Multi-Account Boundaries
An account is the strongest boundary the cloud gives you, and only if the trust between accounts is scoped. Walk a role trusting the whole organization from a sandbox into production, then add a control above the account that local admin cannot undo.
What Is Multi-Account Boundaries?
An account is the strongest blast-radius boundary the cloud gives you, and it only holds if the trust between accounts is scoped. A role in a sandbox that the whole organization is allowed to assume, with no condition and nothing above it, means the sandbox and production are one environment wearing two names. This capstone asks the question every earlier fix leaves open: what stops the fix from being undone.
What You'll Learn in Multi-Account Boundaries
- A role has two policies: one for what it can do, one for who may become it. A tight permissions policy on a role anyone can assume is still a problem.
- A trust policy naming the whole organization lets the weakest account define the security of the strongest.
- An account contains a compromise by default, unless a trust relationship was created to cross it.
- A service control policy sets a ceiling above the account, so a member-account administrator cannot grant the permission back.
Multi-Account Boundaries — Training Steps
-
The cheapest door in
Bob is not in production. He is in Dremwick's sandbox account, holding a CI runner credential that leaked in a public build log. Sandbox holds nothing worth stealing, which is exactly why nobody watches it closely. He starts by asking what else the organisation contains.
-
A door with the whole account on the guest list
Bob looks for roles in prod that dev is allowed to assume. He finds one meant for audit tooling, and reads its trust policy.
-
Walk through it
Bob assumes the role. Nothing exotic: the trust policy says his account is welcome, so AWS hands him production credentials.
-
What prod looks like from inside
The assumed session is an ordinary production principal now. Bob asks what it can see.
-
Every contract Dremwick holds
The contracts export is the commercial core of the business: who buys the power, at what price, for how long. Bob streams it straight to his terminal.
-
What actually failed?
Before the response, name the failure precisely.
-
Our pricing is in someone else's bid
Dremwick lost a tender to a rival whose bid undercut them by a margin that only makes sense if the rival knew their strike prices. Commercial escalated it; the trail leads back to a session in the production account that came from dev.
-
Open the organisation
Alice opens the organisation view: the account tree, the trust policy on the cross-account role, and the guardrails above each organisational unit.
-
The whole account on the guest list
The trust policy is the hole. It names the dev account, not the tool that was supposed to use it.
-
Name the one principal that may cross
Alice rewrites the trust policy so it names the audit tooling role specifically, and requires an external id that only that tooling knows.