Why do we need multiple accounts in AWS?

A multi-account strategy in AWS offers many benefits regarding security and isolation. Some of the key benefits are:

Isolation of resources: By deploying resources in separate accounts, you can achieve complete isolation between environments (dev, test, prod) and applications. This helps restrict unauthorized access between accounts.

Access control: You can configure IAM policies with restrictions and controls to govern access to each account. This allows centralized control over identities and access to all your accounts.

Blast radius reduction: In the event of a breach, the damage will be limited to the compromised account. This helps reduce the blast radius. Other accounts will remain secure and unaffected.

Flexibility: A multi-account strategy provides more flexibility in organizing your accounts based on departments, applications, environments, etc. This makes it easier to manage and scale your AWS infrastructure.

Granular billing: You can get separate bills for each account which provides more transparency into your AWS costs and helps you allocate costs to departments or projects based on cost allocation tags

What are the key services used to secure your AWS accounts?

To implement a multi-account strategy, you must create multiple AWS accounts. Then establish a secure mechanism for users and applications to access resources in different accounts. AWS provides many services that help govern and secure multiple accounts centrally. AWS Organizations is at the center of it all. Some of the essential services that work with AWS Organizations are:

• AWS Control Tower - Helps in setting up and governing multiple account environments.

• AWS IAM Identity Center - To centrally manage access to multiple accounts based on the principle of least privilege. Previously, this was known as AWS SSO

• AWS CloudTrail - Captures all the API calls made against the AWS account.

• AWS Config - Provides a detailed overview of your AWS account's resource configurations and how they have changed over time.

• AWS Guard Duty - Analyzes CloudTrail logs, VPC flow logs, and other sources to detect threats against your AWS accounts. Scans for security risks across your accounts and resources.

• AWS Security Hub - Helps establish security standards and provides a centralized view of the security status of your accounts.

• AWS Detective - Helps in analyzing and determining the root cause for security incidents by providing a unified view of user and resource interactions

• AWS Firewall Manager - Provides the ability to create centralized firewall rules across the organization.

• AWS Audit Manager - Assists in conducting ongoing audits of your AWS usage, automating report generation, and evaluating your compliance with industry standards.

• AWS Inspector - This is an automated vulnerability management service. When integrated with AWS organization, it can help in getting aggregated vulnerability data across multiple AWS accounts, enable or disable scans manage suppression rules across the organization

• Amazon Macie - This is a data security and data privacy service that helps protect sensitive data in your Amazon S3 bucket. It integrates with AWS Organizations to centrally manage and protect the data across multiple AWS accounts within the organization.

Hight level guidelines for securing multiple AWS accounts

• Ensure that CloudTrail is enabled at the Organization level.

• Organize accounts with Organization Units and apply appropriate SCPs to prevent unintended account usage.

• Designate an account for security operations. This account will act as the management account for GuardDuty and Security Hub and house Config Aggregator.

• Implement guardrails to ensure that the accounts created under your Organization are secure. This can be accomplished by deploying Config rules and conformance packs based on the workload and services being used within the Organization. There are several conformance packs available that can help improve security posture and maintain operational best practices.

• To ensure infrastructure and network security, deploy a centralized firewall manager as described in this guide.

By leveraging the above services, you can deploy a robust, multi-account architecture in AWS which is secure and has centralized identity and access management; isolation of resources; and granular control over permissions.