AWS whitepapers documentation change
Summary
Restructured headings, added links to security best practices (e.g., Principles of Least Privilege), emphasized management account security controls, and updated terminology/capitalization.
Security assessment
The changes emphasize security best practices (e.g., linking to least privilege principles, bolding 'should not' for management account usage) but do not address a specific disclosed vulnerability. The updates improve documentation about existing security features of AWS Organizations.
Diff
diff --git a/whitepapers/latest/organizing-your-aws-environment/aws-organizations.md b/whitepapers/latest/organizing-your-aws-environment/aws-organizations.md index 7fcf88e21..11be1cccd 100644 --- a//whitepapers/latest/organizing-your-aws-environment/aws-organizations.md +++ b//whitepapers/latest/organizing-your-aws-environment/aws-organizations.md @@ -5 +5 @@ -About organizations +What is an Organization?Organizations management accountOrganizations member accountsOrganizational units @@ -9 +9 @@ About organizations -[AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html) helps you centrally govern your environment as you grow and scale your workloads on AWS. Whether you are a growing startup or a large enterprise, Organizations helps you to centrally provision accounts and resources; secure and audit their environment for compliance; share resources; control access to accounts, regions, and services; as well as optimize costs and simplify billing. Additionally, Organizations supports aggregation of health events, consolidated data on use of access permissions, and centralized management of backups and tagging for multi-account environments. +[AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html) helps you centrally govern your environment as you grow and scale your workloads on AWS. Whether you are a growing startup or a large enterprise, Organizations helps you to centrally provision accounts and resources; secure and audit their environment for compliance; share resources; control access to accounts, Regions, and services; as well as optimize costs and simplify billing. Additionally, Organizations supports aggregation of health events, consolidated data on use of access permissions, and centralized management of backups and tagging for multi-account environments. @@ -13 +13 @@ This section includes best practices for organizing your AWS accounts, including -## What is an organization? +## What is an Organization? @@ -15 +15 @@ This section includes best practices for organizing your AWS accounts, including -An _organization_ is an entity that you create to consolidate a collection of accounts so that you can administer them as a single unit. Within each organization, you can organize the accounts in a hierarchical, tree-like structure with a [root](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#root) at the top and [organizational units](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organizationalunit) (OUs) nested under the root. Each account can be placed directly in the root, or placed in one of the OUs in the hierarchy. +An organization is an entity that you create to consolidate a collection of accounts so that you can administer them as a single unit. Within each organization, you can organize the accounts in a hierarchical, tree-like structure with a [root](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#root) at the top and [organizational units (OUs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organizationalunit) nested under the root. Each account can be placed directly in the root, or placed in one of the OUs in the hierarchy. @@ -30 +30 @@ Each organization consists of: -### Organizations management account +## Organizations management account @@ -32 +32 @@ Each organization consists of: -The management account creates the AWS organization’s resources, OUs, and policies, to manage the organization’s member accounts. Access to the management account must be strictly controlled by a small set of highly-trusted individuals from the organization, following the Principles of Least Privilege based on the activities they need to perform. This account should not be used for business workloads and should not contain business resources. +The management account creates the AWS organization's resources, OUs, and policies, to manage the organization's member accounts. Access to the management account must be strictly controlled by a small set of highly-trusted individuals from the organization, following the [Principles of Least Privilege](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_permissions_least_privileges.html) based on the activities they need to perform. This account **should not** be used for business workloads and should not contain business resources. @@ -34 +34 @@ The management account creates the AWS organization’s resources, OUs, and poli -Additionally, the organization management account is where automation tooling is installed to automate consistent deployment of controls or other standardized infrastructure constructs across accounts in an organization. A trust relationship, which is used by the automation tooling, exists between child AWS accounts in the organization and the organization management account. This relationship is established by default when new AWS accounts are created in the organization, and it enables management account users and roles to assume this cross-account [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM)[ role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in child accounts. +Additionally, the organization management account is where automation tooling is installed to automate consistent deployment of controls or other standardized infrastructure constructs across accounts in an organization. A trust relationship, which is used by the automation tooling, exists between child AWS accounts in the organization and the organization management account. @@ -36 +36,3 @@ Additionally, the organization management account is where automation tooling is -**Considerations for setting up the management account:** +This relationship is established by default when new AWS accounts are created in the organization, and it enables management account users and roles to assume this cross-account [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM) [role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in child accounts. + +### Considerations for setting up the management account: @@ -42,3 +44 @@ When you set up the management account, we recommend using an email address that -### Organizations member accounts - -AWS Organizations member accounts belong to the organization and reside in the overall organization’s structure. All billing for member accounts is consolidated to the management account of the organization. +## Organizations member accounts @@ -46 +46 @@ AWS Organizations member accounts belong to the organization and reside in the o -Most of your workloads will reside in member accounts, except for some centrally managed processes that must reside in either the management account or in accounts assigned as designated administrators for specific AWS services. +AWS Organizations member accounts belong to the organization and reside in the overall organization's structure. All billing for member accounts is consolidated to the management account of the organization. Most of your workloads will reside in member accounts, except for some centrally managed processes that must reside in either the management account or in accounts assigned as designated administrators for specific AWS services. @@ -48 +48 @@ Most of your workloads will reside in member accounts, except for some centrally -### Organizational units +## Organizational units (OUs) @@ -52 +52 @@ An organizational unit (OU) provides a means to group accounts within a root. An -_OUs are not meant to mirror your own organization’s reporting structure_. Instead, OUs are intended to group accounts that have common overarching security policies and operational needs. The primary question to ask yourself is: How likely will the group need a set of similar policies? +OUs are not meant to mirror your own organization's reporting structure. Instead, OUs are intended to group accounts that have common overarching security policies and operational needs. The primary question to ask yourself is: How likely will the group need a set of similar policies? @@ -54 +54 @@ _OUs are not meant to mirror your own organization’s reporting structure_. Ins -The following diagram shows a basic organization that consists of seven accounts that are organized into four OUs under the [root](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#root). The organization also has a few policies that are applied to OUs. +The following diagram shows a basic organization that consists of seven accounts that are organized into four OUs under the [root.](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#root) The organization also has a few policies that are applied to OUs. @@ -56 +56 @@ The following diagram shows a basic organization that consists of seven accounts - +