Why to create different AWS accounts?

Search for a command to run...

No comments yet. Be the first to comment.
I don't like technical Interviews. Usually, I feel I'm setting for an exam and that adds stress and pressure. I've failed to pass some technical interviews for not being able to explain some technical concepts I didn't have the chance to use in the p...

It's not easy to answer this question without sounding like I'm promoting myself (though that might be true). DevOps engineer tries to make things easier for the developers to test and deploy code faster in a consistent way. That’s not new. But how c...

Kubernetes became a kind of standard for container orchestration lately. That's great!. Is extremely flexible, reliable, you can achieve a lot of things and it can be fun :D. The question is..., does all the companies using it really need it?. I've b...

Personally. I have mixed feelings about this kind of meetings. They are usually in the calendar, where you have your time to discuss any kind of topic, which is usually work related, but could be any kind of things you would like to discuss with your...

DevOps Stories
6 posts
I’m Sergio Aguila. I was born in Argentina, I’m married to my life partner, Manuela, and I’m the father of Gemah (a 4 years beautiful girl). Before the pandemic, we had the chance to travel more than what I’ve ever imagined.
Besides that. What I do?..., well…,I’ve studied Computer Engineering, and had the chance to work as Technical Support, Operations Engineer, Infrastructure Engineer, and lately (since the term was invented) as a DevOps Engineer. I was lucky enough to work in Argentina, New Zealand, Germany and the last few years I’ve been working remotely, for US startups from Argentina.
Well, if you are still reading this. Probably would like to know a bit more technical details on my expertise. I’m passionate about Cloud Computing, DevOps, Automation, etc. My tech stack in a nutshell is AWS, Linux, Containers and Terraform.
I’ve been willing to start writing for a while, but for one reason or another I didn’t have the chance to do it before. I hope you enjoy and find my articles helpful!.
This is usually a best practice within organizations. In a nutshell, that allows resource isolation. You can say: "That could be achieved by setting different VPCs!", that is right. Anyways, this increases the isolation and gives more granularity to the permissions of who can do what in each account.
For example. We could grant flexible permissions to QA and Developers to the accounts that belong to the Dev environment. But we want to restrict that to the upper environments (Stage and Prod).
Besides that. We don't want the applications to talk to the resources they don't need to. I'm not talking only about environments, but we could create different accounts for different Business units. For example, we don't need the e-commerce team accounts to talk to the marketing accounts if that's not required.
Some times no need for an extra security layer for some accounts, that is not required for all of them. That's yet another reason for creating different accounts.
Another reason to create several accounts is that is easy and has no extra cost. Okay, Sergio..., I'm in, What is the downside of creating several accounts? Probably the complexity of managing them and the complexity of Billing and Cost allocation. That's a whole different topic that can be covered in another article.
The only thing you need is to have an AWS account with access to the root account. Besides that, you will need an email, specific to that account.
The first step is to have an organization configured in https://us-east-1.console.aws.amazon.com/organizations/v2/home/ (depending the region you are working on. This is an easy article that goes through that process. Is simple. It will create a Root organization unit, which will be the parent of further organization units you create.
Please check: https://repost.aws/knowledge-center/get-started-organizations
Once you have Organization Enabled and a Root organization Unit. You can create your second AWS account as follows:
Click on "Add AWS account":

Just add the account name and the email address associated with that account. Leave the IAM role name as the default for now. Is very important for the Email address of the account's owner to be unique! Otherwise, it will fail and you'll not notice.

Here is an example of a notification for a failed AWS request creation due to a duplicated email address:


If everything goes right. You will have your second AWS account created within a couple of minutes:

That's great! How can I access that account now? I'll cover that in the next article of this Series (AWS from Scratch). Thanks for reading!