Multi-Account Management

Scenario

In a multi-cloud environment, enterprises usually need to perform unified security management on the Internet egress IP addresses (EIPs) of multiple accounts. However, in a conventional manner, firewall policies need to be configured one by one, resulting in low management efficiency and security vulnerabilities. CFW provides secure and reliable cross-account data aggregation and resource access capabilities. If your accounts are centrally managed by Organizations, you can use CFW to protect the EIPs of any member account in the organization in a unified manner.

For details about the Organizations service, see Overview of Organizations.

Account Permissions

• Before using the multi-account management function, you need to understand the following account knowledge:

  Table 1 Multi-account protection permissions

  Account Type	Function	Description
  Organization administrator	With the Organizations service, the account can use the management account to create an organization and manage Organizational Units (OUs), accounts, and policies for the organization.	Manage all accounts in the organization.
  Delegated administrator	A delegated administrator account is a member account with special permissions in an organization. The management account of the organization can specify a member account as the delegated administrator account of a trusted service.	Manage all accounts in the organization.
  Member account	Except for the management account, other accounts in an organization are member accounts. An account can be a member of only one organization at a time.	View basic organization information.

• When the multi-account function is enabled, CFW automatically creates a service-linked agency between the organization administrator (or delegated administrator) and the invited account to request EIP information from the invited account.
  • The agency is a cloud service agency. Its permission is CFWServiceLinkedAgencyPolicy, name is ServiceLinkedAgencyForCloudFirewall, and Scope is All resources.
  • If an invited account is deleted, CFW automatically deletes the agency associated with the service in account B.
  • When you unsubscribe from CFW, the service-linked agency associated with the organization administrator (or delegated administrator) and all member accounts is automatically deleted.

Notes and Constraints

• Only the EIPs of member accounts can be managed in a unified manner.
• EIPs cannot be protected across regions. To use CFW in another region, switch to that region and purchase a firewall. For details, see Purchasing and Modifying CFW.
• The number of accounts that can be protected by a single firewall instance is as follows:
  • Yearly/Monthly CFW:
    • Standard edition: 20
    • Professional edition: 50
  • Pay-per-use CFW (professional edition): 20

Configuration Process and Procedure

Before using multi-account protection, you need to enable Enterprise Center, enable Organizations, create an organization, configure CFW as a trusted service, add a delegated administrator account, and invite member accounts. Then, you can use the multi-account management function of CFW to add multiple member accounts in the organization to centrally protect and manage EIPs of the member accounts.

Figure 1 Multi-account protection configuration process

1. (Optional) Enable Enterprise Center.

   Enterprise Center allows you to associate multiple Huawei Cloud accounts for accounting. You can use a master account to create a hierarchical organization, and create member accounts or associate existing ones. The master account then can manage the accounting of all its associated member accounts.

   The current account must have Enterprise Center enabled and become an enterprise master account. For details, see Enabling Enterprise Center.

2. (Optional) Enable the Organizations service and create an organization.

   The Organizations service helps you manage multiple accounts within your organization. It enables you to consolidate multiple Huawei Cloud accounts into a single organization so you can manage the accounts all in one place.

   You can use your current account as the management account to create an organization. For details, see Creating an Organization.

3. Configure CFW as a trusted service in Organizations.

   The management account can enable a cloud service as a trusted service in the organization. Each trusted service has access to the information about the organizational units (OUs) and member accounts in the organization and can also manage the entire organization.

   For details, see Enabling or Disabling a Trusted Service.

4. (Optional) Specify a delegated administrator account in Organizations.

   The management account of your organization can designate a member account to be a delegated administrator account for a trusted service. All the users in the delegated administrator account will have organizational management capabilities.

   For details, see Specifying a Delegated Administrator.

5. In Organizations, invite an account to join the organization as the organization administrator or a delegated administrator.

   The organization administrator or a delegated administrator invites an account to join the organization, and the invited account accepts the invitation. After an invited account successfully joins the organization, it becomes a member of the organization and is managed by the organization in a unified manner.

   For details, see Inviting an Account to Join Your Organization.

6. In CFW, add the invited account to the multi-account management list as the organization administrator or delegated administrator.
   1. Log in to the CFW console.
   2. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
   3. In the navigation pane, choose System Management > Multi-Account Management.
   4. Click Add Account. On the page that is displayed, select the target account. The account is automatically added to the Selected area on the right.

      An account to be added must belong to the same organization. For details about organization accounts, see Overview of an Account.

   5. Click OK.

7. After the account is added, check its information in the account list on the multi-account management page.

   Table 2 Parameters in the account list

   Parameter	Description
   Account Name	Account name.
   EIPs	Number of EIPs under an account.
   Protected EIPs	Number of EIPs protected by the firewall.
   Unprotected EIPs	Number of EIPs that are not protected by the firewall.

Example Configuration

Assume that account A needs to manage the assets of account B. To use CFW to protect the assets of organization members, perform the following operations:

1. If account A is an organization administrator, skip this step. If account A is not an organization administrator, the organization administrator should add account A as a delegated administrator. For details, see Specifying a Delegated Administrator.
2. Account A (organization administrator or delegated administrator) invites account B to join the organization. For details, see Inviting an Account to Join Your Organization.
3. In CFW, use account A to add account B to the list on the Multi-Account Management page.
   1. Log in to the CFW console.
   2. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
   3. In the navigation pane, choose System Management > Multi-Account Management.
   4. Click Add Account. On the page that is displayed, select the target account. The account is automatically added to the Selected area on the right.

      An account to be added must belong to the same organization. For details about organization accounts, see Overview of an Account.

   5. Click OK.

Verifying the Configuration

After the configuration is successful, view the EIPs of other accounts and view the account to which the current EIP belongs in the Owner column on the Assets > EIPs page.

References

• To delete a member account, select the account and click Delete Account above the list. In the dialog box that is displayed, click OK.
• Using CFW to Protect EIPs Across Accounts
• Using CFW to Protect VPCs Across Accounts