AWS whitepapers documentation change
Summary
Updated guidance on security OUs, account isolation, and multi-account strategies
Security assessment
The changes emphasize security best practices like maintaining a dedicated security OU, explicit access controls between accounts, and workload isolation. While these improve security posture, they are preventive measures rather than fixes for existing vulnerabilities.
Diff
diff --git a/whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.md b/whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.md index 6491f479c..0b54500b1 100644 --- a//whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.md +++ b//whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.md @@ -34,0 +35,2 @@ Using multiple AWS accounts to help isolate and manage your business application +When organizing your AWS accounts, maintain a clean security organizational unit (OU) that adheres to AWS Control Tower requirements. The security OU should contain only the essential security accounts designated by AWS Control Tower. For additional security-related accounts, create a separate OU outside the core security OU. + @@ -37 +39 @@ Using multiple AWS accounts to help isolate and manage your business application -Your cloud resources and data are contained in an AWS account. An account acts as an identity and access management isolation boundary. When you need to share resources and data between two accounts, you must explicitly allow this access. +Your cloud resources and data are contained in an AWS account, which acts as an isolation boundary for identity and access management. When you need to share resources between accounts, you must explicitly allow this access. By default, no access is allowed between accounts. For instance, if you use separate accounts for production and non-production environments, they remain isolated unless you specifically enable communication. @@ -39 +41 @@ Your cloud resources and data are contained in an AWS account. An account acts a -By default, no access is allowed between accounts. For example, if you designate different accounts to contain your production and non-production resources and data, no access is allowed between those environments by default. +The optimal number of AWS accounts for an organization can range from a few to thousands. Managing multiple accounts often requires automation to minimize operational complexity and ensure alignment with security, governance, and operational requirements. AWS charges are based on resource usage, not the number of accounts. @@ -41 +43 @@ By default, no access is allowed between accounts. For example, if you designate -The number of accounts that best meets your needs can range from a few to hundreds or even thousands. Management of many accounts requires use of automation to help minimize your Multi-account strategy best practices and recommendations 2 operational complexity and ensure efficient alignment with your security, governance, and operational requirements. AWS does not charge per account. Rather, you incur charges based on resources used, regardless of account quantity. +We recommend using several accounts to separate your workloads, rather than relying on a single account. A workload is a set of components that collectively deliver business value, and it's typically the level of detail discussed by business and technology leaders. This approach simplifies meeting your requirements, even in early adoption stages. As you experience success with initial workloads, you may want to expand your use of AWS, often leading to the foundation stage of adoption. At this point, you invest in developing your cloud foundational capabilities before significantly increasing adoption. @@ -43 +45 @@ The number of accounts that best meets your needs can range from a few to hundre -Rather than using a single account, we recommend that you use several accounts to separate your workloads. A workload identifies a set of components that deliver business value together. A workload is usually the level of detail that business and technology leaders communicate about. This approach is designed to make it easier for you to meet your requirements, even in the early project stage of adoption. Based on the success of those first few workloads, you might want to gain further business benefits by expanding your adoption of AWS. This motivation often leads to the foundation stage of adoption. In this stage, you invest in evolving your cloud foundational capabilities before greatly expanding adoption. +This multi-account strategy makes it easier to manage projects, enhance security controls, and support both early-stage and foundation-stage AWS adoption. It provides the flexibility for future expansion while maintaining strong foundational capabilities, allowing your organization to scale its AWS usage effectively as needs grow.