CODEWITHSUNDEEP
amazon-web-servicesamazon-iam
Vladimir Venegas
Vladimir Venegas

Reputation: 4213

How to manage environments on AWS

In our company, we are adding administrator role to all devs. I think this is a big risk, and now I want to restrict devs privileges. My goal is that a dev can add any resource, but can't touch test and production environments.

I was thinking to make a group on IAM and set the following policy, but maybe there is a better approach. 

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "*:*",
            "Resource": "*-dev-*"
        }
    ]
}

Is there a set of best practices to work with several environments (dev, test, prod) on AWS?

Upvotes: 0

Views: 178

Answers (1)

E.J. Brennan
E.J. Brennan

Reputation: 46879

Your best bet is to have completely separate AWS accounts, one or more just for production and one or more for just for dev/test environments.

For billing purposes you can tie them altogether if you want to.

You definitely don't want all of your devs to have administrator access to your prod environment, and a separate account will help limit the possibility of a catastrophic mistake being made.

Upvotes: 1

Related Questions