By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Suggest a best approach for creating this AWS architecture

0

How do you create a architecture which involves components EC2, lambda, S3, parameter store, KMS, Scheduler in AWS. This architecture bascically need to be same across all accounts in the organization and there could be updates in the architecture. The root account of AWS organization should not be able to use/view any resources in the users accounts of the organization.

The information is saved in parameter store of user account after a series of steps run on EC2 instance.

The inputs to the lambda function would be this sensitive information of the user which would be stored in the parameter store of the user account. Also, the output of lambda function would again be another sensitive information of user and need to be stored in S3 bucket of that user. Also, the code would be updated frequently.

If there are any other alternative suggestions. Please provide them.

Topics
Security, Identity, & ComplianceManagement & GovernanceStorage
Tags
Security, Identity, & ComplianceAWS OrganizationsAWS Account ManagementParameter StoreAmazon S3 Access Grants
Language
English
Keerthi
asked 2 months ago235 views
1 Answer
2

Hello.

If you are managing multiple AWS accounts with AWS Organizations, I think it is a good idea to create a CloudFormation template and create AWS resources in each AWS account using a stack set.
By doing this, even if there are changes to resource settings, etc., you can complete the work by just using the management account instead of having to work on each AWS account one by one.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html

profile picture
EXPERT
Riku_Kobayashi
answered 2 months ago
profile pictureAWS
EXPERT
iBehr
reviewed 2 months ago
  • Keerthi
    2 months ago

    But, will everything be compromised with root account password ? If suppose someone cracks the root organization password. Will they be able to do malicious activities in other accounts by updating the resource setting?

  • iBehr EXPERT
    2 months ago

    Ensure that you have 2FA set for the root account, preferably with a hardware device that you keep secure (in a safe or such).

  • Keerthi
    a month ago

    Can we do in some de-centralized way such that users must setup the architecture and run it in their AWS accounts. Root user is only responsible to pay the bills of the accounts in the organization and nothing else.

Relevant content