<p>Start by reading this: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html</a></p>

<p>Those are best-practices and do not take into account business policies.</p>

<p>I don't think having one account per region is more secure than having policies scoped by regions. In cli, you will have to specify the region in the command anyway (not sure if AWS cli uses a default region if you don't specify one in your credentials file).</p>

CC BY-SA 4.0
2020-03-30T15:07:45.030Z
I’m pretty sure us-east-1 is a auto default for older accounts and us-east-2 or some other one is default on newer accounts.  As we use #1, that’s where my worries come in.  A messed up command could cause damage to the default.
John Humphreys
CC BY-SA 4.0
2020-03-30T14:34:28.757Z
2020-04-01T08:23:55.503Z
2020-04-01T08:23:55.503Z
Kaymaz
<p>In the past, I've usually had separate accounts for each region that I've worked in.  These accounts had different IAM roles/etc, so there was very little chance I'd inadvertently mess up region A when working on region B and vice versa.</p>

<p>Recently, we deployed to another region <em>within the same account</em>.  This means, without extra controls, just setting the default region differently on your CLI could have fairly disastrous consequences.</p>

<p>While IAM is global, is it generally recommended to have distinct uses per region / restrict which resources they can hit with policies, or is that overkill?  Are there any good tools for helping you "not mess up" when running anything on the CLI?  (including things like terraform)?  Do you know any other "best practices" or good resources to learn about this particular area?</p>

<amazon-web-services><credentials>
AWS Credentials - What are multi region user/role management best practices?
John Humphreys
# AWS Credentials - What are multi region user/role management best practices?

(Asked by: username_0 on 2020-03-28)

In the past, I've usually had separate accounts for each region that I've worked in. These accounts had different IAM roles/etc, so there was very little chance I'd inadvertently mess up region A when working on region B and vice versa.

Recently, we deployed to another region *within the same account*. This means, without extra controls, just setting the default region differently on your CLI could have fairly disastrous consequences.

While IAM is global, is it generally recommended to have distinct uses per region / restrict which resources they can hit with policies, or is that overkill? Are there any good tools for helping you "not mess up" when running anything on the CLI? (including things like terraform)? Do you know any other "best practices" or good resources to learn about this particular area?

**Tags:** amazon-web-services, credentials


---

## 1 answers

### Answer by username_1 on 2020-03-30. Score: 2

Start by reading this: <https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html>

Those are best-practices and do not take into account business policies.

I don't think having one account per region is more secure than having policies scoped by regions. In cli, you will have to specify the region in the command anyway (not sure if AWS cli uses a default region if you don't specify one in your credentials file).

> **Comments:**
> **username_0**: I’m pretty sure us-east-1 is a auto default for older accounts and us-east-2 or some other one is default on newer accounts.  As we use #1, that’s where my worries come in.  A messed up command could cause damage to the default.  

---

