An AWS Organisation for the whole TAM team

What was going on

Own’s platform can export backup snapshots to AWS S3 buckets or MySQL servers, and encrypt them with AWS Key Management Service. TAMs needed AWS access to test those features and troubleshoot customer issues.

Until then they had to create and maintain personal AWS accounts. That was inefficient, cost them money and carried real security risks. We needed something secure, cost-effective and standard.

What I was asked to do

Design and implement an AWS Organisation that centralised billing, separated services into dedicated accounts, and gave TAMs secure access to S3, RDS MySQL and KMS. It also needed monitoring, auditing and usage limits to prevent misuse or runaway costs.

What I did

I set up three separate accounts.

• Alpha: the primary account, handling billing, payment and user identity through IAM Identity Centre single sign-on, with Cost Explorer and CloudTrail for monitoring and auditing
• Beta: provisions S3 buckets and programmatic access for connection testing, limited to 50GB a month
• Charlie: manages MySQL servers on RDS, with one database per TAM for testing, programmatic access and a 50GB cap
• Role-based access control so TAMs only reach what they need
• CloudTrail logging across all accounts, and CloudWatch alerts for excessive usage or anomalies

What changed

Billing was centralised and the cost of personal accounts disappeared. TAMs could securely access the resources they needed to test and troubleshoot, and usage limits and automated alerts kept costs under control.

Doing it responsibly

Role-based access keeps the risk of unauthorised access low, and audit logs provide transparency and accountability. The design follows cybersecurity best practice and removes a cost TAMs shouldn’t have had to carry.