What is the appropriate account to delegate administrators?

[nitrocode]

I'm curious what cloudposse thinks of each of these.

1. AWS Organizations can now be delegated
   • It's very difficult to migrate this for brownfield so I want to make sure the correct account.
   • This impacts stacksets, aws accounts, finops, cloudtrail, policies (scp, rcp, declarative, tag, etc), landing zone, etc
   • What account is best for this? The security account? Or a new org account?
2. Guardduty
   • security account
3. SecurityHub
   • security account
4. Centralizing root access
   • Same account as AWS Organizations? Or identity or security?
5. IAM identity center
   • Same account as AWS Organizations? Or identity or security?
6. Terraform state bucket
   • Currently it's created in the root account because that's the first account but is that the best account for it since root has a lot of privileges and giving everyone access to a resource in the root account is not the best for compliance/security
   • corp or tools account ?
7. Where should financial operations be?
   • Usually it defaults to the root account. I believe the billing and cur can be exported to an s3 bucket in a separate account.
   • New account finops or finance ?
8. Where should org wide cloudtrail logs go?
   • AWS recommends a separate logging account
   • If not in logging, perhaps in root or security?
9. AWS Health
   • Perhaps an ops account ?
10. AWS Inspector
11. AWS Systems Manager
    • Perhaps security or some kind of ops account?
12. AWS StackSets
    • security account?

There may be more delegated admins that I'm not aware of. If you know of others, please list them and their respective account that you'd recommend putting them in.

References

• https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html
• https://www.cloudquery.io/blog/guide-aws-org-delegation

[milldr]

We use a combination of the security and the audit accounts for the majority of security and compliance tools. See our docs here.

In a typical REFARCH setup, the logs are written to the audit account, the AWS services (Config, Security Hub, and GuardDuty) are deployed to the security account, and the Organizational management account (root account) is used to delegate security as the Delegated Administrator account. The central collection region is usually the same as the primary region used in your platform accounts for hosting your application workloads.

So to answer your question specifically:

1. AWS Organizations can now be delegated - we're still using the root account, although that's an interesting point for brownfield. Will consider
2. Guardduty - security
3. SecurityHub - security
4. Centralizing root access - root
5. IAM identity center - root. Previously we've deployed this to identity, but we ultimately landed on root
6. Terraform state bucket - root, but case-by-case. Recently, we've been deploying several state buckets to create a level of separation, and we've had a partial brownfield environments use a different account as the management account for the subset of accounts.
7. Where should financial operations be? - Currently we dont have a dedicated account, but I would recommend corp or whatever makes sense for your use-case. The question is if a single account is sufficient or if they need a dedicated tenant.
8. Where should org wide cloudtrail logs go? - We deploy to audit with cloudtrail-bucket
9. AWS Health - We dont use this yet, but I would say most likely audit
10. AWS Inspector - AWS Organization Management account is root and the AWS Organization Delegated Administrator account is security.
11. AWS Systems Manager - Depends on use case. If we're storing account specific values, store them in that account. If we're setting up automation, using automation. etc
12. AWS StackSets - We dont use these but perhaps automation would be a good place