Security architecture fundamentals
Assign different services or applications to separate accounts based on function, compliance requirements, or unified control policies. This use of multiple accounts provides natural fencing that keeps your business services and applications independent from each other. For example, you can use account-level fencing to strictly separate production environment applications from development or staging environment applications.
Centralized account management: Resource Directory automates the creation and management of Alibaba Cloud accounts and provides ongoing governance. You can also use folders to group accounts. This helps you logically organize your business services or applications based on their purpose and requirements.
Centralized access control: You can use Resource Directory control policies to centrally manage permission borders for resource access across all levels of your organization. This lets you establish organization-wide or specific access control principles to ensure security, compliance, and cost control. For example, you can prohibit members from requesting domain names or deleting log records.
Centralized service and resource configuration: The multi-account architecture of Resource Directory supports the unified configuration of Alibaba Cloud services across accounts. For example, you can use ActionTrail to record all operation logs within your organization. You can also use CloudConfig to aggregate compliance data, monitor business compliance in real time, and enable a rapid response.
Delegated administration: You can use the delegated administration feature to assign a delegated administrator account for a trusted service. This account can then manage the service for the entire organization. This approach simplifies the unified management of Alibaba Cloud services and separates the service management account from other accounts. This reduces the exposure of the management account to threats and improves security.
This approach helps you build a secure, efficient, and scalable multi-account governance framework on Alibaba Cloud. It provides a solid foundation for business growth in a complex cloud environment.