CODEWITHSUNDEEP
amazon-web-servicesproduction-environmentdev-to-productionaws-organizations
Santosh Baruah
Santosh Baruah

Reputation: 115

Separating Dev Prod Environments In AWS

I’m my scenario wants to separate out the production environment from our development environments.

We'd like to only have our production systems on one AWS account and all other systems and services on another.

I'd like to split/separate for billing purposes. If I do add more monitoring services many charge by the number of running instances. I have considerably more running instances than I need to monitor though so I'd like the separation. This also would make managing permissions in the future a lot easier I believe (e.g. security hub scores wouldn't be affected by LMS instances).

I'd like to split out all public facing assets to a separate AWS account. So RDS, all EC2 instances relating to prod-webserver (instances, target group, AMI, scaling, VPC, etc.), S3 cloudfront.abc.com bucket, jenkins, OpenVPN, all Seoul assets.

Perhaps I could achieve the goal with 'Organizations' or the 'Control Tower' as well. Could anyone please advise what would be best in my scenario? Is there Better alternative for this ?

Upvotes: 0

Views: 6565

Answers (3)

Ausgefuchster
Ausgefuchster

Reputation: 1178

AWS provides a lot information about this topic. E.g. a very detailed Whitepaper about Organizing Your AWS Environment in which they say

Using multiple AWS accounts to help isolate and manage your business applications and data can help you optimize across most of the AWS Well-Architected Framework pillars, including operational excellence, security, reliability, and cost optimization.

With accounts, you logically separate all resources (unless you allow something else) and therefore ensure independence between e.g. the development environment and the production environment.

You should also take a look at Organizational Units (OUs)

The following benefits of using OUs helped shape the Recommended OUs and accounts and Patterns for organizing your AWS accounts.

  • Group similar accounts based on function
  • Apply common policies
  • Share common resources
  • Provision and manage common resources

Control Tower is a tool which allows you to manage all your AWS accounts in one place. You can apply policies for every account, OU, or prohibit regions. You can use the Account Factory to create new accounts based on blueprints.

But still you need to collect a lot of knowledge about these tools and best practices because they're just that. Best practices and recommendations you can use to get started and build a good foundation, but they're nothing you can fully rely on because you may have individual factors.

So understanding these factor and consequences is very important.

Upvotes: 1

s0enke
s0enke

Reputation: 11

Separating workloads and environments is considered a best practice in AWS according to the AWS Well-Architected Framework. Nowadays Control Tower (which builds upon AWS Organizations) is the standard for building multi-account setups in AWS.

Regarding multi-account setups I recommend reading the Organizing Your AWS Environment Using Multiple Accounts.

Also have a look at the open-source AWS Quickstart superwerker which sets up a well-architected AWS landing zone using AWS Control Tower, Security Hub, GuardDuty, and more.

Upvotes: 1

John Rotenstein
John Rotenstein

Reputation: 270224

The fact that you was to split for billing purposes means you should use separate AWS Accounts. While you could split some billing by tags within a single account, it's much easier to use multiple accounts to split the billing.

The typical split is Production / Testing / Development.

You can join the accounts together by using AWS Organizations, which gives some overall security controls.

Upvotes: 1

Related Questions