We have certain AWS labs which we offer to our customers. Every time a user opens the lab, a new member account is created and added to the organisational account.
This only happens the first time when a user logs into the lab. This member account has no resource restrictions and can do anything the user wants.
- Launching any type and number of ec2 instances.
- Create as many s3 buckets as possible and upload files of any size.
- Launch any type of RDS and ElastiCache clusters.
This has been creating a huge problem for us and we want to limit resources depending upon what is required to perform in the labs.
After a lot of research, I came up with this:
Resource restrictions on OU level using SCP: 1. Deny every service by default. 2. Allow only those services which are used in tasks. 3. Allow those services in 1 particular region only (For e.g. us-east-1) 4. Limit what type of instances can be launched (For e.g. t2.micro only) 5. Limit specific AMI's using which instances can be launched (For e.g. Only free AMI's like ubuntu and linux AMI's, no windows AMI's) 6. Policy for limiting s3 bucket sizes is not possible. Organisation account removal: 1. Can't remove member account if they don't have required information to become standalone account. 2. This information includes: - AWS Customer Agreement - choose a support plan - provide and verify the required contact information - provide a current payment method 3. This can't be automated so the idea is to create 2 OU's "Organisational units". - Working accounts - Disabled accounts 4. 1st OU will have required permissions to perform the lab tasks only (Principle of least privilege) 5. 2nd OU will have no permissions, Deny All for all services and actions.
Moving accounts from one OU to another OU A program can be written to list account under the "working accounts OU"
From the output, filter out the "JoinedTimestamp" parameter and perform move operation on accounts which are older than xx days.
I want to know from experienced AWS architects whether the second part of the "Organisational Unit" is possible.
If yes, can someone help me to figure out how to achieve it as I don't have much programming experience.