Secure (and usable) multi-AWS account IAM setup | Datadog

What this post added

This post details a strategy for managing multiple AWS accounts by centralizing IAM users in a management account and using role delegation with MFA for cross-account access. It outlines requirements for a secure and usable setup, including user isolation, limited default access, role assumption for privileged actions, MFA enforcement, and role grouping by topic. An example scenario with users Alice, Bob, and Charlie across accounts A, B, and M is provided to illustrate the implementation steps, focusing on creating a 'users' group in the management account and defining roles in target accounts.