What do people do nowadays when setting up a multi...
# terraformh
Havard Noren
03/17/2025, 9:56 AMWhat do people do nowadays when setting up a multi account aws setup from scratch using aws organisations and aws identity center and where is the boundary between full automation and practical automation?
For the sake of this question, lets imagine a smaller company with a handfull teams and a devops team with 1-2 people in it.
I still hear mixed reviews about aws control tower / landingzone.
r
Regan Manning
03/17/2025, 1:57 PM1 or 2 devops eng who are deeply experienced with AWS? or new to it?
Regan Manning
03/17/2025, 2:04 PMControl Tower is worth it when you are building landing zones or multi-account org structures in aws BUT only for Initial account creation, IAM, and Roles/Policy IMO.
Putting anything else in control tower like networking or other infra or apps is a trap (again this is just my opinion and you might have more use-cases that require more governance.
Back to your first question, automation vs practical... https://xkcd.com/1205/
Regan Manning
03/17/2025, 2:06 PMtldr: If it saves you time in the future it should go in IaC
h
Havard Noren
03/19/2025, 8:33 AMThanks for the comment!
Regarding the iam roles / policies for control tower, I assume these are the general roles / policies that needs to be in place in all accounts and not the more specific roles / policies eg for services?
r
Regan Manning
03/19/2025, 2:16 PMSome people insist everything go into CT but I personally think service accounts should live as close to the project code as possible
Regan Manning
03/19/2025, 2:17 PMIt depends on how much control you need across the org
Regan Manning
03/19/2025, 2:18 PMusing CT does allow you to prevent sprawl in favor of strict standards but it may slow you down if you don't have good pipeline integration
Regan Manning
03/19/2025, 2:23 PMNo matter what, do ensure you create all your roles/policies with some IaC pipeline though. Do not let people manually make changes or you will regret it later
h
Havard Noren
03/20/2025, 9:08 AMthanks!
Then I think we are doing good so far, there is currently no manual creation, but that it probably beacuse the teams don't have any cloud experience and we aren't that many yet
10 Views