Share resources securely within your organization

As your organization’s number of workloads and accounts grows, the need to securely share resources across environments (such as development, testing, and production) increases. Instead of duplicating resources across accounts or environments, securely sharing components reduces operational overhead, ensures consistency, and avoids errors. By following secure practices, you can compartmentalize environments while allowing for seamless resource sharing.

1. Use resource sharing frameworks: Leverage AWS Resource Access Manager (RAM) to securely share AWS resources such as Amazon VPC subnets, Route 53 resolver rules, and more, across AWS accounts. This allows for efficient use of shared resources without duplicating efforts across accounts.
2. Apply least privilege access for shared resources: When sharing resources, ensure that only authorized accounts, users, or services have access, and limit permissions to the minimum required actions. Use IAM policies, resource-based policies, and service control policies (SCPs) to control access to shared resources.
3. Maintain separation of environments: Even when sharing resources, ensure that environment boundaries (such as development, testing, and production) are clearly defined. Compartmentalization helps isolate potential issues and maintains the integrity of each environment.
4. Monitor and audit shared resource access: Use AWS CloudTrail and AWS Config to monitor how shared resources are accessed and used across accounts. Implement logging and auditing to detect any unauthorized access or configuration changes.
5. Reduce operational overhead: By securely sharing common resources, such as networking components or shared databases, you reduce the need to provision and manage duplicate resources. This simplifies management and ensures that updates or changes are applied consistently across shared environments.
6. Use tagging for visibility: Apply resource tags to shared resources to maintain clear visibility of which resources are being shared and their intended purpose. Tags can also help you manage cost allocation and usage tracking.

Supporting Questions:

• How do you determine which resources should be shared across multiple accounts or environments?
• What controls are in place to ensure secure access to shared resources?
• How do you monitor and audit access to ensure that shared resources are used appropriately?

Roles and Responsibilities:

Cloud Architect:

• Responsibilities:
  • Design and implement a secure resource-sharing strategy that minimizes duplication and maximizes efficiency across AWS accounts and environments.
  • Ensure that least privilege principles are applied when granting access to shared resources.

Cloud Administrator:

• Responsibilities:
  • Use AWS Resource Access Manager (RAM) to configure and manage shared resources securely.
  • Monitor shared resource access through AWS CloudTrail and AWS Config to detect unauthorized activity and maintain security.

Artefacts:

• Resource Sharing Policies: Documentation outlining which resources are shared across environments or accounts and how access is controlled.
• Shared Resource Access Logs: Logs from AWS CloudTrail that track access to shared resources, ensuring compliance and detecting unauthorized actions.
• Tagging Strategy: Tags applied to shared resources to help identify ownership, purpose, and usage for better management and visibility.

Relevant AWS Services:

AWS Identity Services:

• AWS Identity and Access Management (IAM): Use IAM policies to manage access to shared resources securely, ensuring only authorized users and services can interact with shared components.
• AWS Resource Access Manager (RAM): Facilitates secure sharing of resources such as VPCs, subnets, and more across AWS accounts, reducing duplication and operational overhead.
• AWS Organizations with SCPs: Use SCPs to control access and enforce security policies across shared resources within multiple AWS accounts.

Monitoring and Compliance Services:

• AWS CloudTrail: Monitors and logs all access and usage of shared resources across AWS accounts, providing a comprehensive audit trail for security and compliance.
• AWS Config: Tracks configuration changes in shared resources and evaluates compliance with organizational policies, ensuring secure resource sharing across environments.