AWS Account Access Guide

Overview

The AWS org has 7 accounts. Human access goes through AWS IAM Identity Center (SSO) — one login, pick any account. No long-lived IAM user credentials for human access.

CI/CD uses OIDC federated auth (no stored keys). The devops-admin IAM user exists for automated tooling that cannot use SSO — do not use it for interactive work.

First-Time Setup

Step 1 — Install AWS CLI v2

bash

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip && sudo ./aws/install
aws --version   # should show 2.x

Step 2 — Copy the AWS config

The ~/.aws/config on the Kobe Cloud PC already has all account profiles configured. For a new machine, create ~/.aws/config with:

ini

[profile main]
sso_start_url = https://d-9267898861.awsapps.com/start
sso_region = us-west-2
sso_account_id = 206820231356
sso_role_name = AdministratorAccess
region = us-west-2
output = json

[profile logging]
sso_start_url = https://d-9267898861.awsapps.com/start
sso_region = us-west-2
sso_account_id = 038901680748
sso_role_name = AdministratorAccess
region = us-west-2
output = json

[profile networking]
sso_start_url = https://d-9267898861.awsapps.com/start
sso_region = us-west-2
sso_account_id = 238342914131
sso_role_name = AdministratorAccess
region = us-west-2
output = json

[profile prod]
sso_start_url = https://d-9267898861.awsapps.com/start
sso_region = us-west-2
sso_account_id = 807267566999
sso_role_name = AdministratorAccess
region = us-west-2
output = json

[profile dev]
sso_start_url = https://d-9267898861.awsapps.com/start
sso_region = us-west-2
sso_account_id = 040067931468
sso_role_name = AdministratorAccess
region = us-west-2
output = json

[profile identity]
sso_start_url = https://d-9267898861.awsapps.com/start
sso_region = us-west-2
sso_account_id = 414134953818
sso_role_name = AdministratorAccess
region = us-west-2
output = json

[profile backup]
sso_start_url = https://d-9267898861.awsapps.com/start
sso_region = us-west-2
sso_account_id = 863609217450
sso_role_name = AdministratorAccess
region = us-west-2
output = json

Step 3 — Log in

bash

aws sso login --profile main

This opens a browser. Log in with your ciriusgroup.com Microsoft account (SSO is federated through Entra). After login, the SSO session is cached and all profiles work without re-authenticating for 8 hours.

Daily Use

Running commands against a specific account

bash

# List EC2 instances in Prod
aws ec2 describe-instances --profile prod --region us-west-2

# Check S3 buckets in Backup account
aws s3 ls --profile backup

# Run Terraform in a specific account directory
cd aws-infra/prod
export AWS_PROFILE=prod
terraform plan

Re-authenticating when the session expires

bash

aws sso login --profile main
# One login covers all profiles for 8 hours

Checking which account you're currently authenticated as

bash

aws sts get-caller-identity --profile <profile-name>

Account Quick Reference

Profile	Account ID	What Lives Here
`main`	206820231356	Org root, billing, OIDC trust for GitHub Actions
`logging`	038901680748	CloudTrail org trail, Security Hub delegated admin, Audit Manager, centralized log storage
`networking`	238342914131	Palo Alto firewall, Panorama, Transit Gateway, Twingate connectors
`prod`	807267566999	DR workloads, Cloud PC (Kobe), EC2 instances
`dev`	040067931468	Development and test (minimal plumbing)
`identity`	414134953818	AD, identity services
`backup`	863609217450	Veeam backup targets, S3 backup buckets with Object Lock

For most operational work use prod, networking, or logging. The main account is org management — avoid making resource changes there.

Running Terraform

All Terraform changes go through GitHub Actions — never terraform apply locally. But terraform plan locally is fine and often useful for validation.

bash

cd aws-infra/<account-dir>   # e.g. aws-infra/prod

# Authenticate
export AWS_PROFILE=prod

# Init (first time or after provider changes)
terraform init

# Plan — shows what would change without applying
terraform plan

# Never run apply locally — push a PR instead

State files live in S3 per account. The backend config in each directory points to the right bucket — do not change backend configs without Rory's approval.

Console Access

For GUI work, use the SSO portal:

Go to https://d-9267898861.awsapps.com/start
Log in with your ciriusgroup.com Microsoft account
Select the account and click "Management console"

This gives you browser-based console access to any account without separate passwords.

Cross-Account Operations (Agents and Automation)

The security monitoring agents running in Container Apps use a cross-account assume-role pattern. From the Cloud PC (AWS Prod account), they assume OrganizationSecurityAudit in each account to read CloudTrail, Security Hub, and IAM.

This is automated — you do not manually assume-role for agent work. If you are writing a new AWS agent, see Agent Development Guide for the cross-account boto3 pattern.

Break-Glass — Root Account Access

AWS root accounts are only for emergencies when IAM is broken. Root credentials and MFA tokens are in Keeper → "AWS Root — [Account Name]".

The physical MFA token for root accounts is kept in the office. If you need root access remotely without the token, use the account recovery flow.

Never use root for routine work. See Break-Glass Procedure.

Troubleshooting

`Error: SSO token has expired`

bash

aws sso login --profile main

One re-login covers all profiles.

`Error: No credentials` when running Terraform

bash

export AWS_PROFILE=<account-profile>
aws sts get-caller-identity   # verify you're logged in

`AccessDenied` on a specific API call

The SSO role is AdministratorAccess — broad access. If you hit AccessDenied it may be an SCP (Service Control Policy) at the org level blocking the action. Check the Org management account → SCPs for restrictions. Common SCP restrictions: leaving the org, disabling CloudTrail, root user actions.

`The config profile could not be found`

The profile name in your command doesn't match ~/.aws/config. Check the exact profile names with aws configure list-profiles.

AWS DR Overview — what lives in each account
AWS Network Topology — VPC and network layout
OIDC Authentication — how CI/CD authenticates (different from human access)
Break-Glass Procedure — root account emergency access

Document History

Date	Change	Author
May 2026	Initial draft — SSO setup, daily use, account reference, Terraform, console access, troubleshooting. Based on ~/.aws/config profile inventory and aws-infra IAM Terraform.	Rory

AWS Account Access Guide ​

Overview ​

First-Time Setup ​

Step 1 — Install AWS CLI v2 ​

Step 2 — Copy the AWS config ​

Step 3 — Log in ​

Daily Use ​

Running commands against a specific account ​

Re-authenticating when the session expires ​

Checking which account you're currently authenticated as ​

Account Quick Reference ​

Running Terraform ​

Console Access ​

Cross-Account Operations (Agents and Automation) ​

Break-Glass — Root Account Access ​

Troubleshooting ​

Error: SSO token has expired ​

Error: No credentials when running Terraform ​

AccessDenied on a specific API call ​

The config profile could not be found ​

Related Documents ​

Document History ​

AWS Account Access Guide

Overview

First-Time Setup

Step 1 — Install AWS CLI v2

Step 2 — Copy the AWS config

Step 3 — Log in

Daily Use

Running commands against a specific account

Re-authenticating when the session expires

Checking which account you're currently authenticated as

Account Quick Reference

Running Terraform

Console Access

Cross-Account Operations (Agents and Automation)

Break-Glass — Root Account Access

Troubleshooting

`Error: SSO token has expired`

`Error: No credentials` when running Terraform

`AccessDenied` on a specific API call

`The config profile could not be found`

Related Documents

Document History