... or how to turn your single account AWS Code Pipeline into a multi-account one.

Recently I had an opportunity to improve the security posture of an application landscape which went to production in a bit of a rush so certain compromises were made on the way. Now that the applications have been running in a stable manner for some time, the time has come to make some security improvements.

Current Stage

In the current stage, multiple applications are running in the same AWS account together with all the other components such as the whole deployment pipeline, ECR repository, S3 buckets with artifacts and so on.

There are multiple ways how to improve the security posture of this landscape.

In this post I will focus on one of the best practices in the Security Pillar of the AWS Well Architected Framework - SEC01-BP01 Separate workloads using accounts which says:

Establish common guardrails and isolation between environments (such as production, development, and test) and workloads through a multi-account…