Do You Need Multiple AWS Accounts for Optimal Cloud Management? | DCN

In relation to cloud computing accounts, extra is best — at the least generally. Different occasions, it makes most sense to stay with only one or a couple of accounts.

To clarify how to decide on the fitting variety of accounts for a cloud setting, let’s discover how accounts work, the professionals and cons of a number of accounts, and why it could or could not make sense to undertake a multi-account technique.

Associated: Will AI Revolutionize Knowledge Heart Infrastructure Administration? Possibly Not

We’ll focus particularly on Amazon Net Companies, which remains the most widely used public cloud. Nonetheless, the steerage beneath applies usually to any cloud (though as we clarify, it is necessary to grasp that cloud accounts perform considerably otherwise on totally different clouds).

What Is an AWS Account?

An AWS account is a digital id that AWS assigns to clients, giving them the fitting to create and handle AWS assets. Or, as AWS defines it, an account is a “container for all of the AWS assets you create as an AWS buyer.”

Associated: Microsoft, Amazon-Backed Cloud Body in Talks Over EU Dispute

AWS uses the term “container” in this context to mean that accounts are self-contained identities. Resources managed by one account can’t be controlled or viewed by other accounts. In that respect, an account creates a virtual boundary that isolates your cloud resources.

Accounts vs. Users vs. Organizational Units

Importantly, an account in AWS is distinct from other types of identities that you can define. Specifically, an account is different from:

• Users: A user is an identity that you can assign to a specific person. You configure users on AWS using the AWS Identity and Access Management (IAM) framework. Multiple users can share under the same account, although you can also create separate accounts for each user if you wish.
• Organizational units: An organization unit, or OU, is a group of AWS accounts. You can define policies at the OU level that apply to all accounts managed through that OU. Typically, a single business would establish just one OU, although it’s possible to create multiple OUs for your company if you wish.

Single vs. Multiple AWS Accounts: How to Choose

If your business uses AWS, you can opt to create just one account that all users within your organization share. Or you can set up multiple accounts — an approach known as a multi-account strategy (not to be confused with a multi-cloud strategy, which suggests one thing totally different).

AWS leaves it as much as clients to resolve what number of accounts to create; there aren’t any guidelines requiring you to arrange a sure variety of accounts, whatever the scale at which you use or which forms of cloud providers you utilize. (AWS does impose a restrict of 5,000 whole customers per account by default, though you may request further customers beneath a single account if you happen to one way or the other end up with greater than 5,000 customers who need to share an account.)

So, how do you select? There is no easy reply, however think about the next widespread situations for establishing what number of AWS accounts to make use of:

• One account per enterprise: In case your cloud wants are comparatively small scale — if you happen to deploy only a few apps, for instance, or have a small variety of engineers who must entry the cloud — it is easiest to arrange only one account that’s shared by everybody in your enterprise. This strategy additionally ensures that everybody can simply share cloud assets; for instance, if one consumer desires to assist handle an app deployed by one other consumer, they will simply accomplish that in a single-account setup (offered the fitting IAM permissions are in place).
• One account per division or workforce: In case you have a number of departments or units of customers utilizing your cloud platform, it typically is sensible to ascertain a separate account for each. Customers on the identical workforce usually work inside the similar setting however don’t typically have a motive to handle assets owned by different groups.
• One account per workload: For workloads that require strict isolation from different workloads, you may configure separate accounts. Be aware, nevertheless, that it is also potential to implement fairly strict boundaries between workloads utilizing IAM insurance policies, so you do not essentially want a number of accounts if workload isolation is a precedence.
• One account per setting sort: Some companies arrange separate accounts for various kinds of environments — one for dev/testing and one for manufacturing, for instance.
• One account per consumer: If every consumer in your group is doing one thing distinctive within the cloud and barely or by no means must work together with cloud assets managed by different customers, it might make sense to configure a separate account for each consumer. Nonetheless, that strategy is comparatively unusual.

The underside line right here is that there aren’t any hard-and-fast guidelines about what number of AWS accounts to arrange. You may have to contemplate the wants and priorities of your enterprise, groups, and customers to make the fitting alternative.

A number of OUs in AWS

Tangentially, it is value noting that (as talked about above) it is potential to arrange a couple of organizational unit in AWS if you want, then handle a number of accounts inside every OU. It is a uncommon apply as a result of accounts are granular sufficient that you would be able to set totally different guidelines and insurance policies for various accounts inside the similar OU, so functionally talking, there may be not an excellent motive to configure a couple of OU. You may as well handle payments for a number of accounts by way of a central AWS group.

Nonetheless, for very massive companies that embody distinct items, having a couple of OU generally is sensible. For instance, if your organization has gone by way of a merger or acquisition, it could retain separate OUs, one for every of the unique organizations that shaped the brand new entity.

A number of Accounts on Clouds Different Than AWS

The identical logic laid out above about separating (or not separating) units of customers or groups on the account stage applies to different public clouds. Nonetheless, as a result of the organizational hierarchies and terminology utilized by different clouds are a bit totally different, you will want to regulate your account administration technique barely if you happen to’re working exterior of AWS.

For instance, on Azure, a “subscription” is kind of the equal of an AWS account (there are some nuanced variations between AWS accounts and Azure subscriptions which might be past the scope of this text). And on Google Cloud Platform (GCP), the time period “service account” refers to accounts created for machine customers, which is a definite idea from AWS accounts.

You may need to be sure you perceive the ideas and phrases that your cloud supplier makes use of to handle accounts earlier than making choices about what number of accounts to make use of.

Conclusion

There are professionals and cons to having a couple of account in AWS or any public cloud. A number of accounts can present tighter isolation between groups and workloads, however additionally they improve complexity and make it more durable to share assets in some circumstances.

Concerning the creator