They are leveraging the Cross-Account access feature of the AWS Management console, which has been released early this year: https://aws.amazon.com/blogs/aws/new-cross-account-access-in...

> If you switch to ops-admin @ stage for example, and then go to the S3 page in the console,

> will you get a listing of all buckets in the stage AWS account even though your login

> session as calvin "belongs" to an other AWS account (segment)?

It should work like that, yes. Your privileges will be "scoped" to the role you are assuming in the "stage" account.

> I can see how having separate AWS accounts for dev/stage/prod makes things easier.

It's also a good way of maintaining agility when you have multiple teams working in parallel on different projects (ex: 1 team = 1 AWS account). Zalando has recently published a bunch of tools leveraging IAM to help manage multiple AWS accounts (ex: federated SSH access) : https://stups.io/