AWS Organizations

Question 1

Why using AWS Organizations?

Answer 1

Don’t create resources into the paying account (root)
Central-consolidated billing;
Service control policies (SCP): what services are available;
Tag policies: standardize on all tagged resources across the organization;

Question 2

How Organization can be broken down?

Answer 2

Into Organization Units such as Finance, Development, etc. Each OU can have multiple accounts such as development, staging, and production

Question 3

How to allow cross account S3 access?

Answer 3

Create a role with the account B as trusted entity. The role will generate a link that can be shared to automatically fill the account ID and role name. The accessing account will be restricted to the role given permissions

Question 4

What are the three ways to share S3 buckets across accounts?

Answer 4

Bucket Policies & IAM: programmatic access only
Bucket ACL & IAM: programmatic access only
Cross-account IAM Roles: both programmatic and console access