Cloud providers like AWS consist of a wide range of really powerful services. Using AWS by yourself or only operating small tools you're not facing the problem of keeping track of the services, permissions, roles that are in your AWS account. But once you start sharing your account in e.g. your company or time goes on, it can become messy. At that point, it's easy to lose track of what's in the account. When it comes to security and managing all correct permissions to all resources is gets even harder to keep track of.
All too often you end up running multiple projects in the same AWS account or having your stages in the same account. There are several reasons why this is not a good option.
The AWS account looks like looks like the picture below. You have a bunch of applications and no idea where things are happening. Refactoring your infrastructure is like playing Russian roulette and hoping for nothing to break.
If you have a different account for each application or stage it offers you a way better separation. This keeps each application distinct from one another. But there is a major drawback here: you have to create an individual account for each project or stage and handle the payment options as well.
It would be much nicer if you had a single starting point, from where you can jump into the accounts.
The key element in this topic is the AWS Security Token Service API in short STS.
AWS Security Token Service (AWS STS) is a web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users that you authenticate (federated users).
That means you can access an account without having an IAM-User within that account.
You must be logged in with an IAM-User in both AWS accounts. For this, both users must have root privileges.
If you have created the sub-account via my Organisation, AWS has created the trusted entity for you. They named it OrganizationsAccountAccessRole and the role has admin privileges, so you can skip the next step.
Go to the IAM-Service and select Role and Create a new Role. The type of trusted entity must be Another AWS account. Then, enter the account id from where you want to have access e.g. your main account.