By using AWS re:Post, you agree to the Terms of Use

IAM as code - centralize the management of IAM roles and policies in a multi-account organization

0

A customer is trying to centralize the management of IAM roles and policies in a multi-account organization. They would like to achieve the following:

  • keep log of all changes for compliance reasons
  • facilitate periodical audits process
  • test policies in sandbox environment before deploying in production

They are using Terraform and would like to use CodeCommit as repository. Do we have examples of customers who have achieved such a process, and/or best practices?

Thanks

asked 2 years ago33 views
1 Answers
0
Accepted Answer

You should check out the blog post on best practices with OU management. There are suggestions for both sandbox environments and logging: https://aws.amazon.com/blogs/mt/best-practices-for-organizational-units-with-aws-organizations/

Check out centralized CloudTrail for logging and auditing. It's a widely adopted best practice. It helps the management account make sure everything is logged (and doesn't let member accounts turn it off).

For IAM role usage. There are many approaches customers can take. I don't have Terraform examples. Stacksets provides easy integration for rollout of IAM roles.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions