Design Secure Architectures · Topic 2 of 6
Multi Account Access and Federation
Govern many AWS accounts with Organizations and service control policies, and give people access through federation, IAM Identity Center and STS.
- 5 min
- An account is a strong isolation boundary, and Organizations manages many accounts with consolidated billing.
- An SCP sets a ceiling and never grants permissions, and it does not restrict the management account.
- Control Tower builds a governed multi account landing zone with guardrails.
What it is
Most real AWS environments use many accounts, because an account is the strongest security and billing boundary AWS offers. Separate accounts for production, development and security tooling limit the damage of a mistake or a breach.
This page covers two questions the exam asks. How do you govern many accounts at once, and how do people who already have an identity elsewhere (for example in a company directory) get access without a new IAM user for each of them?
How it works
AWS Organizations and service control policies
AWS Organizations groups accounts into a tree of organizational units (OUs) under one management account. It provides consolidated billing, which combines usage across accounts and can improve volume discounts.
A service control policy (SCP) sets the maximum permissions for the accounts under it. An SCP never grants access on its own: an action works only if the SCP allows it and an IAM policy in the account also allows it. SCPs do not apply to the management account.
A common use is a guardrail that denies actions everywhere, such as leaving the organization, turning off logging or using a Region that your company does not approve.
AWS Control Tower
AWS Control Tower sets up a secure multi account environment (a landing zone) based on best practices. It uses Organizations underneath and adds ready made guardrails, a log archive account and an account factory for creating new accounts in a standard way. Choose it when a scenario asks for a quick, governed starting point with little custom work.
Sharing resources between accounts
AWS Resource Access Manager (RAM) shares resources, such as VPC subnets or Transit Gateways, with other accounts or with the whole organization without copying them. Sharing subnets lets several accounts place resources in one VPC owned by a central network account.
Federation and workforce access
Federation lets users sign in with an identity that lives outside IAM and receive temporary AWS credentials. The credentials come from AWS Security Token Service (STS).
| Need | Choose |
|---|---|
| Employees sign in once to many AWS accounts and applications | AWS IAM Identity Center |
| Company directory using Security Assertion Markup Language (SAML 2.0) | IAM SAML identity provider, or Identity Center |
| Use an existing Microsoft Active Directory | AWS Directory Service (Managed Microsoft AD, or AD Connector as a proxy) |
| Customers of a web or mobile app | Amazon Cognito (next page) |
| One account's workload needs another account's resources | A cross account IAM role |
IAM Identity Center connects to an identity source (its own directory, Active Directory or an external provider). You then assign users or groups to accounts through permission sets, which are templates for the role created in each account. It is the recommended way to manage workforce access to many accounts.
Assuming a role
An identity calls the STS AssumeRole operation and gets a short lived access key, secret key and session token. With the AWS CLI it looks like this.
aws sts assume-role \
--role-arn arn:aws:iam::111122223333:role/AuditRole \
--role-session-name audit-sessionThe role must have a trust policy that names who may assume it. Without that trust, the call fails even if the caller has broad permissions.
Multi account security tooling
Central teams often use a delegated administrator account to run security services for the whole organization. For example, a security account can collect findings from Amazon GuardDuty and AWS Security Hub across all accounts. AWS CloudTrail can create an organization trail that logs every account into one bucket.
When the question says "restrict what accounts can do, even for administrators in those accounts", pick a service control policy. When it says "let users sign in with corporate credentials", pick federation.
What to remember for the exam
- An account is a strong isolation boundary, and Organizations manages many accounts with consolidated billing.
- An SCP sets a ceiling and never grants permissions, and it does not restrict the management account.
- Control Tower builds a governed multi account landing zone with guardrails.
- Use RAM to share resources such as subnets without duplicating them.
- Use IAM Identity Center for workforce single sign on across accounts.
- Use SAML 2.0 federation or Directory Service when the identities live in a company directory.
- STS gives temporary credentials, and a role needs a trust policy to say who can assume it.
- An organization trail records events from all accounts in one place.
Common mistakes
Believing an SCP gives access. An SCP only filters. An identity still needs an IAM policy that allows the action.
Creating IAM users for every employee. With many accounts or an existing directory, federation is easier to run and safer than separate users and passwords.
Mixing up Identity Center and Cognito. Identity Center is for your workforce using AWS accounts. Cognito is for the customers of your own application.
Forgetting the trust policy. A cross account role works only when its trust policy allows the calling account or principal, and the caller is allowed to call sts:AssumeRole.
An SCP applied to an OU affects every account in it, so a wrong deny can lock out administrators. Test a new SCP on a small OU first.
Check yourself
What does a service control policy do?
It sets the maximum permissions available in the accounts it applies to, and it does not grant any permission by itself.
Which service gives employees single sign on to many AWS accounts from a corporate directory?
AWS IAM Identity Center, which assigns access through permission sets.
What does a role's trust policy define?
It defines which principals are allowed to assume the role.
Topic 2 of 6 in Design Secure Architectures
Test yourself on Design Secure Architectures
The full AWS SAA-C03 question bank has 823 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.