Skip to main content
Scaling your AWS Identity and Access Management (IAM) strategy across multiple accounts requires careful planning. In this lesson, Sarah will:
  • Create separate AWS accounts for each department to enforce resource isolation
  • Enable centralized IAM management using AWS Organizations
  • Configure IAM cross-account access for seamless resource sharing
  • Monitor user activity and API calls with AWS CloudTrail
  • Set up usage and performance alarms in AWS CloudWatch
  • Implement security governance and compliance with AWS Config
  • Leverage IAM Anywhere to grant on-premises access to AWS resources
  • Use IAM Identity Center for unified single sign-on (SSO) into AWS
Establishing individual AWS accounts per team is a best practice for isolating billing, permissions, and resource usage.
TaskAWS ServicePurpose
Account creationAWS OrganizationsIsolate resources and consolidate billing
Centralized IAM managementAWS OrganizationsApply policies across accounts
Cross-account accessIAM RolesShare resources without sharing credentials
Activity and API monitoringCloudTrailAudit user/API calls
Alarms for resource usageCloudWatchAlert on thresholds and anomalies
Security governance and compliance checksAWS ConfigTrack resource configurations and drift
On-premises accessIAM AnywhereGrant secure data center access
Single sign-onIAM Identity CenterCentralize user authentication
The image is a slide titled "Module 3: Sara must plan for expansion," listing tasks related to AWS account management and security, such as creating AWS accounts, enabling centralized IAM management, and setting alarms using Cloudwatch.
Be cautious when configuring cross-account roles: overly permissive trust policies can expose your resources to unintended access.

Watch Video