AWS – Using Multiple (Staging, UAT and Production) Accounts Under AWS Organization
Tags: aws, awsorganization, slider
Published: 2020-02-07 03:56:18

---
title: AWS – Using Multiple (Staging, UAT and Production) Accounts Under AWS Organization
published: true
date: 2019-12-10 04:11:18 UTC
tags: AWS,AWS Organization,Slider
canonical_url: 
---

This article assumes that you want to have separate AWS console accounts such as Staging, UAT and Production at one place.

The best way to achieve this kind of separation is by using [AWS Organizations](https://console.aws.amazon.com/organizations/home) and AWS Single Sign-On (SSO)

AWS Organizations provides all the necessary options to achieve this goal.

Okay enough talk, Lets do this !

## Create Organization

Search AWS Organization in the service tab and then create your organization

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140025/001-7.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140025/001-7.png)

You will receive a confirmation email soon. Once you verify your master account, You’re good to go !

## Add/Invite AWS accounts

You can associate an existing AWS account to your organization or you can create a new one.

In our example we will create a new one by clicking on Add Account

You can also use Organizational Units (OUs) for more hierarchical structure. We will use a simpler approach in our example which can be easily transformed into OUs in the future.

This is our structure for now

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140049/002.jpeg)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140049/002.jpeg)

Now lets start by adding these accounts into your organization

![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140108/003-7.png)

Choose Create account and fill Full Name (Staging, dev and production etc) and Email, leave the IAM role name for now ( we will add roles and policies on the AWS Accounr level later )

Repeat the same for each account you want to create such as Staging, UAT and Production

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140158/004-7.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140158/004-7.png)

## AWS Single Sign-On (SSO)

From services tab select AWS Single Sign-On (SSO) and click on **Enable AWS SSO**. Once its enabled, you should be able to see the following options

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140220/005-5.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140220/005-5.png)

Lets start with the first step **Choose your identity source**. You can click on that option and change the User portal URL. This will be a portal page for your team to login and select the AWS account they are associated with.

## Users and Groups

Now lets create Users and Groups that we can associate with AWS accounts later on.

Click on the **Users** on the left and select **Add User**

![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140246/006-6.png)

Fill in all the details and leave **Groups** as it is for now.

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140301/007-1.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140301/007-1.png)

Add as many users you want to add by repeating the same steps.

Lets create our **Groups** now. In my case I have created Development and Production groups

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140322/008-2.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140322/008-2.png)

Time to assign the **Users** to the **Groups**. Click on the Users tab and select the user you want to associate with a group. Once you select the user, you’ll be able to see **Groups** tabs

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140342/009-2.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140342/009-2.png)

Click on **Add to group** and assign the user to one or multiple groups

## AWS Accounts

This is the final step I PROMISE. Its time to associate the users with the AWS accounts ( You have created in the organization ). For that you need to click on AWS account tab on the left.

Click on the on the desired AWS account and select **Assign Users**

![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140403/010-2.png)

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140424/011-1.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140424/011-1.png)

Select the **Groups** tab and choose the User’s group you want to associate with this Account. Click on **Next: Permission set**

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140447/012-1.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140447/012-1.png)

Click on **Create new permission set**. You have have two options to choose from on the next page. In our example, we are selecting **Use an existing job function policy** and the **AdministratorAccess** policy.

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140506/013-1.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140506/013-1.png)

You can create a custom permission set as per your policies if you want

On the final page, tick on the permission set you just have created and hit Finish YEAYYYYYYYY !!!!!!!

When you go to the portal ( created earlier in the post ). You will see login screen.

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140533/014-1.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140533/014-1.png)

Login with any of the user from the associated group and you be able to see the following.

[![](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140554/015-1.png)](https://s3-ap-southeast-2.amazonaws.com/sal-blog/wp-content/uploads/2019/12/27140554/015-1.png)

You can click on the Management console of any AWS account and Bingo. you’re in that environment’s AWS account !