3 ms·
Historically yes. Your job is to evolve this configuration as security controls improve. It's not a fire and forget process, it's continuous improvement.
by gw99 4y ago
Historically yes. Your job is to evolve this configuration as security controls improve. It's not a fire and forget process, it's continuous improvement.
- cameronh90 4y agoOr you can just use multiple accounts, which makes things a whole bunch easier. Frankly, AWS is just missing a level of abstraction here. Azure has resource groups, Gcloud has projects. An AWS account now is just used instead of those concepts, despite it being heavyweight and awkward to do so.
- nijave 4y agoThere's plenty of tools to automate the creation and management of new accounts. The biggest hurdle afaik is there's no automated way to delete an account Azure also has higher-level subscriptions
- rcrowley 4y agoAWS recently added the organizations:CloseAccount API (albeit with some caveats discussed elsewhere in this comment tree).
- cameronh90 4y agoIt does, but account creation is kind of slow, and the whole control tower / SSO / etc. stuff is fairly janky. Clearly Amazon have been trying to make the account a more common level of isolation for some time and it's improving, but it's still not fantastic. Support also still has a minimum monthly pricing and isn't cross-account.