (resource policy).
🤯

10. Why not use AWS Organization?
Reasons not to use AWS Organizations
• Didn’t know – well, not anymore
• Don’t care – fair enough
• Too Complex – we’ve fixed this
> npm i aws-organization-formation -g

11. AWS Organization Formation
Three main use cases
1. Infrastructure as code for AWS Organizations
2. Cross account, cross region annotated CloudFormation
3. Continuous delivery of account baseline

12. Infra as code for AWS Organizations
Support for
1. Generating code based resources in AWS Organizations
2. Creating AWS Accounts, OUs and SCPs
3. Multiple models per AWS Organization
4. Setting up Account IAM Alias, Password Policy and Enterprise Support
5. Change sets that can be reviewed and applied

13. Infra as code for AWS Organizations

14. Organization annotated CloudFormation
Support for
1. Deploying CloudFormation resources to multiple accounts
2. Referencing organization resources and attributes
3. Resolving !Ref across target AWS Accounts and Regions
4. Generating resources / producing resources `for-each` account in binding

15. Organization annotated CloudFormation
Comparison with CloudFormation StackSets
1. Both deploy stacks across multiple accounts / regions
2. Org-formation deploys stacks based on different parts of single templates
3. Org-formation supports cross account / cross region !Ref, !GetAtt
4. Support for CloudFormation, serverless.com, CDK

16. Demo: CloudTrail setup
https://github.com/OlafConijn/AwsOrganizationFormation/tree/master/examples

17. Continuous delivery of account baseline

18. Continuous delivery of account baseline
Support for
1. Defining tasks in a task file
2. Defining dependencies between tasks (DependsOn)
3. Task types: update-organization, update-stacks, include, CDK, SLS, ..
4. Extensibility (through event-bridge)
5. Task file parameters & expressions (like !Ref, !GetAtt and !Sub) in beta

19. Thank you!
• No time like the current to get started with AWS Organizations!
• Try org-formation at
https://github.com/OlafConijn/AwsOrganizationFormation
• Reach out over email: olaf.conijn at moneyou.nl
• Questions, issues, stars & PRs are welcome!