Module 5 of 6 β€’ Multi-Account Architecture & Governance

Cross-Account Networking & AWS Organizations Settings

Real companies split their cloud into multiple AWS Accounts (Production, Development, Shared Services, Network Hub) managed under an AWS Organization. Compare Transit Gateway, VPC Peering, and Cross-Account PrivateLink belowβ€”and toggle Organization settings (RAM, SCPs, Route Isolation) to see how they control and secure connectivity!

πŸ›οΈ
Multi-Account Analogy: Think of each AWS Account as a separate branch office building, and AWS Organizations as the corporate parent company. VPC Peering is a direct 1-to-1 skybridge between two buildings. Transit Gateway (shared via AWS RAM) is a central Grand Central Station hub that connects all company buildings while keeping Dev employees out of the Production building. Cross-Account PrivateLink is a secure drive-thru window that exposes just one service to another account (even if both buildings numbered their rooms identically!).
Next: Module 6 (Troubleshooting Lab) β†’ ← Prev: Module 4 (Security Groups & NACLs)
Pattern 1: AWS Transit Gateway Shared via AWS RAM Across Organization
πŸ›οΈ AWS Organization (o-acme-corp) β€’ RAM Sharing: ENABLED β€’ SCP Guardrails: ACTIVE 🏒 Account A: Production OU Acct: 1111-1111-1111 | VPC: 10.1.0.0/16 πŸ–₯️ Prod Payment App EC2 Private IP: 10.1.2.50 πŸ›‘οΈ Org SCP: Local IGW Blocked (Uses Hub Egress) πŸ§ͺ Account C: Sandbox / Dev OU Acct: 2222-2222-2222 | VPC: 10.2.0.0/16 πŸ–₯️ Developer Test Workload Private IP: 10.2.2.80 Should reach Shared Services, NOT Prod! πŸ”€ AWS Transit Gateway Shared via AWS RAM (ram-tgw) Prod ⇄ Shared: ALLOW Dev ⇄ Shared: ALLOW Dev ⇄ Prod: ISOLATED Centralized Org Routing Hub 🏒 Account B: Shared Acct: 3333 | 10.10.0.0/16 πŸ” Central Auth API IP: 10.10.4.25:443 Used by all accounts Via TGW Attachment πŸ›‘οΈ Central Egress Hub AWS Network Firewall + Central NAT & IGW Inspects all internet traffic for the Org 🌍 EXTERNAL ACCOUNT Outside AWS Organization! Org: o-stranger99 πŸ•΅οΈ Unapproved Peer Acct: 6666-6666-6666 Tries to peer or attach to your Prod VPC
AWS Organizations Boundary (SCPs, RCPs, RAM) Cross-Account Bridge (TGW / Peering / PrivateLink)