Summary

This chapter discussed the importance of a multi-account architecture, examining the vast use cases for setting up and managing multiple AWS accounts. It falls within Domain 2: Security in the AWS Certified Developer Associate exam with a particular focus on the task statement, Implement authentication and/or authorization for applications and AWS services. Specifically, you learned that hosting different workloads and even different environments in separate AWS accounts is essential for ensuring higher levels of security and reducing the impact of mishaps in one environment affecting workloads in another. With multiple AWS accounts, you can separate individual applications and even have a separate account for their development lifecycle.

With multiple AWS accounts, you can also separate internal applications and workloads from customer-facing ones, further enhancing security. In this chapter, you learned how to manage AWS accounts using AWS Organizations. You learned how to apply service control policies to prevent member accounts from specific services, resources, and regions. The management account in an AWS organization has the highest authority, and you can even prevent administrators of member accounts from leaving the organization.

Although AWS Organizations offers the ability to build guardrails for your member accounts, who or what can work with those permitted services and make API calls still needs to be defined using AWS IAM or by defining resource-based policies. We perform a deep-dive study of the IAM services in the next chapter.