Creating a multi-account environment
All resources and services on AWS require an AWS account. After you create an account, you can deploy AWS resources to that account. Hence, the AWS account is the fundamental container that holds your resources. Every month, AWS aggregates usage for each account, and the account holder is responsible for those charges. However, most organizations using AWS have multiple accounts that run their workloads.
Securing your business assets is the primary reason for using multiple accounts. An AWS account provides a natural security boundary for organizations with multiple accounts. Say you were to deploy your entire business’ production workload in a single AWS account. If a malicious actor were to obtain certain privileges to that account, that may lead to a large security breach in your business. However, if the threat affects just one account out of many, this significantly limits the threat or blast radius.
Isolating resources by attributing...
