AWS Resource Naming Conventions #

Global Resource Naming and Onboarding App Team Process #

1. All naming information is provided by project manager and verified with infrastructure team to fit within below naming criteria.
2. Approved names are added to master lookup tables at centralized GitHub location for all Terraform code to reference.
3. Names are then submitted to the Okta team for inclusion in resource based group names that grant access to whichever platforms are needed with the correct permission sets.
4. The core 5 informational nodes of the resource names should be consistent across all resources in all platforms and resource access groups in Okta.
5. Each resource type has a separate naming pattern.

Layout #

1. All lowercase split with dashes.

<node1>-<node2>-[<node3>]

[] denotes optional node

<#description#> node can be added to aid in human readability. Multiple description nodes are allowed but mind overall pattern character limit.

OU Pattern #

ou-<agency>-[<division>]-aws-<product/org-category>-[<#description#>-][<project/team>-][<prod/nonprod>-]<root-id>

• Must be 1 to 128 characters long
• Can include any Unicode character (no restrictions on letters, numbers, or symbols)
• org-category examples are security, infrastructure, network, cjis, hipaa, general, etc.
• Only prod and nonprod environments allowed.
• root-id is taken from AWS Organizations r-**** value in the management account.

Agency and Foundation Level 1 OU Examples #

Note iowa is mandatory agency with no division.

• Foundation Infrastrucure OU:
  • ou-iowa-aws-infrastructure-prod-d3gh
• Foundation Security Tooling OU:
  • ou-iowa-aws-security-tooling-prod-d3gh
• Foundation ignored OU for sanboxes:
  • ou-iowa-aws-ignored-prod-d3gh
• Agency OUs:
  • ou-iowa-aws-hhs-prod-d3gh
  • ou-iowa-aws-iwd-prod-d3gh
  • ou-iowa-aws-dom-prod-d3gh

Compliance Level 2 OUs #

Note OUs can be based on agency, division, product, or project/team, but must include every name in the hierarchy down to that level of specificity.

• All Compliances OU for HHS:
  • ou-hhs-aws-all-prod-d3gh
  • ou-hhs-aws-all-nonprod-d3gh
• No Compliance OU:
  • ou-dom-aws-general-prod-d3gh
• Specific Compliance OU:
  • ou-iwd-aws-fti-prod-d3gh
• Transitional OU for Migration project only:
  • ou-ipers-aws-transitional-prod-d3gh

The Core 5 Nodes for Account and Resource Patterns #

There are 5 required nodes that provide a primary key to aid in search for the resources they are linked to. Some resource patterns may have additional required nodes, but these are required for ALL account and resource level patterns.

agency #

Abbreviated name of agency owning the project and platform. Examples: dom, iwd, hhs, dial, ipers

platform #

Abbreviated brand name of cloud or platform. Examples: azc Azure Cloud. aws Amazon Web Services. gcp Google Cloud Platform. oci Oracle Cloud. nci Neutanix. ovm Oracle VM Infra. vmw VMware.

product #

General product that the permissions are used for. Examples: elias, avx, idss, connect, safher

project/team #

Development/implementation/infrastructure/auditing team such as a contracting group or internal team for further diviation. Examples: idss, cobalt, edbi. accen, amazon, forest, digx, mspan

env #

Environment for a given resource. Examples: dev, test, uat, prod, stage, govcloud

Account Pattern #

acct-<agency>-[<division>-]aws-<product/category>-[<#description#>-]<project/team>-<env>-<root-id>

• Must be 3–63 characters long
• Can include lowercase letters, digits, and hyphens
• Must start and end with a letter or digit (no leading/trailing hyphens)
• Cannot contain two consecutive hyphens
• root-id is taken from AWS Organizations r-**** value in the management account.

Foundation Accounts:

Note optional nodes highlighted below.

• acct-iowa-aws-security-logarchive-infra-nonprod-73t0
• acct-iowa-aws-mgmt-payer-infra-prod-9s89
• acct-iowa-aws-security-tooling-infra-nonprod-73t0
• acct-iowa-aws-network-infra-nonprod-73t0

Workload Accounts:

• acct-dial-aws-safher-digix-govcloud-2we9
• acct-dom-doit-aws-shared-infra-nonprod-w2k1
• acct-hhs-cae-aws-elias-ddi-accenture-prod-d32s
• acct-hhs-medicaid-aws-elias-audits-deloitte-prod-d32s

Sandbox accounts:

Note Can be a team, project, or user based in product node.

• acct-dom-doit-aws-team-forest-sbox-59vaf
• acct-iwd-aws-jane-smith-sbox-2k2a
• acct-ipers-aws-project-team-sbox-qvsc

AWS Resource Pattern #

<aws-resource-abbreviation>-<agency>-aws-<product>-[<#description#>-]-<project/team>-<env>-<region-code>-<three-character-iteration>

• No division or root-id
• region-code and three-character-iteration mandatory
• aws-resource-abbreviation will be kept in a single source of truth lookup table.

Examples:

• snet-hhs-aws-elias-chatbot-accenture-test-use2-001
• ec2-dom-aws-management-infra-dev-use2-005

User access naming:

Note groups, roles, users, and permission sets do not require region, but do require shorthand access label as highlighted below. three-character-iteration not needed.

• group-hhs-aws-eden-deloitte-test-developer
• role-iowa-aws-terraform-github-nonprod-admin
• user-iowa-aws-ryan-bartusek-nonprod-read
• pset-hhs-aws-elias-accenture-nonprod-read

Hostname Pattern #

<agency><platform><environment><application><role><os><unique-id>

<AAA><PL><E><APP><RR><O><UUU>

Note Used across all new work environments. Based on 15 useable character Windows NetBIOS name.

AAA = agency Three-character abbreviation Examples: dot, dom, hhs

PL = platform Two characters Examples: az (Azure), aw (AWS), gc (Google Cloud)

E = environment One character Examples: p (prod), n (nonprod), d (dev), u (uat)

APP = application Three characters Free-form application identifier Examples: inf (infrastructure), eli (elias), vis (vision)

RR = role/service Two characters Examples: sq (sql), ap (app), fl (file), dc (domain controller)

O = os type One character Examples: w (Windows), l (Linux), a (appliance)

UUU = unique iterator Three characters Examples: 001, 01b

Examples:

• IWD AW P INF CA W 001 CA server
• IWD AW P INF EC W 001 Ent CA