Cross-account user roles

Using multiple accounts to provision your resources (for example, development and production environments) provides a form of blast radius protection—even in a worst-case scenario, any issues or damages are limited to the account they occur in, not your entire AWS presence.

Creating and assuming roles across accounts is the best way to manage access to multiple accounts. Specific roles provide a clear and explicit declaration of permissions that can be easily reviewed, and revoked if needed.

This recipe provides a way to scale your access across many accounts, without compromising your security.

Getting ready

This recipe assumes you already have two AWS accounts created and ready to go.

In one account (the source account, referred to as Account A) you will need an IAM user.

Note

While you will need to use your account's root credentials to set up the first role in an account, do not use them on a day-to-day basis. The root account has permissions to do anything in your...