SEC01-BP01 Separate workloads using accounts
Establish common guardrails and isolation between environments (such as production, development, and test) and workloads through a multi-account strategy. Account-level separation is strongly recommended, as it provides a strong isolation boundary for security, billing, and access.
Desired outcome: An account structure that isolates cloud operations, unrelated workloads, and environments into separate accounts, increasing security across the cloud infrastructure.
Common anti-patterns:
-
Placing multiple unrelated workloads with different data sensitivity levels into the same account.
-
Poorly defined organizational unit (OU) structure.
Benefits of establishing this best practice:
-
Decreased scope of impact if a workload is inadvertently accessed.
-
Central governance of access to AWS services, resources, and Regions.
-
Maintain security of the cloud infrastructure with policies and centralized administration of security services.
-
Automated account creation and maintenance process.
-
Centralized auditing of your infrastructure for compliance and regulatory requirements.
Level of risk exposed if this best practice is not established: High
Implementation guidance
AWS accounts provide a security isolation boundary between workloads or resources that operate at different sensitivity levels. AWS provides tools to manage your cloud workloads at scale through a multi-account strategy to leverage this isolation boundary. For guidance on the concepts, patterns, and implementation of a multi-account strategy on AWS, see Organizing Your AWS Environment Using Multiple Accounts.
When you have multiple AWS accounts under central management, your accounts should be organized into a hierarchy defined by layers of organizational units (OUs). Security controls can then be organized and applied to the OUs and member accounts, establishing consistent preventative controls on member accounts in the organization. The security controls are inherited, allowing you to filter permissions available to member accounts located at lower levels of an OU hierarchy. A good design takes advantage of this inheritance to reduce the number and complexity of security policies required to achieve the desired security controls for each member account.
AWS Organizations and AWS Control Tower are two services that you can use to implement and manage this multi-account structure in your AWS environment. AWS Organizations allows you to organize accounts into a hierarchy defined by one or more layers of OUs, with each OU containing a number of member accounts. Service control policies (SCPs) allow the organization administrator to establish granular preventative controls on member accounts, and AWS Config can be used to establish proactive and detective controls on member accounts. Many AWS services integrate with AWS Organizations to provide delegated administrative controls and performing service-specific tasks across all member accounts in the organization.
Layered on top of AWS Organizations,
AWS Control Tower provides a one-click best practices setup
for a multi-account AWS environment with a
landing
zone. The landing zone is the entry point to the
multi-account environment established by Control Tower.
Control Tower provides several
benefits
-
Integrated mandatory security controls that are automatically applied to accounts admitted into the organization.
-
Optional controls that can be turned on or off for a given set of OUs.
-
AWS Control Tower Account Factory provides automated deployment of accounts containing pre-approved baselines and configuration options inside your organization.
Implementation steps
-
Design an organizational unit structure: A properly designed organizational unit structure reduces the management burden required to create and maintain service control policies and other security controls. Your organizational unit structure should be aligned with your business needs, data sensitivity, and workload structure
. -
Create a landing zone for your multi-account environment: A landing zone provides a consistent security and infrastructure foundation from which your organization can quickly develop, launch, and deploy workloads. You can use a custom-built landing zone or AWS Control Tower to orchestrate your environment.
-
Establish guardrails: Implement consistent security guardrails for your environment through your landing zone. AWS Control Tower provides a list of mandatory and optional controls that can be deployed. Mandatory controls are automatically deployed when implementing Control Tower. Review the list of highly recommended and optional controls, and implement controls that are appropriate to your needs.
-
Restrict access to newly added Regions: For new AWS Regions, IAM resources such as users and roles are only propagated to the Regions that you specify. This action can be performed through the console when using Control Tower, or by adjusting IAM permission policies in AWS Organizations
. -
Consider AWS CloudFormation StackSets: StackSets help you deploy resources including IAM policies, roles, and groups into different AWS accounts and Regions from an approved template.
Resources
Related best practices:
Related documents:
Related videos:
Related workshops:
