Mulitple Account Management in AWS

1. 2019.02.19

2. AWS Multiple Account Management
Yihui Xu, Platform Security Architect
AWS Cummunity Day Nordics 2019
2019.02.19

3. About Me
AWS Multiple Account Management AWS Community Day Nordics 2019
• Yihui Xu
Platform Security Architect @ Aera Payment & Identification AS
• Cyber Security
• IAM
• DevOps
• Application Security
• Penetration Testing
• All 5 AWS Certifications + AWS Certified Security Specialty
• Microsoft Certified
2019.02.19

4. Agenda
• Reasons for multiple account approach
• AWS multiple account management
• AWS Landing Zone
• AWS Control Tower
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019

5. Possible reasons for Multi-Account
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
• Department keeps the sensitive data in there own account
• One account each environment (dev, test, pre-prod, prod, shared services, etc)
• Acquisitions
• Geo location

6. Separate AWS Account
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
Development
Test
Production
Development
Test
Production
eu-central-1 us-east-1
Pros:
• Separate control
• Separate Billing
Cons:
• Duplicated configuration
• At least 2 reserved
instance resource pool
• Consistency

7. Consolidated Billing Account
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
Billing Account
Development Test Production
Pros:
• Centralized Management
• Consolidated Billing
• Shared RI
Cons:
• More complex control
• Billing Analysis

8. Multiple Billing Account
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
Billing Account
Development Test Production
Billing Account
Development Test Production
eu-central-1 us-east-1
Pros:
• Native Regional Isolation
• Regional Based Billing
Cons:
• Even More complex control
• Billing Analysis

9. 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
Account Level Management

10. AWS Organizations
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
• Policy-based account management
• Automated account provisioning via API
• Simplified billing

11. AWS Organizations: Creation
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
https://aws.amazon.com/cn/blogs/aws/category/aws-organizations/

12. AWS Organizations: Core Concept
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
ROOT OU
OU 1 OU 2
OU 3 OU 4
Service Control Policies
Account
Account
Account Account Account Account Account

13. Whitelist v.s. Blacklist
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
• Complementary Control
• Service Control Policies(SCP) to setup permission boundary
• Whitelist: ALLOW boundary
• Blacklist: DENY boundary

14. Permission Boundary
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
• Max permission
• Don’t grant any permission

15. SCP Example
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
Root OU
OU 1 OU 2
{
“Effect”: “Allow”,
“Action”: “*”,
“Resource”: “*”
}
{
“Effect”: “Deny”,
“Action”: [
“ec2:DeleteFlowLogs”,
“logs:DeleteLogGroup”,
“logs:DeleteLogStream”
],
“Resource”: “*”
}
Attached: FullAWSAccess
Attached: FullAWSAccess
Attached: Deny_DeleteLogs

16. Create Organization
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tutorials_basic.html

17. 2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
Resource Level Management

18. Resource Level Management
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
• Centralized Control
• Approval Mode
• Self-Service

19. AWS CloudFormation StackSets –
Centralized Control
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html
• AWS CloudFormation Template
• Centralized provision, update, delete multiple
account across region
• Highly integrated with AWS Organizations

20. AWS CloudFormation ChangeSets:
Approval Mode
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html

21. AWS Service Catalog: Self-Service Action
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019

22. AWS Landing Zone
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
https://aws.amazon.com/cn/solutions/aws-landing-zone/

23. AWS Control Tower
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019

24. Summary
2019.02.19 AWS Multiple Account Management AWS Community Day Nordics 2019
• Reasons for using multiple AWS account
• AWS multiple account management
• AWS Landing Zone
• AWS Control Tower

25. AWS Multiple Account Management AWS Community Day Nordics 20192019.02.19

26. Thank You
AWS Multiple Account Management AWS Community Day Nordics 20192019.02.19

27. 2019.02.19