Ravi Sir's Cards › AWS
Org-wide or account list?
This comparison card contrasts Org-wide or account list. PrincipalOrgID fence is described as any principal in o-…. It scales with new accounts. Explicit account Allow list is described as enumerate account ids. It also notes precise but brittle. The card pairs PrincipalOrgID fence with growing Organizations, and Explicit account Allow list with fixed partner set.
Read card text
What this card says
Org-wide or account list?
PrincipalOrgID fence
Any principal in o-…; scales with new accounts.
Explicit account Allow list
Enumerate account ids; precise but brittle.
Key points
Internal shared datasets.
Two partner accounts only.
Example
StringEquals aws:PrincipalOrgID / StringEquals aws:PrincipalAccount
Use when
Growing Organizations.
Fixed partner set.