TechPrufer
Sign inGet started

Blogs›Datadog›Multi-account IAM and Security

Multi-account IAM and Security

Multi-account IAM and Security

1
posts
2017

Datadog has developed a robust system for managing multiple AWS accounts securely and efficiently. This system leverages IAM users, groups, and roles to enforce granular access control, requiring MFA for privileged operations and grouping permissions by topic. The approach aims to balance security with usability, allowing for effective management of infrastructure across numerous accounts.

2017

Secure (and usable) multi-AWS account IAM setup | Datadog

9/20/2017

This post details a strategy for managing multiple AWS accounts by centralizing IAM users in a management account and using role delegation with MFA for cross-account access. It outlines requirements for a secure and usable setup, including user isolation, limited default access, role assumption for privileged actions, MFA enforcement, and role grouping by topic. An example scenario with users Alice, Bob, and Charlie across accounts A, B, and M is provided to illustrate the implementation steps, focusing on creating a 'users' group in the management account and defining roles in target accounts.