Separating Dev Prod Environments In AWS

user_15342630 0
Viewed 658

I’m my scenario wants to separate out the production environment from our development environments.

We'd like to only have our production systems on one AWS account and all other systems and services on another.

I'd like to split/separate for billing purposes. If I do add more monitoring services many charge by the number of running instances. I have considerably more running instances than I need to monitor though so I'd like the separation. This also would make managing permissions in the future a lot easier I believe (e.g. security hub scores wouldn't be affected by LMS instances).

I'd like to split out all public facing assets to a separate AWS account. So RDS, all EC2 instances relating to prod-webserver (instances, target group, AMI, scaling, VPC, etc.), S3 cloudfront.abc.com bucket, jenkins, OpenVPN, all Seoul assets.

Perhaps I could achieve the goal with 'Organizations' or the 'Control Tower' as well. Could anyone please advise what would be best in my scenario? Is there Better alternative for this ?

aws-organizations dev-to-production production-environment amazon-web-services
2 Answers

The fact that you was to split for billing purposes means you should use separate AWS Accounts. While you could split some billing by tags within a single account, it's much easier to use multiple accounts to split the billing.

The typical split is Production / Testing / Development.

You can join the accounts together by using AWS Organizations, which gives some overall security controls.

user_1747770

Separating workloads and environments is considered a best practice in AWS according to the AWS Well-Architected Framework. Nowadays Control Tower (which builds upon AWS Organizations) is the standard for building multi-account setups in AWS.

Regarding multi-account setups I recommend reading the Organizing Your AWS Environment Using Multiple Accounts,.

Also have a look at the open-source AWS Quickstart superwerker which sets up a well-architected AWS landing zone using AWS Control Tower, Security Hub, GuardDuty, and more.

user_16756370
Related