4 ms·
What’s the right granularity to shard aws accounts? I haven’t gone down this road. Is it madness to consider this as a multi tenant mechanism vs the usual forei
by gfodor 7y ago
What’s the right granularity to shard aws accounts? I haven’t gone down this road. Is it madness to consider this as a multi tenant mechanism vs the usual foreign keys in the database approach? Is applying cloudformation across thousands of accounts feasible?
- mrkurt 7y agoI feel like the harder part of that would be migrations on databases and application code deploys. CloudFormation to configure VPCs would probably work fine. If you're going to do that, though, you may as well do CloudFormation into customer VPCs and let them do all the "paying Amazon".
- shortj 7y agoProbably the most useful mechanism I have for determining this is “if this AWS account disappears, how screwed am I / can I recover.” I tend to separate all of my projects/services, and each of those to environments. A cold storage AWS account, audit and security (ship logs, config changes, etc), shared services to another account. If dev account gets hacked, that sucks, but we can clear it out. It prod gets hacked (and deleted!) that super sucks. But hopefully cold storage and audit accounts can help us out. If some other services/projects account gets hacked, I don’t want to be worried about impact to unrelated projects.
- gfodor 7y agoNice approach - for cold storage what do you mean exactly? Manually rsynced backups or something? Most aws services I’ve used that have backups built in I don’t recall having cross account writability.
- shortj 7y agoRDS snapshot copying, EBS snapshot copies, S3 cross account bucket replication, etc. Write only with no entry points into that account from your other accounts. (Preferably its own locked down IAM role with MFA required)
- gfodor 7y agoCool- stealing this, thanks! Do you do the backups w a scheduled lambda?
- jamesblonde 7y agoWe also use test roles on top of separate dev/prod accounts. It has save us already a couple of times when somebody deleted all instances (by mistake), but the blast radius was kept small.
- akhilcacharya 7y agoWhat's wrong with region + stage?
- kevan 7y agoThink about where you need fault boundaries (e.g. cellular, zonal, regional, global) and match your account structure to that if possible. In practice that usually means one account per cell/zone/region per environment (test/prod).