For organization accounts, we just use `[email protected]` which routes all emails for all accounts to one alias.
Also, yeah, AWS' account situation is bonkers. Even with organizations, if you have an account open in one tab and open another account in another, you get logged out of the first. Bonkers.
This naming scheme works, but it still seems suboptimal. I should never, under any circumstance, receive email intended for the root user of an account that is subordinate to an organization. If someone manages to create a password associated with that user or otherwise authenticate as that user, that is a security failure. Conversely, I should be able to assume the “role” of that account’s root user from the organization’s management account regardless of IAM policy inside that account. And the scare quotes are intentional: no role should need to exist inside the sub-account for this to work — it should not be possible to lock myself out of a sub-account by any manipulation of that sub-account’s IAM configuration.
Re:Google Bard enters open beta
by crucialfelix on Tuesday March 21, 2023 @03:31PM
(#35251328)
I use separate Chrome profiles to switch AWS accounts.
Also better to have no browser extensions installed when doing anything sensitive.
Not that Google’s account switcher has ever been particularly good.
[0] Not just the console. AWS organizations are sort of okay, but you still need to give every account an email address. Seriously, Amazon? I bet you could invent a new subtype of account called, say, “project”, where a project has a name, does not have an email address, does not have a root non-IAM user, and is only accessed via IAM roles. And I bet you could, with more effort, teach the console to accept a URL prefix that encodes the name of an account and a role and gives a console view with that role assumed without globally assuming that role. And then I could administer a VPC according to current best practices, from the console, without cursing at multi-account containers and needing to correctly type the account and role every time I want to do anything.