4 ms·
When you are a large company, you outgrow the limits of a single AWS account per environment pretty quickly, and you start splitting out functional areas or ser
by joneholland 9y ago
When you are a large company, you outgrow the limits of a single AWS account per environment pretty quickly, and you start splitting out functional areas or services into their own accounts.
These endpoints solve the last piece of the puzzle, for having components communicate. Until now, we've had to do public ELB's with restricted security groups, or VPN tunnels.
- closeparen 9y agoIs IAM not sufficient for separating things within an organization?
- joneholland 9y agoYou run into all kinds of hard and soft limits when you have thousands of instances. The other thing to think about is scaling for people. Do you really want 100+ teams in one account? What about cost tracking ? Etc etc. Lots of reasons to have an account per team, or ideally, an account per service.
- toomuchtodo 9y agoIt is not. Some services don’t currently support IAM segregation. We have hundreds of AWS accounts all within AWS Orgs, based on organizational units and SDLC phase. Orchestrating infrastructure across that many accounts poses some interesting (and fun!) challenges.