AWS Multi-Account Best Practices

Tue Feb 21 2023

Today I learned some best practices for managing multiple accounts within a single organisation. I actually I thought I had a good understanding of AWS organisations, until I listened to the Cloud Security Podcast's (opens new window) How to Build AWS Multi-Account Infrastructure with Security and Speed (opens new window) podcast episode this morning.

The first critical piece of advice they gave (which is also recommended by AWS (opens new window)), is about how when you migrate from a single AWS account to a multi-account setup with AWS Organisations, you should not use you existing account as your management for your organisation.

Instead, you should first create a new AWS account, set up AWS Organisations and then invite your old account to be a member of your organisation.

In the podcast, they mention this AWS Whitepaper (opens new window) that recommends some best practices for setting up your organisational units (OUs) and accounts within your organisation.

I can highly recommend going through the Patterns for organizing your AWS accounts (opens new window) and Recommended OUs and accounts (opens new window) sections. What is counter-intuitive, is that they recommend not structuring your AWS accounts according to your company's structure/org chart. Instead, you should group accounts together that will need similar purposes or policies.