We (http://gruntwork.io http://gruntwork.io) are still establishing best practices around managing multiple AWS accounts, but so far having a single "admin" acc

We (http://gruntwork.io http://gruntwork.io) are still establishing best practices around managing multiple AWS accounts, but so far having a single "admin" account where all IAM Users are managed seems like a best practice. You can then implement a nifty dropdown that allows IAM Users to easily switch accounts. [1] I'm not sure about how IAM Groups fits into this. For IAM Roles, we use Infrastructure-as-Code (Terraform) to create all those anyway, so I still prefer to create those in the AWS account that contains the resources to which they apply. [1] https://aws.amazon.com/blogs/security/enable-a-new-feature-in-the-aws-management-console-cross-account-access/ https://aws.amazon.com/blogs/security/enable-a-new-feature-i...