Mastering Multi-Account Management: Step-by-Step Guide to Setting Up AWS Organizations with SSO

AWS Organizations is a powerful service that allows businesses and organizations to manage multiple AWS accounts under a single umbrella. By centralizing account management, organizations can streamline operations, enhance security, and simplify billing. One of the best practices when using AWS Organizations is to establish a multi-account AWS environment with Single Sign-On (SSO) for seamless and secure access to all accounts. This guide provides a step-by-step approach to achieve this setup.

Benefits of a Multi-Account AWS Environment with SSO

1.Centralized Management: Simplify account management, including billing and security policies.
2.Improved Security: Isolate workloads and resources to minimize the blast radius in case of a breach.
3.Scalability: Easily add and manage accounts for new teams, projects, or departments.
4.Streamlined Access: Use SSO to allow users to securely access multiple accounts without managing separate credentials.

Steps to Set Up a Multi-Account AWS Environment with SSO

Step 1: Sign in to the AWS Management Console

Log in as the root user of the AWS management account. The management account is the primary account that governs your organization.

Step 2: Navigate to the Organizations Page

• Click on your account name in the top-right corner of the console.

• Select "Support", then choose "Organizations" from the dropdown menu.

Step 3: Create an Organization

a. On the Organizations page, click "Create organization".

b. Select the type of organization to create:

• With an existing management account: Use the current account as the management account.

• With a new management account: Provide details such as an email address and phone number for the root user of the new management account.

c. Click "Create organization" to complete this step.

Creating and Adding AWS Accounts

Step 4: Add New AWS Accounts

a. Navigate to the Accounts tab in the Organizations console.

b. Click "Add account" and provide the following details:

• Email address: Unique for each account.

• Account name: Reflects the purpose of the account (e.g., "Development", "Marketing").

• Role name: Define an IAM role that grants permissions to manage the account.

c. Click "Create account" to finalize.

Step 5: Repeat Account Creation for Other Teams or Departments

For each additional team or department requiring a separate AWS account, repeat the process to ensure resources are properly segmented.

Adding Existing Accounts to the Organization

Step 6: Invite Accounts

a. Navigate to the Accounts tab in the Organizations console.

b. Click "Invite accounts" and enter the email addresses of the accounts you want to add.

c. Assign a role for managing the accounts within the organization.

d. Click "Send invitation".

Step 7: Accept Invitations

Users of the invited accounts must log in and accept the invitations. Once accepted, the accounts will appear in your organization.

Setting Up AWS Single Sign-On (SSO)

Step 8: Enable AWS SSO

a. Go to the AWS SSO Console.

b. Click "Enable AWS Single Sign-On" to activate the service for your organization.

Step 9: Configure an Identity Source

a. Choose the directory to store user and group information:

• AWS SSO directory: Manage users directly in AWS SSO.

• External identity providers: Integrate with services like Microsoft Active Directory, Okta, or Google Workspace.

b. Complete the setup based on your chosen identity source.

Granting Access to AWS Accounts

Step 10: Assign Accounts to Users and Groups

a. In the AWS SSO Console, navigate to the "AWS Accounts" section.

b. Select the accounts that require access.

c. Assign users and groups from your identity source to the accounts.

Step 11: Configure Permissions

a. Use permission sets to define the level of access for each user or group.

b. Apply predefined AWS-managed policies or create custom policies tailored to your organization’s needs.

c. Assign the appropriate permission sets to users and groups.

Implementing Role-Based Access Control (RBAC)

Step 12: Define Roles and Permissions

a. Analyze user requirements and group them by roles (e.g., developer, admin).

b. Use AWS IAM policies to define access scopes based on roles.

c. Attach these policies to the permission sets in AWS SSO.

Step 13: Test Access Control

a. Simulate user logins to verify they have appropriate access.

b. Adjust permissions as needed to align with organizational policies.

Final Steps and Best Practices

Step 14: Monitor and Audit

a. Use AWS CloudTrail to log activity across accounts.

b. Regularly review access logs to ensure compliance with security policies.

Step 15: Enforce Service Control Policies (SCPs)

a. Use SCPs to define what actions can or cannot be performed within the organization.

b. For example, restrict access to certain AWS regions or services for specific accounts.

Step 16: Automate Account Provisioning
Consider using AWS Control Tower for streamlined account creation and governance.

Conclusion

By following these steps, you can set up a multi-account AWS environment with SSO using AWS Organizations. This configuration ensures secure and efficient management of resources across accounts while providing users with a seamless authentication experience. Regularly revisit your setup to incorporate new best practices and features released by AWS.