Slack's transition away from a single AWS account conducted at AWS Community Day, Bangalore 2019

1. From One to Many:
Slack’s transition away from a single AWS
account
Andrew Martin | 21st July 2019

2. Why?

3. Driving Factors
- Service Ownership

4. Driving Factors
- Service Ownership
- Blast Radius Reduction

5. Driving Factors
- Service Ownership
- Blast Radius Reduction
- Service & Rate Limit Reduction

6. Driving Factors
- Service Ownership
- Blast Radius Reduction
- Service & Rate Limit Reduction
- Cost Management / Cost Tracking

7. How?

8. Tools

9. Tools

10. Tools

11. Tools

12. Tools

13. Tools

14. Early Assumptions

15. Failed Early Assumptions

16. Failed Early Assumptions
- IAM User management would be easy

17. Failed Early Assumptions
- IAM User management would be easy
- Teams would find moving simple

18. Failed Early Assumptions
- IAM User management would be easy
- Teams would find moving simple
- Accounts would be easy to create & destroy

19. Biggest Wins

20. Biggest Wins - Terraform
- Achieve account conformity with ease
- Quickly apply new changes
- Changes are captured in DVCS

21. module "service-team-a" {
source = "../../../modules/aws/managed-accounts"
account_name = "service-team-a"
account_owner = "@service-team"
account_tags = "account_type:sandbox,share_amis:true"
}
Biggest Wins - Terraform

22. Biggest Wins - SSO
- Simplifies access for end users
- Improve on/offboarding process
- Simplify access reviews

23. "aperson": {
"groups_memberships": [
"Service-Team-A"
]
}
"Service-Team-A": {
"accounts": [
{
"account_alias": "service-team-a-sandbox",
"assumable_role": "read-only"
}
]
},
Biggest Wins - SSO

24. Pain Points

25. Pain Points
- Deleting accounts

26. Pain Points
- Deleting accounts
- Tracking resources

27. Pain Points
- Deleting accounts
- Tracking resources
- Cross account access

28. The Future….

29. Future
- Resource Sharing (RAM)
- Shared VPCs
- DNS Zones
- AMIs

30. Future
- Resource Sharing (RAM)
- Shared VPCs
- DNS Zones
- AMIs
- Improving onboarding / offboarding

31. Future
- Resource Sharing (RAM)
- Shared VPCs
- DNS Zones
- AMIs
- Improving onboarding / offboarding
- Improving IAM for service teams