AWS Account Management (Resource Management)

There is quite a bit of nuance in managing accounts in AWS.  One particular issue I see come up is with managing account lifecycles (i.e. if a person wants to have "temp" accounts to provide for people to "play" and learn).  This is simply not easily accomplished.  However, there are procedural ways to deal with this if folks need this type of functionality.  I have given it the following moniker: "account recycling"

The idea is that you would have different account types:
  • "core" accounts under the control of your master/payer account - and these do not get recycled.
  • Long lived line of business accounts - hosting production, etc...
  • long lived developer accounts - (still trying to work through how these would be managed)
  • "burner" accounts - preset limits for usage, pre-determined length of time the account is available
The idea of the burner account is that you would create a "pool" of accounts that could be provided to end-users to consume for testing, then put back in to the pool and used by someone else.  I believe that teams started to utilize this method due to the challenges of disabling/deleting/closing an AWS account.

The nice thing about the first tools listed here is that they also can "clean up" unused resources

There seems to be a few aws-nuke sources out there
https://github.com/rebuy-de/aws-nuke
(also, there is "cloud nuke" as it is more than just AWS now)
https://github.com/gruntwork-io/cloud-nuke

Comments

Post a Comment

Popular posts from this blog

HomeLab - Sophos XG SSL VPN and Comcast

Ugh... Comcast.  This sucked particularly much as this was my first attempt to configure a VPN back to my HomeLab and therefore was not sure what options I should have *known* would work.  Anywho... Sophos SSL VPN uses 8443 by default.  I spent a few hours trying to get through the config on the Sophos and my Linux client.  Nothing was working. For giggles I changed the Sophos to use 443, and then updated my client on my Linux workstation.  And suddenly it all works.  Fowk.  Tried 8443 again.  No love. I don't want to utilize port 443 as I intend to actually host some web apps for testing.  So, I have finalized on an "alternate" port which had to be configured on both the Sophos and the Linux client. I'l be doing a better write-up about this later.  I still need to figure out how to configure all this via the Gnome Network-Manager GUI.
Read more

Software RAID via kickstart (not cloud, sorry)

A bunch of the following specifics are out of scope, but I am including them anyhow # System bootloader configuration bootloader --location=mbr --boot-drive=sda --append=" crashkernel=auto hpsa.hpsa_allow_any=1 hpsa.hpsa_simple_mode=1 console=tty0 console=ttyS0,9600n8" # Partition clearing information #ignoredisk --only-use=sda zerombr clearpart --all --initlabel --drives=sda,sdb,sdc # Disk partitioning information part /boot/efi --fstype="efi" --fsoptions="umask=0077,shortname=winnt" --ondisk=sda --size=256 part /boot --fstype="xfs" --ondisk=sda --size=1024 part pv.01 --fstype="lvmpv" --ondisk=sda --size=51200 --grow volgroup vg_rhel7 --pesize=4096 pv.01 logvol /              --fstype="xfs"  --size=10240 --name=root     --vgname=vg_rhel7 logvol /home          --fstype="xfs"  --size=1024  --name=home     --vgname=vg_rhel7 logvol /tmp           --fstyp...
Read more

Cloud It Out Loud #clouditoutloud

I did a thing... I need a "complete" AWS environment to do some testing... and didn't want to botch my "personal" existing environment which owns my other domains, etc...  Anywho... at some point the following URL will be hosting something https://clouditoutloud.com
Read more