Introduction
A multi-account AWS environment is one in which workloads are separated into several distinct AWS accounts that are managed together. An AWS account is a container for AWS resources and a boundary for billing and access. This guide explains what a multi-account environment is, why it is used, how it is organized, and the practices that apply to it.
What is it?
Rather than placing every workload in a single account, a multi-account design places different workloads and environments in separate accounts. These accounts are grouped and governed centrally with AWS Organizations, a service that manages a collection of accounts. Accounts are placed into an organizational unit, often shortened to OU, which is a group of accounts to which shared policies can be applied.
Why does it exist?
Placing every workload in one account creates risk. A mistake or a security problem can affect everything in that account, an outcome described as a large blast radius, which is the extent of what a single failure can affect. Separate accounts limit the blast radius, create clear security boundaries, separate the billing of each workload, and prevent the service limits of one workload from affecting another. The multi-account approach exists to provide this isolation and clearer governance.
How it works
At the root of the structure is a management account, which is the account that administers the organization and is kept free of workloads. Other accounts are created for workloads and grouped into organizational units, for example a group for production and a group for non-production. A service control policy, often shortened to SCP, sets the maximum permissions that are allowed in the accounts to which it applies, acting as a guardrail regardless of the permissions granted within an account. Central accounts are often used for shared services and for collecting logs. A landing zone, which is a pre-configured secure baseline, can be established with AWS Control Tower.
Architecture diagram
Advantages
- Isolation. A problem in one account does not affect the others.
- Security boundaries. Access can be controlled cleanly per account.
- Separate billing. The cost of each workload is clearly visible.
- Separate limits. The service quotas of one workload do not affect another.
- Central governance. Guardrails can be applied across many accounts at once.
Disadvantages
- More to manage. Many accounts require automation to be operated efficiently.
- Cross-account access. Sharing resources between accounts must be configured carefully.
- Initial effort. Setting up the structure and the guardrails takes time.
Common use cases
- Separating production from development and testing.
- Isolating the workloads of different teams or products.
- Meeting compliance requirements that call for separation.
- Centralizing logging, security, and shared tooling.
Best practices
- The management account should be kept free of workloads and used only to administer the organization.
- Accounts should be grouped into organizational units so that guardrails can be applied to a whole group.
- Service control policies should be used to set guardrails, and per-account permissions should follow least privilege.
- The environment should be created and governed with a landing zone so that new accounts start from a secure baseline.
Common mistakes
- Workloads are run in the management account, which weakens its role as the administrator.
- Accounts are created without guardrails, so each one drifts from the intended baseline.
- Cross-account access is granted too broadly, which undermines the isolation.
- The account structure is created by hand without automation, which becomes difficult to maintain.
Related AWS services
- AWS Organizations manages the accounts and the organizational units.
- AWS Control Tower sets up and governs a landing zone.
- AWS Identity and Access Management controls permissions within each account.
Frequently Asked Questions
- Why are multiple AWS accounts used?
- To isolate workloads so that a problem in one account does not affect the others, to create clear security boundaries, to separate billing, and to keep the service limits of one workload from affecting another.
- What is an organizational unit?
- An organizational unit, or OU, is a group of accounts within AWS Organizations. Accounts are placed into organizational units so that policies can be applied to a whole group at once.
- What is a service control policy?
- A service control policy, or SCP, sets the maximum permissions allowed in the accounts to which it applies. It acts as a guardrail across accounts, regardless of the permissions granted within an account.
- What is a landing zone?
- A landing zone is a pre-configured, secure baseline for a multi-account environment, including the account structure, guardrails, and central logging. AWS Control Tower sets up and governs a landing zone.
- How many accounts should be used?
- The number depends on the organization, but a common starting point separates the management account from workload accounts and separates production from non-production, adding accounts as new isolation boundaries are required.
This article is the summary. The book is the full, continuously updated reference: account structure, governance, security boundaries, and complete architectures on AWS.
View the book