Multi-Account Management

Scenario

Companies with multiple Huawei Cloud accounts require centralized EIP management. Traditionally, you must log in to each account to configure firewall policies on the console separately. This approach is inefficient and can expose accounts to security risks if policies are not updated in a timely manner. For example, manually configuring protection policies for 200 EIPs across 10 Huawei Cloud accounts can take hours, making policy consistency difficult to maintain.

To resolve this, CFW provides a multi-account management feature. It integrates with Organizations to aggregate cross-account data and manage resource access. This allows you to centrally protect EIPs across all member accounts through a single, unified configuration.

For details about the Organizations service, see Overview of Organizations.

Account Permissions

• Before using the multi-account management function, you need to understand the following account knowledge:

  Table 1 Multi-account protection permissions

  Account Type	Function	Description
  Organization administrator	With the Organizations service, the account can use the management account to create an organization and manage Organizational Units (OUs), accounts, and policies for the organization.	Manage all accounts in the organization.
  Delegated administrator	A delegated administrator account is a member account with special permissions in an organization. The management account of the organization can specify a member account as the delegated administrator account of a trusted service.	Manage all accounts in the organization.
  Member account	Except for the management account, other accounts in an organization are member accounts. An account can be a member of only one organization at a time.	View basic organization information.

• When the multi-account function is enabled, CFW automatically creates a service-linked agency between the organization administrator (or delegated administrator) and the invited account to request EIP information from the invited account.
  • The agency is a cloud service agency. Its permission is CFWServiceLinkedAgencyPolicy, name is ServiceLinkedAgencyForCloudFirewall, and Scope is All resources.
  • If an invited account is deleted, CFW automatically deletes the agency associated with the service in account B.
  • When you unsubscribe from CFW, the service-linked agency associated with the organization administrator (or delegated administrator) and all member accounts is automatically deleted.

Notes and Constraints

• Only the EIPs of member accounts can be managed in a unified manner.
• EIPs cannot be protected across regions. To use CFW in another region, switch to that region and purchase a firewall. For details, see Purchasing and Modifying CFW.
• The number of accounts that can be protected by a single firewall instance is as follows:
  • Yearly/Monthly CFW:
    • Standard edition: 20
    • Professional edition: 50
  • Pay-per-use CFW (professional edition): 20

Configuration Process and Procedure

Before using multi-account protection, you need to enable Enterprise Center, enable Organizations, create an organization, configure CFW as a trusted service, add a delegated administrator account, and invite member accounts. Then, you can use the multi-account management function of CFW to add multiple member accounts in the organization to centrally protect and manage EIPs of the member accounts.

Figure 1 Multi-account protection configuration process

1. (Optional) Enable Enterprise Center.

   Enterprise Center allows you to associate multiple Huawei Cloud accounts for accounting. You can use a master account to create a hierarchical organization, and create member accounts or associate existing ones. The master account then can manage the accounting of all its associated member accounts.

   The current account must have Enterprise Center enabled and become an enterprise master account. For details, see Enabling Enterprise Center.

2. (Optional) Enable the Organizations service and create an organization.

   The Organizations service helps you manage multiple accounts within your organization. It enables you to consolidate multiple Huawei Cloud accounts into a single organization so you can manage the accounts all in one place.

   You can use your current account as the management account to create an organization. For details, see Creating an Organization.

3. Configure CFW as a trusted service in Organizations.

   The management account can enable a cloud service as a trusted service in the organization. Each trusted service has access to the information about the organizational units (OUs) and member accounts in the organization and can also manage the entire organization.

   For details, see Enabling or Disabling a Trusted Service.

4. (Optional) Specify a delegated administrator account in Organizations.

   The management account of your organization can designate a member account to be a delegated administrator account for a trusted service. All the users in the delegated administrator account will have organizational management capabilities.

   For details, see Specifying a Delegated Administrator.

5. In Organizations, invite an account to join the organization as the organization administrator or a delegated administrator.

   The organization administrator or a delegated administrator invites an account to join the organization, and the invited account accepts the invitation. After an invited account successfully joins the organization, it becomes a member of the organization and is managed by the organization in a unified manner.

   For details, see Inviting an Account to Join Your Organization.

6. In CFW, add the invited account to the multi-account management list as the organization administrator or delegated administrator.
   1. Log in to the CFW console.
   2. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
   3. In the navigation pane, choose System Management > Multi-Account Management.
   4. Click Add Account. On the page that is displayed, select the target account. The account is automatically added to the Selected area on the right.

      An account to be added must belong to the same organization. For details about organization accounts, see Overview of an Account.

   5. Click OK.

7. After the account is added, check its information in the account list on the multi-account management page.

   Table 2 Parameters in the account list

   Parameter	Description
   Account Name	Account name.
   EIPs	Number of EIPs under an account.
   Protected EIPs	Number of EIPs protected by the firewall.
   Unprotected EIPs	Number of EIPs that are not protected by the firewall.

Example Configuration

In the following example, Account A (the organization administrator) centrally manages the assets of Account B. The workflow is as follows:

1. (Optional) Configure a delegated administrator: If Account A is not an organization administrator, the current organization administrator must designate Account A as a delegated administrator.

   For details, see Specifying a Delegated Administrator.

2. Invite Account B to the organization. Account A sends an invitation via the Organizations console, and Account B accepts it.

   For details, see Inviting an Account to Join Your Organization.

3. Add Account B to CFW.
   1. Log in to the CFW console.
   2. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
   3. In the navigation pane, choose System Management > Multi-Account Management.
   4. Click Add Account. On the page that is displayed, select the target account. The account is automatically added to the Selected area on the right.

      An account to be added must belong to the same organization. For details about organization accounts, see Overview of an Account.

   5. Click OK.
4. After the account is added, check its information in the account list on the multi-account management page.

Verifying the Configuration

After the configuration is successful, view the EIPs of other accounts and view the account to which the current EIP belongs in the Owner column on the Assets > EIPs page.

References

• To delete a member account, select the account and click Delete Account above the list. In the dialog box that is displayed, click OK.
• Using CFW to Protect EIPs Across Accounts
• Using CFW to Protect VPCs Across Accounts