Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

AWS Multiple Account Management

51 views

Published on

Mulitple Account Management in AWS

Published in: Technology
  • Be the first to comment

  • Be the first to like this

AWS Multiple Account Management

  1. 1. 2019.02.19
  2. 2. AWS Multiple Account Management Yihui Xu, Platform Security Architect AWS Cummunity Day Nordics 2019 2019.02.19
  3. 3. About Me AWS Multiple Account Management AWS Community Day Nordics 2019 • Yihui Xu Platform Security Architect @ Aera Payment & Identification AS • Cyber Security • IAM • DevOps • Application Security • Penetration Testing • All 5 AWS Certifications + AWS Certified Security Specialty • Microsoft Certified 2019.02.19
  4. 4. Agenda • Reasons for multiple account approach • AWS multiple account management • AWS Landing Zone • AWS Control Tower 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
  5. 5. Possible reasons for Multi-Account 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 • Department keeps the sensitive data in there own account • One account each environment (dev, test, pre-prod, prod, shared services, etc) • Acquisitions • Geo location
  6. 6. Separate AWS Account 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 Development Test Production Development Test Production eu-central-1 us-east-1 Pros: • Separate control • Separate Billing Cons: • Duplicated configuration • At least 2 reserved instance resource pool • Consistency
  7. 7. Consolidated Billing Account 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 Billing Account Development Test Production Pros: • Centralized Management • Consolidated Billing • Shared RI Cons: • More complex control • Billing Analysis
  8. 8. Multiple Billing Account 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 Billing Account Development Test Production Billing Account Development Test Production eu-central-1 us-east-1 Pros: • Native Regional Isolation • Regional Based Billing Cons: • Even More complex control • Billing Analysis
  9. 9. 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 Account Level Management
  10. 10. AWS Organizations 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 • Policy-based account management • Automated account provisioning via API • Simplified billing
  11. 11. AWS Organizations: Creation 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 https://aws.amazon.com/cn/blogs/aws/category/aws-organizations/
  12. 12. AWS Organizations: Core Concept 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 ROOT OU OU 1 OU 2 OU 3 OU 4 Service Control Policies Account Account Account Account Account Account Account
  13. 13. Whitelist v.s. Blacklist 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 • Complementary Control • Service Control Policies(SCP) to setup permission boundary • Whitelist: ALLOW boundary • Blacklist: DENY boundary
  14. 14. Permission Boundary 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 • Max permission • Don’t grant any permission
  15. 15. SCP Example 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 Root OU OU 1 OU 2 { “Effect”: “Allow”, “Action”: “*”, “Resource”: “*” } { “Effect”: “Deny”, “Action”: [ “ec2:DeleteFlowLogs”, “logs:DeleteLogGroup”, “logs:DeleteLogStream” ], “Resource”: “*” } Attached: FullAWSAccess Attached: FullAWSAccess Attached: Deny_DeleteLogs
  16. 16. Create Organization 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tutorials_basic.html
  17. 17. 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 Resource Level Management
  18. 18. Resource Level Management 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 • Centralized Control • Approval Mode • Self-Service
  19. 19. AWS CloudFormation StackSets – Centralized Control 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html • AWS CloudFormation Template • Centralized provision, update, delete multiple account across region • Highly integrated with AWS Organizations
  20. 20. AWS CloudFormation ChangeSets: Approval Mode 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html
  21. 21. AWS Service Catalog: Self-Service Action 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
  22. 22. AWS Landing Zone 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 https://aws.amazon.com/cn/solutions/aws-landing-zone/
  23. 23. AWS Control Tower 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
  24. 24. Summary 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019 • Reasons for using multiple AWS account • AWS multiple account management • AWS Landing Zone • AWS Control Tower
  25. 25. AWS Multiple Account Management AWS Community Day Nordics 20192019.02.19
  26. 26. Thank You AWS Multiple Account Management AWS Community Day Nordics 20192019.02.19
  27. 27. 2019.02.19

×