AWSのOU設計とアカウント - あなたはいくつAWSアカウントを持っている？

OU 構造の設計は 1 回限りの作業ではありません。企業がクラウドの採用を増やし、AWS追加のワークロードをlanding zone に移行するにつれて、その OU 設計 (および暗黙のうちにポリシーの概念) も自然に進化していきます。
cf. 学んだ事項とベストプラクティス - AWS 規範ガイダンス

OU をフォルダと間違えないでください。ポリシーの対象と考えてください。OUAWS アカウント とその階層はポリシーの構造化要素であり、常にポリシーのコンテナとして扱う必要があります。AWS アカウント同じポリシーセットを必要とするものはすべて同じ OU に配置することをお勧めします。このガイドラインは、ネストされた OU (OU 内の OU) にも適用されます。
cf. 学んだ事項とベストプラクティス - AWS 規範ガイダンス

• Production と Non-Production で同じ名前のものは、アカウント内に同じ構成ができあがる。

Overview

概観はこんな感じ。

これは次のホワイトペーパーの引用。

cf. Recommended OUs and accounts - Organizing Your AWS Environment Using Multiple Accounts

OU Structure

ホワイトペーパーにある Recommended OUs and accounts の内容を図に起こしながら、部分的に拡充していく。

OUを別の切り口（アカウントの使用者）で分類してみる。

• クラウド全体
  • Cloud Builder
  • Security Team
  • Operation Team
• プロダクトやサービス
  • Developer
  • Cloud Builder
• 組織や人
  • Cloud Builder
  • ビジネス部門で特殊な要件がある人

Services on each AWS Accounts

Management Account on Root

Log Archive Account on Security OU

Security OU に所属するこのアカウントはセキュリティ関連の情報を集約して保存する。

• prod
  • aws-log-archive-prod

Security Tooling (Audit) Account on Security OU

Security OU に所属するこのアカウントは、セキュリティ関連のツールやコンソールへのアクセス、調査を目的とした Organization 内のすべてのアカウントに対する View-Only なアクセスを提供する。

• prod
  • aws-security-tooling-prod
• test
  • aws-security-tooling-prod

Backup Account on Infrastructure OU

• prod
  • aws-backup-prod

Identity Account on Infrastructure OU

• prod
  • aws-identity-prod

Monitoring Account on Infrastructure OU

他のAWSアカウント上のリソースやアプリケーション、ログデータ、パフォーマンスを監視するために使用されるアカウント。
監視対象の範囲や、監視を担当する人・組織を考慮することで、さらに具体化して検討ができそうな領域。

• prod
  • aws-monitoring-prod
• test
  • aws-monitoring-test

Network Account on Infrastructure OU

• prod
  • aws-network-prod
• test
  • aws-network-test
• dev
  • aws-network-dev

Operation Tooling Account on Infrastructure OU

• prod
  • aws-operation-tooling-prod
• test
  • aws-operation-tooling-test

Shared Services on Infrastructure OU

AWS Organizations 内の複数のAWSカウントで共有されるITサービスやリソースをホストして管理する。

• prod
  • aws-shared-xxxx-service-prod
• test
  • aws-shared-xxxx-service-test

Sandbox Accounts on Infrastructure OU

The Sandbox OU contains accounts in which your builders are generally free to explore and experiment with AWS services and other tools and services subject to your acceptable use policies. These environments are typically disconnected from your internal networks and internal services. Sandbox accounts should not be promoted to any other type of account or environment within the Workloads OU.
cf. Sandbox OU (Experimental) - Organizing Your AWS Environment Using Multiple Accounts

A common practice is to provide a sandbox account to either each builder or each small team of builders, along with cloud spend budgets to ensure that their AWS spending aligns within your policies. In more advanced scenarios, you might provide your builders and teams with the option to have multiple sandbox accounts so that they can experiment more freely with configurations that entail use of multiple accounts (for example, experimenting with cross-account IAM roles).
cf. Sandbox OU (Experimental) - Organizing Your AWS Environment Using Multiple Accounts

• Temporary resources and environments

• Wide-ranging access

• No access to corporate resources and non-public data

• Sandbox and development environments

• aws-sandbox-xxxx[-yyyy]

Workloads Accounts on Workload OU

• prod
  • aws-xxxx-yyyy-prod
• test
  • aws-xxxx-yyyy-test
• dev
  • aws-xxxx-yyyy-dev

Exceptions Accounts on Exception OU

The Exceptions OU houses accounts that require an exception to the security policies that are applied to your Workloads OU. Normally, there should be a minimal number of accounts, if any, in this OU.
cf. Exceptions OU (Procedural) - Organizing Your AWS Environment Using Multiple Accounts

Transitional Accounts on Transitional OU

The Transitional OU is intended as a temporary holding area for existing accounts and workloads that you move to your organization before formally integrating them into the more standardized areas of your AWS environment structure.
cf. Transitional OU (Procedural) - Organizing Your AWS Environment Using Multiple Accounts

Policy Staging OU

The Policy Staging OU is intended to help teams that manage overall policies for your AWS environment to safely test potentially broadly impacting policy changes before applying them to the intended OUs or accounts. For example, SCPs and tag policies should be tested prior to applying them to the intended OUs or accounts. Similarly, broadly applicable account baseline IAM roles and policies should also be tested using the Policy Staging OU
cf. Policy Staging OU (Procedural) - Organizing Your AWS Environment Using Multiple Accounts

Suspended OU

The Suspended OU is used as a temporary holding area for accounts that are required to have their use suspended.

Moving an account to this OU does not automatically change the overall status of the account. For example, in cases where you intend to permanently stop using an account, you would follow the Closing an account process to permanently close the account.
cf. Suspended OU (Procedural) - Organizing Your AWS Environment Using Multiple Accounts

Individual Business Users OU

The Individual Business Users OU houses accounts for individual business users and teams who need access to directly manage AWS resources outside the context of resources managed within your Workloads OU.

In some cases, you can consider a small number of AWS resources as something other than a workload. For example, a business team might require write access to Amazon S3 buckets to share marketing videos and data with a business partner. In these cases, you might choose to manage these resources in accounts within the individual business users OU rather than in accounts in the Workloads OU.
cf. Individual Business Users OU (Advanced) - Organizing Your AWS Environment Using Multiple Accounts

• aws-xxx-yyy-zzz

Deployments OU (Advanced)

The Deployments OU contains resources and workloads that support how you build, validate, promote, and release changes to your workloads. You might already be using continuous integration/continuous delivery (CI/CD) capabilities to help manage and automate how changes to various types of source code are processed.
cf. Deployments OU (Advanced) - Organizing Your AWS Environment Using Multiple Accounts

Business Continuity OU (Advanced)

The Business Continuity OU is intended to help teams implement a cross-account disaster recovery strategy. The data is as close to air-gapped as possible and the OU has no workload resources. This creates a secure data bunker to help protect your organization and allow for recovery from severe disasters like ransomware. The secure data bunker should only be accessed when the disaster recovery data for a workload is unavailable, untrustworthy, or destroyed.
cf. Business Continuity OU (Advanced) - Organizing Your AWS Environment Using Multiple Accounts

Workloads OU に配置するAWSアカウントに構築するシステム

シンプル

全体感