-
Notifications
You must be signed in to change notification settings - Fork 4
accounts team
We support two kinds of accounts in support of products: development and production. Development accounts are created for teams to develop products and host non production endpoints. Teams can explicitely request development accounts. Production accounts host production endpoints of products. Teams can indirectly request production accounts by requesting the promotion of products from development accounts to production. The cloud services team will determine placement of production endpoints in production accounts. Production account creation must address separation of cost, economies of scale, security, service requirements, etc as needed. Below are some details that may help explain this account strategy.
Never! Accounts are single payer.
No one! The organization owns all the accounts. Each account will have a principal. Think of this role as a steward rather than an owner.
- An account shared by a product team used to develop their product(s).
- Product team members have ADMIN rights in dev accounts!
- Production data and/or production endpoints can never be hosted in a development account.
- With great power comes great responsibility!
- Pay attention to cost!
- Pay attention to security!
- Clean up after yourself!
- Having a hard time cleaning up? infrastructure as code is your friend.
- Having a hard time promoting your application to prod? infrastructure as code is your friend.
- Not sure about what you're doing? ask for guidance. Ask your peers, Ask AWS.
- Generally you should restrict access to your proof of concept efforts to our on prem network
- Creating security group ingress 0.0.0.0/0? Don't do it!
- Don't know what something means? ask!
- Shared responsibility between Cloud services and product teams.
- Whatever is needed for Product teams to develop their Products.
- Cloud services and product teams work together to determine spec
- Dedicated account for production endpoints of a product.
- Product and Operations team have limited/read-only role.
- Cross account role allows a build service to deploy and configure resources in Product accounts.
- Production Data can only be hosted in a Product Account.
- legacy products may require humans with elevated roles to operate resources
- net new products should not require humans with elevated roles to operate
- There can be flexibility in where product teams run their pre-production endpoints, eg one team might want to deploy UAT/QA/STAGE versions of a product in a product account to most closely simulate "production", others might prefer to run these psuedo production versions in their dev or test account.
- Cloud services and product teams work together to determine spec
- Cloud services team
- Whatever is required of the product
- Cloud services and product teams work together to determine spec