Building an Enterprise Grade Multi Account AWS Environment
summary
Recommends a multi-account layout with a single management account and grouped OUs, using AWS Control Tower for small orgs or a self‑managed bootstrap for heavy customization; uses IAM Identity Center for centralized SSO and role cascade; avoids VPC peering and Direct Connect Gateway (limit ~10 accounts) in favor of Transit Gateway + PrivateLink + RAM as a hub-and-spoke; centralizes endpoints, Transit Gateway and Security Hub/EventBridge in shared accounts — a pattern that scales to hundreds of accounts.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 0:27About me
- 1:00Agenda
- 1:30Security Concerns
- 2:51Cost Concerns
- 3:43How Many Accounts
- 4:44Application Per Environment
- 5:41Two Natures of AWS Accounts
- 6:23Grouping AWS Accounts
- 13:20AWS Access Control
- 13:41Distributed AWS Account Challenges
- 15:33Required Access Control
- 18:15RoleBased Access Control
- 19:46Network Connectivity
- 20:24Network Connectivity Tenets
- 22:07Network Connectivity Choices
- 24:25Network Connectivity Architecture
- 26:27Network Connectivity Patterns
- 28:12Expand Transit Gateway Pattern
- 29:01Intelligent Threat Detection
- 30:44AWS Security Hub
related talks
47mManage AWS Cloud Environments Easily and Securely
57mBest practices for cloud governance at scale
21mSecuring hundreds of AWS accounts for streamlined governance
32mCreate a cloud-ready environment
23mGetting started with identity on AWS
28mSecure cloud migration environments built with Control Tower &
40mCreating a managed, governed, and secure SaaS foundation on
58mCreate enterprise-wide preventive guardrails