SlideShare a Scribd company logo
A Multi-Account Strategy for SMEs
AWS Community Summit Manchester, April 2nd 2019
Who Are We?
© 2019 RealityMine. All rights reserved. !3
RealityMine
Real moments. Real actions. Real intelligence. Real life revealed.
RealityMine enables the world’s leading market research organisations to monitor real consumers
across multiple devices and on all major operating systems. This permission-based data collection
provides unique insights into the behaviour of consumers and is integrated by agencies into
syndicated products, audience measurement currencies and custom research globally.
© 2019 RealityMine. All rights reserved. !4
Who Am I?
Objectives
© 2019 RealityMine. All rights reserved. !6
Objectives
Why have multiple accounts
Ways to design your account layout
An example layout strategy
Migrating to multi-account
Security and logging
Permissions and role management
Centralising user accounts
© 2019 RealityMine. All rights reserved. !7
Why Multiple Accounts?
Isolation
Separate account limits
Allow experimentation
Keep auditors happy
Accounts are free
Billing is consolidated
User management can be centralized
The Layout
© 2019 RealityMine. All rights reserved. !9
The Layout
Sandbox
Security/Users
BackupDevelopmentProduction
Target Accounts
Migration
© 2019 RealityMine. All rights reserved. !11
Migrating to Multi-Account
Choose or create a new ‘Master’ account
Launch Organizations at https://console.aws.amazon.com/organizations/
Choose `Create Organization` – choose All Features or Consolidated Billing
Wait and verify master account email address
Create new sub accounts or invite existing accounts
New accounts have a role created - `OrganizationAccountAccessRole`
Root password requires reset to use
Sub accounts will get marketing emails unless disabled
https://pages.awscloud.com/communication-preferences.html
© 2019 RealityMine. All rights reserved. !12
Service Control Policies (SCP)
Like IAM policies, but deny access
Applied to selected accounts through Organizations
Applies to the entire account, including Root
Restricts unwanted actions
Can now use fine-grained controls
Security & Logging
© 2019 RealityMine. All rights reserved. !14
Security and Logging
Create S3 buckets in the Security/Users account for –
• Cloudtrail
• Config
• Bucket Logs
In master account -
• Enable Cloudtrail with Multi-Region enabled and for Organisation
• Busy accounts – disable Cloudwatch Logs
In each account, in each region -
• Enable Config
• Can aggregate data together from multiple accounts
Permissions & Role Management
© 2019 RealityMine. All rights reserved. !16
Permissions Management
How to define the roles – it depends on your business structure -
• Team
• Staff role
• Developers and Senior Developers
• Non-Certified and Certified
• All users the same
Create a Sandbox/Playground
Have developers own the policies for their applications
© 2019 RealityMine. All rights reserved. !17
Suggested Permissions
Be careful of managed policies – some are very open
AWSElasticBeanstalkFullAccess contains –
iam:PassRole
s3:*
ec2:*
… for any resource
Separate control plane from data plane actions
Allow users to do any read only control plane calls
Restrict data plane calls to their own team/product and where required
Be more flexible on roles used by automation
Have a process for making changes
Centralising user accounts
© 2019 RealityMine. All rights reserved. !19
IAM Store
Users exist in one account only – username, password, access keys
Role switch into target account – IAM permissions control which roles they can choose
Target accounts trust the Security/Users account
Easily manage roles, groups and trusts across multiple accounts:
https://github.com/awslabs/aws-iam-generator
© 2019 RealityMine. All rights reserved. !20
IAM Store – How it Works
MFA token
Security/Users
Production
Development
IAM
AWS-STS
Role
Role
© 2019 RealityMine. All rights reserved. !21
IAM Store – Group Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Resource": [
"arn:aws:iam::222222222222:role/Administrators",
"arn:aws:iam::333333333333:role/Administrators",
"arn:aws:iam::333333333333:role/Developers",
]
"Effect": "Allow"
}
]
}
© 2019 RealityMine. All rights reserved. !22
IAM Store – Target Account Role Trust
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:root"
},
"Action": "sts:AssumeRole"
}
]
}
© 2019 RealityMine. All rights reserved. !23
IAM Store – Login Process (Console)
© 2019 RealityMine. All rights reserved. !24
IAM Store – Login Process (Console)
© 2019 RealityMine. All rights reserved. !25
IAM Store – Login Process (CLI)
computer:~$	aws	iam	list-mfa-devices	--user	my.user		--query	"MFADevices[0].SerialNumber"	
"arn:aws:iam::111111111111:mfa/my.user”	
computer:~$	aws	sts	get-session-token	--serial-number	"arn:aws:iam::111111111111:mfa/my.user"	
--token-code	123456	
{	
				"Credentials":	{	
								"SecretAccessKey":	"SECRETACCESSKEY",		
								"SessionToken":	"SESSIONTOKEN",		
								"Expiration":	"2019-03-27T21:30:39Z",		
								"AccessKeyId":	"ACESSKEY"	
				}	
}
© 2019 RealityMine. All rights reserved. !26
IAM Store – Login Process (CLI)
computer:~$	aws	sts	assume-role	--role-arn	"arn:aws:iam::222222222222:role/MyDevAdminRole"	--
role-session-name	"MyDevAdminRole"	
{	
				"AssumedRoleUser":	{	
								"AssumedRoleId":	"ROLEID:MyDevAdminRole",		
								"Arn":	"arn:aws:sts::222222222222:assumed-role/MyDevAdminRole/MyDevAdminRole"	
				},		
				"Credentials":	{	
								"SecretAccessKey":	"SECRETACCESSKEY",		
								"SessionToken":	"SESSIONTOKEN",		
								"Expiration":	"2019-03-27T10:49:48Z",		
								"AccessKeyId":	"ACCESSKEY"	
				}	
}
© 2019 RealityMine. All rights reserved. !27
IAM Store – Login Process (CLI)
computer:~$	aws	sts	get-caller-identity	
{	
				"Account":	"222222222222",		
				"UserId":	"ROLEID:MyDevAdminRole",		
				"Arn":	"arn:aws:sts::222222222222:assumed-role/MyDevAdminRole/MyDevAdminRole"	
}
© 2019 RealityMine. All rights reserved. !28
Centralised Login Options
• Central IAM Store
• External SAML Store (e.g. Azure, ADFS, Directory Services)
• AWS SSO
• Choose not to – use local IAM store
© 2019 RealityMine. All rights reserved. !29
Key Takeaway
Accounts layout – base on environment, but keep users separate
Centralise users
Centralise logs
Create playground
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_create.html
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_create.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html
https://github.com/awslabs/aws-iam-generator
https://aws.amazon.com/answers/account-management/aws-multi-account-security-strategy/
Sandbox
Security/Users
BackupDevelopmentProduction
Target Accounts
@RealityMineTech RealityMineRealityMine.com
Dave Lewthwaite
Cloud Architect
RealityMine
Dave.lewthwaite@RealityMine.com
@davelewty

More Related Content

Similar to Multi accountstrategy | david lewthwaite

Unify security, compliance, and finance teams with governance at scale - GRC2...
Unify security, compliance, and finance teams with governance at scale - GRC2...Unify security, compliance, and finance teams with governance at scale - GRC2...
Unify security, compliance, and finance teams with governance at scale - GRC2...
Amazon Web Services
 
New AWS Security Solutions to Protect Your Workload
New AWS Security Solutions to Protect Your WorkloadNew AWS Security Solutions to Protect Your Workload
New AWS Security Solutions to Protect Your Workload
Amazon Web Services
 
Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation...
Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation...Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation...
Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation...
Amazon Web Services
 
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
Amazon Web Services
 
Control your cloud environment with AWS management tools
Control your cloud environment with AWS management toolsControl your cloud environment with AWS management tools
Control your cloud environment with AWS management tools
Amazon Web Services
 
Breaking the Ice: How Broadridge is Helping Customers Transform Cold Archiva...
 Breaking the Ice: How Broadridge is Helping Customers Transform Cold Archiva... Breaking the Ice: How Broadridge is Helping Customers Transform Cold Archiva...
Breaking the Ice: How Broadridge is Helping Customers Transform Cold Archiva...
Amazon Web Services
 
Virtual_Insurers_New_Tools_For_A_New_World
Virtual_Insurers_New_Tools_For_A_New_WorldVirtual_Insurers_New_Tools_For_A_New_World
Virtual_Insurers_New_Tools_For_A_New_World
Amazon Web Services
 
AWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best PracticesAWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best PracticesAmazon Web Services
 
Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) - AWS reInvent ...
Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) - AWS reInvent ...Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) - AWS reInvent ...
Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) - AWS reInvent ...
Amazon Web Services
 
Implementing Governance@Scale
Implementing Governance@ScaleImplementing Governance@Scale
Implementing Governance@Scale
Amazon Web Services
 
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Amazon Web Services
 
AWS identity services: Enabling and securing your cloud journey - SEC203 - Ne...
AWS identity services: Enabling and securing your cloud journey - SEC203 - Ne...AWS identity services: Enabling and securing your cloud journey - SEC203 - Ne...
AWS identity services: Enabling and securing your cloud journey - SEC203 - Ne...
Amazon Web Services
 
AWS Governance at Scale_AWSPSSummit_Singapore
AWS Governance at Scale_AWSPSSummit_SingaporeAWS Governance at Scale_AWSPSSummit_Singapore
AWS Governance at Scale_AWSPSSummit_Singapore
Amazon Web Services
 
Foundations: Understanding the Critical Building Blocks of AWS Identity and G...
Foundations: Understanding the Critical Building Blocks of AWS Identity and G...Foundations: Understanding the Critical Building Blocks of AWS Identity and G...
Foundations: Understanding the Critical Building Blocks of AWS Identity and G...
Amazon Web Services
 
Landing Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS MigrationsLanding Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS Migrations
Amazon Web Services
 
Deploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerDeploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control Tower
Amazon Web Services
 
How Millennium Management achieves provable security with AWS Zelkova - FSV30...
How Millennium Management achieves provable security with AWS Zelkova - FSV30...How Millennium Management achieves provable security with AWS Zelkova - FSV30...
How Millennium Management achieves provable security with AWS Zelkova - FSV30...
Amazon Web Services
 
GPSTEC310_IAM Best Practices and Becoming an IAM Ninja
GPSTEC310_IAM Best Practices and Becoming an IAM NinjaGPSTEC310_IAM Best Practices and Becoming an IAM Ninja
GPSTEC310_IAM Best Practices and Becoming an IAM Ninja
Amazon Web Services
 
Implementing your landing zone - FND210 - AWS re:Inforce 2019
Implementing your landing zone - FND210 - AWS re:Inforce 2019 Implementing your landing zone - FND210 - AWS re:Inforce 2019
Implementing your landing zone - FND210 - AWS re:Inforce 2019
Amazon Web Services
 
Bonus-Session-Interledger-DvP-Settlement-on-Amazon-Managed-Blockchain
Bonus-Session-Interledger-DvP-Settlement-on-Amazon-Managed-BlockchainBonus-Session-Interledger-DvP-Settlement-on-Amazon-Managed-Blockchain
Bonus-Session-Interledger-DvP-Settlement-on-Amazon-Managed-Blockchain
Amazon Web Services
 

Similar to Multi accountstrategy | david lewthwaite (20)

Unify security, compliance, and finance teams with governance at scale - GRC2...
Unify security, compliance, and finance teams with governance at scale - GRC2...Unify security, compliance, and finance teams with governance at scale - GRC2...
Unify security, compliance, and finance teams with governance at scale - GRC2...
 
New AWS Security Solutions to Protect Your Workload
New AWS Security Solutions to Protect Your WorkloadNew AWS Security Solutions to Protect Your Workload
New AWS Security Solutions to Protect Your Workload
 
Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation...
Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation...Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation...
Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation...
 
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
 
Control your cloud environment with AWS management tools
Control your cloud environment with AWS management toolsControl your cloud environment with AWS management tools
Control your cloud environment with AWS management tools
 
Breaking the Ice: How Broadridge is Helping Customers Transform Cold Archiva...
 Breaking the Ice: How Broadridge is Helping Customers Transform Cold Archiva... Breaking the Ice: How Broadridge is Helping Customers Transform Cold Archiva...
Breaking the Ice: How Broadridge is Helping Customers Transform Cold Archiva...
 
Virtual_Insurers_New_Tools_For_A_New_World
Virtual_Insurers_New_Tools_For_A_New_WorldVirtual_Insurers_New_Tools_For_A_New_World
Virtual_Insurers_New_Tools_For_A_New_World
 
AWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best PracticesAWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best Practices
 
Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) - AWS reInvent ...
Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) - AWS reInvent ...Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) - AWS reInvent ...
Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) - AWS reInvent ...
 
Implementing Governance@Scale
Implementing Governance@ScaleImplementing Governance@Scale
Implementing Governance@Scale
 
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
 
AWS identity services: Enabling and securing your cloud journey - SEC203 - Ne...
AWS identity services: Enabling and securing your cloud journey - SEC203 - Ne...AWS identity services: Enabling and securing your cloud journey - SEC203 - Ne...
AWS identity services: Enabling and securing your cloud journey - SEC203 - Ne...
 
AWS Governance at Scale_AWSPSSummit_Singapore
AWS Governance at Scale_AWSPSSummit_SingaporeAWS Governance at Scale_AWSPSSummit_Singapore
AWS Governance at Scale_AWSPSSummit_Singapore
 
Foundations: Understanding the Critical Building Blocks of AWS Identity and G...
Foundations: Understanding the Critical Building Blocks of AWS Identity and G...Foundations: Understanding the Critical Building Blocks of AWS Identity and G...
Foundations: Understanding the Critical Building Blocks of AWS Identity and G...
 
Landing Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS MigrationsLanding Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS Migrations
 
Deploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerDeploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control Tower
 
How Millennium Management achieves provable security with AWS Zelkova - FSV30...
How Millennium Management achieves provable security with AWS Zelkova - FSV30...How Millennium Management achieves provable security with AWS Zelkova - FSV30...
How Millennium Management achieves provable security with AWS Zelkova - FSV30...
 
GPSTEC310_IAM Best Practices and Becoming an IAM Ninja
GPSTEC310_IAM Best Practices and Becoming an IAM NinjaGPSTEC310_IAM Best Practices and Becoming an IAM Ninja
GPSTEC310_IAM Best Practices and Becoming an IAM Ninja
 
Implementing your landing zone - FND210 - AWS re:Inforce 2019
Implementing your landing zone - FND210 - AWS re:Inforce 2019 Implementing your landing zone - FND210 - AWS re:Inforce 2019
Implementing your landing zone - FND210 - AWS re:Inforce 2019
 
Bonus-Session-Interledger-DvP-Settlement-on-Amazon-Managed-Blockchain
Bonus-Session-Interledger-DvP-Settlement-on-Amazon-Managed-BlockchainBonus-Session-Interledger-DvP-Settlement-on-Amazon-Managed-Blockchain
Bonus-Session-Interledger-DvP-Settlement-on-Amazon-Managed-Blockchain
 

More from AWSCOMSUM

Introducing AWS DeepRacer: David Smith
Introducing AWS DeepRacer: David SmithIntroducing AWS DeepRacer: David Smith
Introducing AWS DeepRacer: David Smith
AWSCOMSUM
 
Beyond serverless.pptx
Beyond serverless.pptxBeyond serverless.pptx
Beyond serverless.pptx
AWSCOMSUM
 
Will hall - Accelerating Infrastructure as Code and Configuration Management ...
Will hall - Accelerating Infrastructure as Code and Configuration Management ...Will hall - Accelerating Infrastructure as Code and Configuration Management ...
Will hall - Accelerating Infrastructure as Code and Configuration Management ...
AWSCOMSUM
 
Onur Salk & Onur Gurdamar - Everything as Code: Creating an application stack...
Onur Salk & Onur Gurdamar - Everything as Code: Creating an application stack...Onur Salk & Onur Gurdamar - Everything as Code: Creating an application stack...
Onur Salk & Onur Gurdamar - Everything as Code: Creating an application stack...
AWSCOMSUM
 
Nils Mohr & Jake Pearce - 100 years of flight data at British Airways. Past, ...
Nils Mohr & Jake Pearce - 100 years of flight data at British Airways. Past, ...Nils Mohr & Jake Pearce - 100 years of flight data at British Airways. Past, ...
Nils Mohr & Jake Pearce - 100 years of flight data at British Airways. Past, ...
AWSCOMSUM
 
Phil Basford - machine learning at scale with aws sage maker
Phil Basford - machine learning at scale with aws sage makerPhil Basford - machine learning at scale with aws sage maker
Phil Basford - machine learning at scale with aws sage maker
AWSCOMSUM
 
Dan pudwell - AWS community summit-oct-2019
Dan pudwell - AWS community summit-oct-2019Dan pudwell - AWS community summit-oct-2019
Dan pudwell - AWS community summit-oct-2019
AWSCOMSUM
 
Mike fowler - Getting started with machine learning (london 2019)
Mike fowler - Getting started with machine learning (london 2019)Mike fowler - Getting started with machine learning (london 2019)
Mike fowler - Getting started with machine learning (london 2019)
AWSCOMSUM
 
Efi Merdler Kravitz - 7 things you should know before going serverless
Efi Merdler Kravitz - 7 things you should know before going serverlessEfi Merdler Kravitz - 7 things you should know before going serverless
Efi Merdler Kravitz - 7 things you should know before going serverless
AWSCOMSUM
 
Michelle Chismon - Anything is possible!* Learning with AWS DeepLens *But not...
Michelle Chismon - Anything is possible!* Learning with AWS DeepLens *But not...Michelle Chismon - Anything is possible!* Learning with AWS DeepLens *But not...
Michelle Chismon - Anything is possible!* Learning with AWS DeepLens *But not...
AWSCOMSUM
 
Bernd Rücker - Lost in transaction? Strategies to manage consistency in serve...
Bernd Rücker - Lost in transaction? Strategies to manage consistency in serve...Bernd Rücker - Lost in transaction? Strategies to manage consistency in serve...
Bernd Rücker - Lost in transaction? Strategies to manage consistency in serve...
AWSCOMSUM
 
Ben Bridts - $ aws help
Ben Bridts -  $ aws helpBen Bridts -  $ aws help
Ben Bridts - $ aws help
AWSCOMSUM
 
Richard pablo - IoT Provisioning Solving the nightmare
Richard pablo - IoT Provisioning Solving the nightmareRichard pablo - IoT Provisioning Solving the nightmare
Richard pablo - IoT Provisioning Solving the nightmare
AWSCOMSUM
 
Matt Houghton - AWS Comsum - October 2019
Matt Houghton - AWS Comsum - October 2019Matt Houghton - AWS Comsum - October 2019
Matt Houghton - AWS Comsum - October 2019
AWSCOMSUM
 
Bruno Amaro Almeida - What can aws tell us about fake and credible news medi...
Bruno Amaro Almeida -  What can aws tell us about fake and credible news medi...Bruno Amaro Almeida -  What can aws tell us about fake and credible news medi...
Bruno Amaro Almeida - What can aws tell us about fake and credible news medi...
AWSCOMSUM
 
Serhat Can- 4 keytakeaways from running serverless on production for 4 years
Serhat Can-  4 keytakeaways from running serverless on production for 4 yearsSerhat Can-  4 keytakeaways from running serverless on production for 4 years
Serhat Can- 4 keytakeaways from running serverless on production for 4 years
AWSCOMSUM
 
Stuart jones - Deconstructing the monolith. Migrating complex systems simply ...
Stuart jones - Deconstructing the monolith. Migrating complex systems simply ...Stuart jones - Deconstructing the monolith. Migrating complex systems simply ...
Stuart jones - Deconstructing the monolith. Migrating complex systems simply ...
AWSCOMSUM
 
Dwp achieving cloud adoption at enterprise scale | Diptesh Patel
Dwp achieving cloud adoption at enterprise scale | Diptesh PatelDwp achieving cloud adoption at enterprise scale | Diptesh Patel
Dwp achieving cloud adoption at enterprise scale | Diptesh Patel
AWSCOMSUM
 
RUNNING AWS LOCALLY
RUNNING AWS LOCALLY RUNNING AWS LOCALLY
RUNNING AWS LOCALLY
AWSCOMSUM
 
Serverless for Visual Journalism at the BBC | Doug Winter
Serverless for Visual Journalism at the BBC  |  Doug WinterServerless for Visual Journalism at the BBC  |  Doug Winter
Serverless for Visual Journalism at the BBC | Doug Winter
AWSCOMSUM
 

More from AWSCOMSUM (20)

Introducing AWS DeepRacer: David Smith
Introducing AWS DeepRacer: David SmithIntroducing AWS DeepRacer: David Smith
Introducing AWS DeepRacer: David Smith
 
Beyond serverless.pptx
Beyond serverless.pptxBeyond serverless.pptx
Beyond serverless.pptx
 
Will hall - Accelerating Infrastructure as Code and Configuration Management ...
Will hall - Accelerating Infrastructure as Code and Configuration Management ...Will hall - Accelerating Infrastructure as Code and Configuration Management ...
Will hall - Accelerating Infrastructure as Code and Configuration Management ...
 
Onur Salk & Onur Gurdamar - Everything as Code: Creating an application stack...
Onur Salk & Onur Gurdamar - Everything as Code: Creating an application stack...Onur Salk & Onur Gurdamar - Everything as Code: Creating an application stack...
Onur Salk & Onur Gurdamar - Everything as Code: Creating an application stack...
 
Nils Mohr & Jake Pearce - 100 years of flight data at British Airways. Past, ...
Nils Mohr & Jake Pearce - 100 years of flight data at British Airways. Past, ...Nils Mohr & Jake Pearce - 100 years of flight data at British Airways. Past, ...
Nils Mohr & Jake Pearce - 100 years of flight data at British Airways. Past, ...
 
Phil Basford - machine learning at scale with aws sage maker
Phil Basford - machine learning at scale with aws sage makerPhil Basford - machine learning at scale with aws sage maker
Phil Basford - machine learning at scale with aws sage maker
 
Dan pudwell - AWS community summit-oct-2019
Dan pudwell - AWS community summit-oct-2019Dan pudwell - AWS community summit-oct-2019
Dan pudwell - AWS community summit-oct-2019
 
Mike fowler - Getting started with machine learning (london 2019)
Mike fowler - Getting started with machine learning (london 2019)Mike fowler - Getting started with machine learning (london 2019)
Mike fowler - Getting started with machine learning (london 2019)
 
Efi Merdler Kravitz - 7 things you should know before going serverless
Efi Merdler Kravitz - 7 things you should know before going serverlessEfi Merdler Kravitz - 7 things you should know before going serverless
Efi Merdler Kravitz - 7 things you should know before going serverless
 
Michelle Chismon - Anything is possible!* Learning with AWS DeepLens *But not...
Michelle Chismon - Anything is possible!* Learning with AWS DeepLens *But not...Michelle Chismon - Anything is possible!* Learning with AWS DeepLens *But not...
Michelle Chismon - Anything is possible!* Learning with AWS DeepLens *But not...
 
Bernd Rücker - Lost in transaction? Strategies to manage consistency in serve...
Bernd Rücker - Lost in transaction? Strategies to manage consistency in serve...Bernd Rücker - Lost in transaction? Strategies to manage consistency in serve...
Bernd Rücker - Lost in transaction? Strategies to manage consistency in serve...
 
Ben Bridts - $ aws help
Ben Bridts -  $ aws helpBen Bridts -  $ aws help
Ben Bridts - $ aws help
 
Richard pablo - IoT Provisioning Solving the nightmare
Richard pablo - IoT Provisioning Solving the nightmareRichard pablo - IoT Provisioning Solving the nightmare
Richard pablo - IoT Provisioning Solving the nightmare
 
Matt Houghton - AWS Comsum - October 2019
Matt Houghton - AWS Comsum - October 2019Matt Houghton - AWS Comsum - October 2019
Matt Houghton - AWS Comsum - October 2019
 
Bruno Amaro Almeida - What can aws tell us about fake and credible news medi...
Bruno Amaro Almeida -  What can aws tell us about fake and credible news medi...Bruno Amaro Almeida -  What can aws tell us about fake and credible news medi...
Bruno Amaro Almeida - What can aws tell us about fake and credible news medi...
 
Serhat Can- 4 keytakeaways from running serverless on production for 4 years
Serhat Can-  4 keytakeaways from running serverless on production for 4 yearsSerhat Can-  4 keytakeaways from running serverless on production for 4 years
Serhat Can- 4 keytakeaways from running serverless on production for 4 years
 
Stuart jones - Deconstructing the monolith. Migrating complex systems simply ...
Stuart jones - Deconstructing the monolith. Migrating complex systems simply ...Stuart jones - Deconstructing the monolith. Migrating complex systems simply ...
Stuart jones - Deconstructing the monolith. Migrating complex systems simply ...
 
Dwp achieving cloud adoption at enterprise scale | Diptesh Patel
Dwp achieving cloud adoption at enterprise scale | Diptesh PatelDwp achieving cloud adoption at enterprise scale | Diptesh Patel
Dwp achieving cloud adoption at enterprise scale | Diptesh Patel
 
RUNNING AWS LOCALLY
RUNNING AWS LOCALLY RUNNING AWS LOCALLY
RUNNING AWS LOCALLY
 
Serverless for Visual Journalism at the BBC | Doug Winter
Serverless for Visual Journalism at the BBC  |  Doug WinterServerless for Visual Journalism at the BBC  |  Doug Winter
Serverless for Visual Journalism at the BBC | Doug Winter
 

Recently uploaded

Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi
Fwdays
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)
Ralf Eggert
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
Product School
 
Knowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and backKnowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and back
Elena Simperl
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
Elena Simperl
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
BookNet Canada
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Tobias Schneck
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Product School
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
Prayukth K V
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
Cheryl Hung
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Product School
 

Recently uploaded (20)

Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
 
Knowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and backKnowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and back
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
 

Multi accountstrategy | david lewthwaite

  • 1. A Multi-Account Strategy for SMEs AWS Community Summit Manchester, April 2nd 2019
  • 3. © 2019 RealityMine. All rights reserved. !3 RealityMine Real moments. Real actions. Real intelligence. Real life revealed. RealityMine enables the world’s leading market research organisations to monitor real consumers across multiple devices and on all major operating systems. This permission-based data collection provides unique insights into the behaviour of consumers and is integrated by agencies into syndicated products, audience measurement currencies and custom research globally.
  • 4. © 2019 RealityMine. All rights reserved. !4 Who Am I?
  • 6. © 2019 RealityMine. All rights reserved. !6 Objectives Why have multiple accounts Ways to design your account layout An example layout strategy Migrating to multi-account Security and logging Permissions and role management Centralising user accounts
  • 7. © 2019 RealityMine. All rights reserved. !7 Why Multiple Accounts? Isolation Separate account limits Allow experimentation Keep auditors happy Accounts are free Billing is consolidated User management can be centralized
  • 9. © 2019 RealityMine. All rights reserved. !9 The Layout Sandbox Security/Users BackupDevelopmentProduction Target Accounts
  • 11. © 2019 RealityMine. All rights reserved. !11 Migrating to Multi-Account Choose or create a new ‘Master’ account Launch Organizations at https://console.aws.amazon.com/organizations/ Choose `Create Organization` – choose All Features or Consolidated Billing Wait and verify master account email address Create new sub accounts or invite existing accounts New accounts have a role created - `OrganizationAccountAccessRole` Root password requires reset to use Sub accounts will get marketing emails unless disabled https://pages.awscloud.com/communication-preferences.html
  • 12. © 2019 RealityMine. All rights reserved. !12 Service Control Policies (SCP) Like IAM policies, but deny access Applied to selected accounts through Organizations Applies to the entire account, including Root Restricts unwanted actions Can now use fine-grained controls
  • 14. © 2019 RealityMine. All rights reserved. !14 Security and Logging Create S3 buckets in the Security/Users account for – • Cloudtrail • Config • Bucket Logs In master account - • Enable Cloudtrail with Multi-Region enabled and for Organisation • Busy accounts – disable Cloudwatch Logs In each account, in each region - • Enable Config • Can aggregate data together from multiple accounts
  • 15. Permissions & Role Management
  • 16. © 2019 RealityMine. All rights reserved. !16 Permissions Management How to define the roles – it depends on your business structure - • Team • Staff role • Developers and Senior Developers • Non-Certified and Certified • All users the same Create a Sandbox/Playground Have developers own the policies for their applications
  • 17. © 2019 RealityMine. All rights reserved. !17 Suggested Permissions Be careful of managed policies – some are very open AWSElasticBeanstalkFullAccess contains – iam:PassRole s3:* ec2:* … for any resource Separate control plane from data plane actions Allow users to do any read only control plane calls Restrict data plane calls to their own team/product and where required Be more flexible on roles used by automation Have a process for making changes
  • 19. © 2019 RealityMine. All rights reserved. !19 IAM Store Users exist in one account only – username, password, access keys Role switch into target account – IAM permissions control which roles they can choose Target accounts trust the Security/Users account Easily manage roles, groups and trusts across multiple accounts: https://github.com/awslabs/aws-iam-generator
  • 20. © 2019 RealityMine. All rights reserved. !20 IAM Store – How it Works MFA token Security/Users Production Development IAM AWS-STS Role Role
  • 21. © 2019 RealityMine. All rights reserved. !21 IAM Store – Group Policy { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Resource": [ "arn:aws:iam::222222222222:role/Administrators", "arn:aws:iam::333333333333:role/Administrators", "arn:aws:iam::333333333333:role/Developers", ] "Effect": "Allow" } ] }
  • 22. © 2019 RealityMine. All rights reserved. !22 IAM Store – Target Account Role Trust { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111111111111:root" }, "Action": "sts:AssumeRole" } ] }
  • 23. © 2019 RealityMine. All rights reserved. !23 IAM Store – Login Process (Console)
  • 24. © 2019 RealityMine. All rights reserved. !24 IAM Store – Login Process (Console)
  • 25. © 2019 RealityMine. All rights reserved. !25 IAM Store – Login Process (CLI) computer:~$ aws iam list-mfa-devices --user my.user --query "MFADevices[0].SerialNumber" "arn:aws:iam::111111111111:mfa/my.user” computer:~$ aws sts get-session-token --serial-number "arn:aws:iam::111111111111:mfa/my.user" --token-code 123456 { "Credentials": { "SecretAccessKey": "SECRETACCESSKEY", "SessionToken": "SESSIONTOKEN", "Expiration": "2019-03-27T21:30:39Z", "AccessKeyId": "ACESSKEY" } }
  • 26. © 2019 RealityMine. All rights reserved. !26 IAM Store – Login Process (CLI) computer:~$ aws sts assume-role --role-arn "arn:aws:iam::222222222222:role/MyDevAdminRole" -- role-session-name "MyDevAdminRole" { "AssumedRoleUser": { "AssumedRoleId": "ROLEID:MyDevAdminRole", "Arn": "arn:aws:sts::222222222222:assumed-role/MyDevAdminRole/MyDevAdminRole" }, "Credentials": { "SecretAccessKey": "SECRETACCESSKEY", "SessionToken": "SESSIONTOKEN", "Expiration": "2019-03-27T10:49:48Z", "AccessKeyId": "ACCESSKEY" } }
  • 27. © 2019 RealityMine. All rights reserved. !27 IAM Store – Login Process (CLI) computer:~$ aws sts get-caller-identity { "Account": "222222222222", "UserId": "ROLEID:MyDevAdminRole", "Arn": "arn:aws:sts::222222222222:assumed-role/MyDevAdminRole/MyDevAdminRole" }
  • 28. © 2019 RealityMine. All rights reserved. !28 Centralised Login Options • Central IAM Store • External SAML Store (e.g. Azure, ADFS, Directory Services) • AWS SSO • Choose not to – use local IAM store
  • 29. © 2019 RealityMine. All rights reserved. !29 Key Takeaway Accounts layout – base on environment, but keep users separate Centralise users Centralise logs Create playground https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_create.html https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_create.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html https://github.com/awslabs/aws-iam-generator https://aws.amazon.com/answers/account-management/aws-multi-account-security-strategy/ Sandbox Security/Users BackupDevelopmentProduction Target Accounts
  • 30. @RealityMineTech RealityMineRealityMine.com Dave Lewthwaite Cloud Architect RealityMine Dave.lewthwaite@RealityMine.com @davelewty