AWS SSO Groups and Root Users
Discourage use of local accounts and encourage SSO Groups. With SSO Groups, access can be granted either across multiple accounts or to individual accounts, using Permission Sets.
SSO Groups and Permission Sets
- Users use their directory credentials to sign in to the user portal.
- Users then choose the AWS account name that will give them federated access to the AWS Management Console for that account.
- Users who are assigned multiple permission sets choose which IAM role to use.
Permission sets are a way to define permissions centrally in AWS SSO so that they can be applied to all of your AWS accounts. These permission sets are provisioned to each AWS account as an IAM role. The user portal gives users the ability to retrieve temporary credentials for the IAM role of a given AWS account so they can use it for short-term access to the AWS CLI.
To use AWS SSO with AWS Organizations, you must first Enable AWS SSO, which grants AWS SSO the capability to create Service-linked roles in each account in your AWS organization. These roles are not created until after you Assign user access for a given account.
Restrict Root User Access at Account Level
While a root users can exist at the master account level, it is not a good idea to leave root users enabled at each of the lower level accounts.
Fortunately, there's an SCP to restrict that. This Service Control Policies Restricts the Use of the Root User in an AWS Account.
This SCP prevents restricts th
Your article highlighted the potential pitfalls and common mistakes to avoid. If you want to learn from real-world examples, click here for cautionary tales and lessons learned.