Purpose of Delegated Account for best practices

The purpose of delegation is to allow different AWS Accounts in an Organisation to host different AWS tools. Delegation allows you to specify the AWS Account which will be the one and only administrator of a particular management our security tool in your AWS Organisation. Per the multi-account strategy, AWS advises customers to separate concerns by Account boundary for various reasons, including limiting blast-radius, data protection, billing and more. By delegating Guard Duty to a particular AWS Account, for example, you can apply appropriate guard rails to that Account (which are most appropriate for security tooling but may differ from other Accounts) and you can easily identify costs for resources and data transfer charges related to Guard Duty.

Use multiple AWS accounts One account isn’t enough to set up a well-architected environment. By using multiple accounts, you can best support your security goals and business processes. Here are some benefits of using a multi-account approach:

Security controls – Applications have different security profiles, so they require different control policies and mechanisms. For example, it’s far easier to talk to an auditor and point to a single account hosting the payment card industry (PCI) workload. Isolation – An account is a unit of security protection. Potential risks and security threats can be contained within an account without affecting others. Therefore, security needs may require you to isolate accounts from one another. For example, you may have teams with different security profiles.

Many teams – Teams have different responsibilities and resource needs. By setting up multiple accounts, the teams cannot interfere with one another, as they might when using the same account.

Data Isolation – Isolating data stores to an account helps limit the number of people who have access to data and can manage the data store. This isolation helps prevent unauthorized exposure of highly private data. For example, data isolation helps support compliance with the General Data Protection Regulation (GDPR).

Business process – Business units or products often have completely different purposes and processes. Individual accounts can be established to serve business-specific needs.

Billing – An account is the only way to separate items at a billing level, including things like transfer charges and so forth. The multi-account strategy helps create separate billable items across business units, functional teams, or individual users.

Quota allocation – AWS quotas are set up on a per-account basis. Separating workloads into different accounts gives each account (such as a project) a well-defined, individual quota.