11 ms·
An AWS account just for getting into other AWS accounts
- flyinprogrammer 4y agohttps://aws.amazon.com/controltower/ https://aws.amazon.com/controltower/ If we all started using Control Tower perhaps they'd get funded enough to continue to build it out and make it awesome.
- rcrowley 4y agoIn the meantime, check out Substrate <https://src-bin.com/substrate/ https://src-bin.com/substrate/> and don’t worry about waiting for AWS to improve.
- metadat 4y agoMr. Crowley, did you forget to mention / disclose your association and financial interest tied to this product? For context, https://www.linkedin.com/in/richarddcrowley https://www.linkedin.com/in/richarddcrowley indicates he works there.
- benatkin 4y agoIt's a bit different of a situation from the usual product recommendations because the domain of the article and link in the comment is the same.
- chronotis 4y agoSeems relevant to me. The article is from your organization, and that information is something I wouldn't have known if not for the prior commenter's comment.
- hatware 4y agoWhat a weird comment.
- abrookewood 4y agoKind of .. I think it's good that people are encouraged to disclose their interests on HN as a matter of course.
- hatware 4y agoA DM is reasonable. Calling someone out in public like that is childish.
- JimDabell 4y agoThere aren‘t any DMs on Hacker News, and if he didn’t post that comment I would have thought it was a disinterested commenter recommending something they had used, not somebody who works on the project. The cultural norm here is to disclose when you are recommending your own product and it’s not childish to point out when people fail to do that, it’s reinforcing that cultural norm.
- hatware 4y ago> There aren‘t any DMs on Hacker News Good thing they... (checks notes) ...know exactly who made the post and can reach out to them on LinkedIn or email them. Cultural norms are reinforced by good examples, there's nothing good about snippy public comments. Reaching out to them privately isn't hard, and, dare I say it: is more inclusive. I don't think I need to explain the origin of the word assume.
- Akronymus 4y ago> , there's nothing good about snippy public comments. It didn't seem snippy to me. "Why aren't you disclosing your ties" would be IMO. The message that was actually posted seemed quite diplomatic.
- rcrowley 4y agoThe same link’s in the second sentence of the article. But, sure, I forgot.
- smcleod 4y agoFar out - that website looks dodgy as. What on earth is going on with its fonts - it looks like a newspaper vomited onto the screen.
- fazfq 4y agoIt looks completely normal to me?
- smcleod 4y agoI thought it was just on my phone, but it's goofy as on the desktop too, this is what it looks like for me in Firefox: https://imgur.com/a/o0vGIq8 https://imgur.com/a/o0vGIq8
- x86_64Ubuntu 4y agoIt looks like it's a super un-Javascripted website. It's only about 2.8MB to load when looking in Chrome Developer view.
- rcrowley 4y agoIt’s set in Computer Modern, the font Donald Knuth designed for TeX and which you most often encounter in academic papers.
- jcims 4y agoIf config can go this long with half-assed implementation I don’t see why control tower is going to fare better with more adoption. Most large enterprises are going to want to roll their own anyway.
- thedougd 4y agoThe guy or gal that's been working on it the last two years has slowly been working through my bucket list. If I can just get guardrails that configure the basic AWS security foundation stuff like password policies, I'll be satisfied. And oddly enough, the CloudFormation coverage for this stuff is abysmal. We don't even allow IAM users in the member accounts, but we really need to check off this compliance box.
- dmak 4y agoI looked at the landing page, but don't really understand when I would use this. Could you give a few examples of why this is useful?
- TYPE_FASTER 4y agoCentralized management and application of IAM policy with the goal of giving teams the freedom to manage their own account, including account security, while still protecting the organization as a whole. When customers request single tenancy in the cloud, where single tenancy is referring to an AWS account, being able to automate account management will be important when trying to scale.
- dmak 4y agoThanks!
- wrnu 4y agohttps://github.com/aws-samples/aws-secure-environment-accelerator https://github.com/aws-samples/aws-secure-environment-accele... I've used the ASEA to get a number of organizations setup. I prefer it to Control Tower (it can be installed on top of CT). The ASEA is open source and written in AWS cdk so it can be forked and modified if needed.
- scarface74 4y ago> If you wish to provide access via SSH… Don’t do this. I can’t think of a single reason that anyone ever needs to SSH directly into a server on AWS in 2022. Use System Manager Session Manager https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html https://docs.aws.amazon.com/systems-manager/latest/userguide... Short explanation: it allows you to access a Linux instance via SSH using SSM as an IAM controlled proxy or use RDP for Windows. You don’t need ingress access to your instance or even egress internet access if your security policies mandate it as long as you set up the correct service endpoints. Also, just use Control Tower and federate it with your IDP - Active Directory, Okta, etc.
- datalopers 4y agoA lot of us are busy solving business needs in smaller companies/startups and don't have the time nor expertise to learn every single AWS service and come up with a justification for utilizing it.
- scarface74 4y agoControl Tower is literally a click once and it sets everything up for you.
- raffraffraff 4y agoThis is an example of why the basic AWS Cloud Architect Associate exam is a good idea. It's how I learned about ControlTower (after using AWS for years)
- jacurtis 4y agoA lot of these tools actually make your life easier and faster in the long run. ControlTower for example. Takes about 30 mins to setup on normal AWS (on GovCloud it was much more complicated, took me half a day). But then setting up new accounts is one click and it’s preconfigured with correct restrictions and security measures, which individually would take several hours per account to do without controltower. So it’s an easy savings from the beginning. The only real cost is the cost of AWS config. So if you’re using that already (for SecurityHub for example) then it’s nothing additional. IAM Identity Center makes user management not only more secure but faster and easier. It will take half a day to maybe a full day to setup the first time. But now every new user will be a few clicks with access across multiple AWS accounts. You can remove them in one click across all accounts. So these are just really simple additions to your workflow that save you time and improve security. SSM is another example. It’s adding a policy to your instance role and checking a box (or adding a flag in Terraform or CLI) and it’s enabled. It’s no additional cost. It saves you time because you don’t need to manage user accounts on the server anymore (they are managed broadly through IAM or PermissionSets). No more copying around SSH keys or rotating them when people leave. It improves security and saves you time. There’s little (if any at all) downside to any of these things. It’s all upside. For the most part, these don’t even have any significant costs associated with them. They are generally provided for free where you’re only cost is the underlying resources that you’re managing, which of course your paying for regardless.
- benatkin 4y agoWhat's this like on Google Cloud? Would you create a project to get into other projects and would that achieve most of what this achieves? And would you use a GSuite address so you don't log into the console just by logging into the email?
- reilly3000 4y agoEverything in GCP is built atop the Google Auth system and tied to a GSuite domain. It’s Org->Folder->Project hierarchy is very similar to AWS Orgs. However, it’s far easier from there. IAM is tied to your gsuite email, and service accounts are also email addresses. One never needs to login with different creds to access another project. You just use your Google login or activate a service account. Projects are a really flexible abstraction. My company has one for every stage for every team plus specialized projects for net/VPC, GCR, logs, etc, hundreds in total. We’re about halfway through the F500 list. Projects are a nice abstraction and getting the setup OP described is a lot more idiomatic to GCP.
- rcrowley 4y agoAll rings true, to me.
- movedx 4y ago> One never needs to login with different creds to access another project. You just use your Google login or activate a service account. It's the same in AWS with AWS SSO/IAM Center. You only login once, and you can access every other account (project) you're allowed to access.
- kevincox 4y agoBut you need to keep going back to the SSO console to switch accounts because only one can be active at once. With GCP you can have multiple tabs open with different accounts. The best part is that the account is in the URL so you can just link to specific resources in different accounts. So many of our runbooks for GCP are like "click this link" whereas for AWS it is "make sure you are looked into {specific-account} then click this link". The latter is much more error prone and can break your workflow if you were doing something in a different account previously.
- pkrumins 4y agoI have 1 AWS account for everything and th
- jagged-chisel 4y agoIs this humor? I honestly can’t tell.
- icedchai 4y agoIt's tough to say. The last company I worked for (a self-described "unicorn") literally used one AWS account for everything: dev, test, and prod.
- HyperSane 4y agoThat is a very bad idea.
- icedchai 4y agoI know! They set it up like that years ago. You’d think they’d at least have moved dev out of it.
- pram 4y agoOn the other hand, the company I’m working for now has over 50 accounts for different team envs and it’s a nightmare at times. Terraform provider and workspaces don’t “scale” well when you need to juggle all those roles, for example.
- deleted 4y ago[deleted]
- Octabrain 4y agoSame in the previous company I worked for. All in one account, spending millions of dolards on it, terrible architecture. From the top of my head: Unecessary peerings everywhere, bad subnet configuration that provoked network conflicts in certain cases, no autoscaling, IAM access based exclusively on keys, no VPN etc And if that wasn't enough, everything was "done" with one of the most terrible examples of "automation" I've ever seen in my whole life: A huge Terraform mono repo with hundreds of files with hundreds of duplicated resource calls (because they didn't even use modules). It took them at least a week for just adding a simple IAM user without breaking anything else and the CD would take hours to finish. An absolute nightmare. As no one else in the company had experience with the cloud, the team managing all I mention was threated as some kind of supreme elite as everyone else though they were doing a great job. Beyond me.
- medina 4y agoRe-discovering Active Directory Enhanced Security Administrative Environment (ESAE) / Red Forest design, in cloud :-)
- rcrowley 4y agoHonestly, having lived a parallel life to the Windows ecosystem, TIL about “red forest.” I do think, though, that cross-account AWS actions are much more first-class than it sounds like jumping between forests ever was.
- epberry 4y agoVery nice write up. As a billing guy I especially liked the tip about using resource policies to enable cross-account access and save on KMS request costs. There's one issue with companies using hundreds of AWS accounts if you're a vendor to them: integrating services. Some folks here may be interested in a technique called "CloudFormation StackSets" which can deploy bits of infrastructure to multiple AWS accounts in one command. Vantage uses this to setup our billing integration and we wrote up the method here, https://www.vantage.sh/blog/using-cloudformation-stacksets-to-onboard-hundreds-of-member-aws-accounts https://www.vantage.sh/blog/using-cloudformation-stacksets-t...
- diceduckmonk 4y agoWhat tool do people here use to search across AWS accounts? Disclaimer: we are building a search engine to search for resources across “workspaces”. In AWS, this unit is the Account. In GCP, this unit is the Project.
- manv1 4y agoThat would be a handy tool.
- diceduckmonk 4y agoOur competitor should let you do this but in CLI form https://steampipe.io/ https://steampipe.io/ They’re great, check them out. We couldn’t build from source the last time we tried, but it is open source. We just made a decision today to open source our UI, so let us know if you’re interested
- throwawaaarrgh 4y agoCloudHealth. 1500 AWS accounts, it does the job well enough
- suzzer99 4y ago"1500 AWS accounts" You just blew my mind. We have two accounts and it gets messy sometimes.
- throwawaaarrgh 4y agoFor an IdP it seems like Dex combined with an LDAP server would be the simplest and most flexible solution. For reliability, I'm curious about throwing together a really simple LDAP server that stores records in AWS S3. That way your IdP can be trivially replicated with as much reliability as you want and nearly no maintenance. (Dex's storage can be Etcd, but I would also look to implement S3 storage)
- raffraffraff 4y ago> a really simple LDAP server that stores records in AWS S3 ... Like glauth? https://github.com/glauth/glauth https://github.com/glauth/glauth
- ManuelKiessling 4y agoVery similar, but with visualizations of how things integrate with each other, and concrete code examples: https://manuel.kiessling.net/2020/12/29/single-sign-on-and-resource-separation-on-aws/ https://manuel.kiessling.net/2020/12/29/single-sign-on-and-r...
- tedk-42 4y agoThese type of articles make me wanna quit doing anything in IT. It's not a criticism of the author, more the current state of technology in AWS. I'd really like to have just 1 AWS account where I can see and do everything there and not keep switching and think about account IDs or which account has what S3 bucket/server whatever.
- deadbunny 4y agoThe really frustrating things is that while AWS make the "Account" their best isolation layer they make managing those accounts with their tooling absolutely awful.
- garbagebin 4y agowhat kind of tooling are you looking for?
- canucklady 4y agoSame. My current company has the same problem, which is that they continually layer additional complexity onto their previous architectural mistakes to try and mitigate them. This results in a complicated system where different independent parts all interact with each other like a rube goldberg machine. The dynamics of the resulting system become sort of perilous and unknowable, and it paralyzes future changes because nobody can predict the nth order effects.
- singlow 4y agoThen do it. Why does your activity in IT depend on what someone on the internet says? For the rest of us, multi-account setups offer a large number of advantages that outweigh the inconveniences and we have built tooling to deal with most of those anyway.
- manv1 4y agoIt's always a tradeoff between blast radius and (in)convenience. With everything in one account someone might accidentally destroy your production environment. That'll be awkward to explain. And with IAC, it could be as simple as one change to a VPC config that recreates instead of updates the VPC. In normal IT (not Twitter) you usually have a production and test environment at least. The inconvenience more than makes up for accidentally destroying something in production. And before you say anything, if you haven't done that you haven't been in IT for long enough. However, if you want to do it your way you should become the director and make it that way. You'll be sorry, but that'll be on your head. I'm not sure if that's possible, but I haven't checked.
- gh0stcloud 4y agothe fact that this is probably good practice just shows how ridiculously confusing AWS is
- albert_e 4y ago> Don’t do this! Any principal in your management account, by default, is able to assume the OrganizationAccountAccessRole in each and every one of the accounts created using the organizations:CreateAccount API. I should note that if you use AWS Control Tower Account Factory to create the member accounts then this role does not get created. The "Audit" account that is created by Control Tower is probably the best one to serve as the Administrative Access Account
- jeremya 4y ago> Any principal in your management account, by default, is able to assume the OrganizationAccountAccessRole in each and every one of the accounts created using the organizations:CreateAccount API. This is an untrue statement. For a principal in the management account to assume OrganizationAccountAccessRole, they need to have a principal-based policy that gives sts:AssumeRole permissions for it. Otherwise, great article. We use this pattern at $DAYJOb