An account for the project
A developer inviting a second person into the new AWS project experience can give that person access under an individual Builder ID. In a November 11 account of changes rolled out over several months, AWS identity executive Keshav Narsipur described how the service places a project inside an AWS-managed organization. Each project gets its own member account, spending limit and set of collaborators. A team can separate an experiment from a customer-facing beta before either grows large enough to warrant a dedicated administrator.
Two kinds of access
For a small business bringing in a contractor, a project invitation narrows the question of where that person should work. Individual sign-in also removes a familiar obstacle at the end of an engagement. A firm that shared one login would have to change a credential other people still need. Builder ID supports an authenticator app or a security key, including when the person uses a social sign-in provider. The availability of that protection leaves a specific question for the owner to verify with each collaborator: has the second factor been registered?
What can outlive an invitation
The workload has a separate identity. AWS says IAM Role Manager initially assigns roles to applications as developers build them, using permissions appropriate to typical service calls. The project owner can later take control of those roles and narrow the permissions to actual use. A contractor’s departure and an application’s handover therefore deserve separate entries in the project record. One accounts for the people with access. The other accounts for the software that keeps running after those people leave.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
