AWS Account Creation

Arda Systems uses a multi-account AWS structure. Each Infrastructure maps to one AWS account. This guide walks through creating a new account in that structure.

1. Collect the Information

Before starting, gather:

Account Information:

• The kind of infrastructure (e.g., Prod, NonProd, Sandbox).
• The qualifier of the infrastructure, either an application (e.g., amm, oam) or, in the case of a Sandbox, an individual (e.g., denis).
• The revision of the infrastructure, as a three-digit number (e.g., 001, 023, 014).

AWS:

• Root User credentials (available in 1Password, Arda-SystemsOAM vault).
• Account Name: must match the name of the Infrastructure it will be associated with.
• Organizational Unit:
  • Development — for Development Infrastructures, when kind is Sandbox or NonProd
  • Platform — for OAM Infrastructures, when kind is Prod and qualifier is oam
  • Platform/Production — for regular Production Infrastructures, otherwise

2. Derive the Email Address

Every AWS account requires a unique email address. Arda uses sub-addressed groups following the scheme infra.<kind>+<qualifier>.<revision>@arda.cards.

Existing base groups:

• infra.sandbox@arda.cards
• infra.nonprod@arda.cards
• infra.prod@arda.cards

Example sub-addresses:

• infra.sandbox+kyle.001@arda.cards
• infra.nonprod+amm.014@arda.cards
• infra.prod+oam.005@arda.cards

Important The email address must be between 6 and 64 characters long. The scheme adds a fixed overhead of 26 characters, leaving ample space for a 35-character qualifier and a three-digit revision.

Do not create new groups following the legacy pattern systems-<infrastructure>@arda.cards.

No Google Workspace administrative access is required for this account-creation flow. Use the matching existing base group and sub-addressing only.

3. Log into AWS as Root User

1. Go to the AWS Root Login page.
2. Select Root User and enter credentials (or use 1Password to fill them in).
3. Navigate to AWS Organizations (search for “Organizations” in the search bar).

Note: If the login process shows an error, refresh the page or click Sign In again.

4. Create the Account in the Appropriate OU

1. In AWS Organizations, select the Organizational Unit based on the rules in Step 1 (kind + qualifier).
2. Click Add an AWS account (top right, orange button).
3. Select Create an AWS account and fill in:
   • AWS account name: Name of the Infrastructure (e.g., NonProd-amm-023)
   • Email address: The email created in Step 2 (e.g., infra.nonprod+amm.023@arda.cards)
   • IAM role name: Leave as default OrganizationAccountAccessRole
4. Click Create AWS account.

5. Set Up Access to the New Account

1. Navigate to IAM Identity Center (search for it; ensure the us-east-2 region is selected).
2. Go to AWS Accounts in the left menu and select the account you just created.
3. Click Assign users or groups and select the appropriate groups. Do not assign individual users.
4. On the next page, select the DevelopmentAdmin permission set.
5. Review and click Submit.

6. Finalize

The account is created and configured for access by the selected groups. For additional permissions or new users, use the IAM Identity Center Groups section or Permission Sets.