‫Now let's do a summary of the account's best practices.
‫So first, if you want to operate multiple accounts,
‫it is recommended you use AWS organizations.
‫And if you want to restrict which account can do what,
‫their power, then you should use SCP
‫for service control policies.
‫It's very easy for you to set up multiple accounts
‫with best security practices with AWS Control Tower,
‫which is sitting on top of organizations.
‫You should use tags and cost allocation tags
‫for easy management and billing in your accounts.
‫And you need to remember the IAM guidelines,
‫such as enabling multifactor authentication, MFA,
‫the least-privilege, creating a password policy,
‫and enabling password rotation.
‫Use AWS Config to record all resource configurations
‫and compliance over time in case something goes wrong.
‫CloudFormation is extremely helpful to deploy stacks
‫across multiple accounts and regions.
‫And for you to really manage all these accounts all at once,
‫Trusted Advisor is great to get insights
‫and to find the right support plan adapted to your needs.
‫Send your service logs and access logs
‫to Amazon S3 or CloudWatch Logs,
‫maybe even in a separate accounts for log-in
‫such as you adhere to the best security practices.
‫Use CloudTrail to record API calls made within your accounts
‫or in different regions and so on.
‫And then if your account happens to be compromised,
‫then please change the root password,
‫delete and rotate all passwords and keys,
‫and contact the AWS support.
‫Finally, you can use AWS Service Catalog
‫to allow users to create predefined stacks
‫that are defined by administrators in the first place.
‫So that's it for this lecture.
‫I hope you liked it,
‫and I will see you in the next lecture.