Cloud Multi-Account Strategy
A Cloud Multi-Account Strategy is a
foundational architectural design that replaces the "single-account"
approach with multiple, isolated accounts to better manage security,
compliance, billing, and operational scale.
In this strategy, an AWS account acts as an isolation
boundary. By default, resources in one account cannot access resources in
another. This "hard boundary" is the core mechanism that makes
multi-account environments safer and more manageable as an organization grows.
Why Move to a Multi-Account Strategy?
- Blast Radius Control: If a configuration error or
security incident occurs, it is contained within a single account,
preventing a widespread outage or breach.
- Clear Cost Attribution: Each account provides a
distinct billing boundary, making it easy to track which project, team, or
department is driving specific costs.
- Security & Compliance: Different workloads have
different security needs. You can apply strict, specialized policies to an
account hosting sensitive data (like PCI/HIPAA workloads) without
hindering the flexibility of a sandbox or development account.
- Overcoming Quotas: AWS service quotas (e.g.,
limits on API calls or instances) are enforced per account. Using multiple
accounts prevents one team's high-usage workload from exhausting the
limits for the entire organization.
- Operational Independence: Teams can experiment or iterate
in their own accounts without interfering with production stability.
Recommended Account Structure
Organizations typically organize their accounts based
on function and security profile, rather than just reflecting the
company’s reporting hierarchy:
1.
Security & Audit Account: A locked-down account that aggregates all logs (CloudTrail,
VPC Flow Logs) and security alerts from across the organization.
2.
Shared Services Account: Hosts centralized resources like CI/CD pipelines, container
registries, or network transit gateways.
3.
Workload Accounts: Separate accounts for Production, Staging, and Development environments.
Sandbox/Innovation Account: A restricted, disposable area for developers to experiment, often with fixed budget caps and no connection to the production network.