# Structure Environments Across AWS Accounts

**URL:** <https://discourse.sst.dev/t/structure-environments-across-aws-accounts/1336>\
**Category:** Chapter Comments\
**Created:** [October 9, 2019, 2:07am UTC](https://discourse.sst.dev/t/structure-environments-across-aws-accounts/1336 "2019-10-09T02:07:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [October 9, 2019, 2:07am UTC](https://discourse.sst.dev/t/structure-environments-across-aws-accounts/1336/1 "2019-10-09T02:07:54Z")

</div>

Link to chapter - [https://serverless-stack.com/chapters/structure-environments-across-aws-accounts.html](https://serverless-stack.com/chapters/structure-environments-across-aws-accounts.html)

---

<div class="post-metadata">

**Author:** ![RIMikeC](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@RIMikeC](https://discourse.sst.dev/u/RIMikeC)\
**Post date:** [October 14, 2019, 1:11pm UTC](https://discourse.sst.dev/t/structure-environments-across-aws-accounts/1336/2 "2019-10-14T13:11:52Z")

</div>

This is a tricky subject to generalise about, as engineering functions will have differing requirements, so there is no one-size-fits-all. _However_, the statement " not every developer on your team should have access or direct access from their terminal to the _production_ environment" is surely incorrect. _Developers should never have write access to production_, (this is what release pipelines are for). They can of course have read-only access, which I would suggest is managed through strict IAM policies, as explained in the rest of the text.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [October 26, 2019, 2:13am UTC](https://discourse.sst.dev/t/structure-environments-across-aws-accounts/1336/3 "2019-10-26T02:13:36Z")

</div>

Yeah exactly. We should clarify that it’s write access that should be restricted.

---

<div class="post-metadata">

**Author:** ![bunoto](https://avatars.discourse-cdn.com/v4/letter/b/439d5e/32.png) [@bunoto](https://discourse.sst.dev/u/bunoto)\
**Post date:** [August 24, 2020, 11:23pm UTC](https://discourse.sst.dev/t/structure-environments-across-aws-accounts/1336/4 "2020-08-24T23:23:28Z")

</div>

I don’t know if this topic is too old to discuss or not. I’m working on this problem in my company.  
I read the article. I have one question: how do you add a same user (for ex: Mark) into the different accounts with the different permissions ?  
For ex: Make has FullAccessS3 on staging account but ReadOnly on prod account

Thank you

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [September 7, 2020, 11:53pm UTC](https://discourse.sst.dev/t/structure-environments-across-aws-accounts/1336/5 "2020-09-07T23:53:07Z")

</div>

You can create two different roles in these accounts that the user will assume into. And those two roles can have the permissions you are looking for.