Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AWS Control Tower (JCON)

AWS Control Tower (JCON)

AWS Control Tower – AWS Cloud-Umgebungen einfach und sicher verwalten
AWS Control Tower ist die einfachste Methode zur Einrichtung und Kontrolle einer neuen, sicheren AWS-Umgebung. Der Vortrag geht auf den Sinn und Zweck einer Multi-Account Strategie ein und zeigt Zusammenhänge des neuen AWS Control Tower Service mit der bisherigen Landing Zone Solution und AWS Organizations auf. Teilnehmer haben am Ende des Vortrags das nötige Rüstzeug, um eine Well-Architected-Umgebung zu erstellen, in der sie Sicherheits-, Betriebs- und Compliance-Regeln zur Steuerung ihrer AWS-Workloads verwalten können.
https://aws.amazon.com/de/controltower/

A53b603265b6c5bf492b18a182cb15d0?s=128

Dennis Kieselhorst

October 28, 2020
Tweet

More Decks by Dennis Kieselhorst

Other Decks in Technology

Transcript

  1. © 2020, Amazon Web Services, Inc. or its Affiliates. Dennis

    Kieselhorst Sr. Solutions Architect AWS Control Tower AWS Cloud-Umgebungen einfach und sicher verwalten
  2. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. • Motivation - Why a multi-account strategy/ landing zone? • AWS Control Tower value proposition • A landing zone, the AWS Landing Zone solution and AWS Control Tower • AWS Control Tower – Enable, Provision, Operate • Demo • Q&A Agenda
  3. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. We thought we did this…
  4. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. But…
  5. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Why one AWS account isn’t enough Billing Many teams Security / compliance controls Business process Isolation
  6. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Isolation with IAM and VPC in one account? “Gray” boundaries Complicated and messy over time Difficult to track resources People stepping on each other AWS Account
  7. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Customers are faced with… Many design decisions The need to configure multiple accounts & services Establishing a security baseline & governance
  8. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Balancing the needs of builders and central cloud IT Builders: Stay agile Innovate with the speed and agility of AWS Cloud IT: Establish governance Govern at scale with central controls
  9. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. More innovation, greater agility, with control Experiment Be productive Empower distributed teams Self-service access Respond quickly to change Agility Enable Provision Operate Secure & Compliant Operations & Spend Management Governance Don’t choose between Agility or Control You need and want both
  10. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Provision Operate AWS management and governance services Enable BUSINESS AGILITY + GOVERNANCE CONTROL AWS Control Tower AWS Organizations AWS Budgets AWS License Manager AWS Well- Architected Tool AWS OpsWorks AWS CloudFormation AWS Service Catalog AWS Marketplace AWS Cost Explorer Amazon CloudWatch AWS Cost and Usage Report AWS CloudTrail AWS Systems Manager AWS Config
  11. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. — Provision — Operate AWS Control Tower: Easiest way to set up and govern AWS at scale — Enable Business agility + governance control
  12. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Why use AWS Control Tower? Set up a best-practices AWS environment in a few clicks
  13. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. What is a “landing zone” • A configured, secure, scalable, multi-account (multiple resource containers) AWS environment based on AWS best practices • A starting point for net new development and experimentation • A starting point for migrating applications • An environment that allows for iteration and extension over time H
  14. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. landing zone, AWS Landing Zone, AWS Control Tower landing zone: • Secure pre-configured environment for your AWS presence • Scalable and flexible • Enables agility and innovation AWS Landing Zone Solution: • Implementation of a landing zone based on multi-account strategy guidance • Customers get code that they will need to manage & maintain • Solution will no longer receive updates by EOY 2020 AWS Control Tower: • AWS Managed Service version of AWS Landing Zone H
  15. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Landing Zones – how we got here 2006-2020+ 2018 Q4 2018 Q2 2019 2020+ Customer Hand Crafted Tried and True – not simple AWS Landing Zone V1 AWS Landing Zone V2.x and AWS Control Tower Announced AWS Control Tower Launched ALZ Reference Architecture for AWS Control Tower
  16. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Enable governance Enable Set up an AWS landing zone Establish guardrails Automate compliant account provisioning Centralize identity and access Manage continuously
  17. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Set up an AWS landing zone • Landing zone - a preconfigured, secure, scalable, multi-account AWS environment based on best practice blueprints • Multi-account management using AWS Organizations • Identity and federated access management using AWS SSO • Centralized log archive using AWS CloudTrail and AWS Config • Cross-account audit access using AWS SSO and AWS IAM • End user account provisioning through AWS Service Catalog • Centralized monitoring and notifications using Amazon CloudWatch and Amazon SNS Master account AWS Control Tower AWS Organizations AWS Single Sign-On Stack sets AWS Service Catalog Log archive account Aggregate AWS CloudTrail and AWS Config logs Account baseline Audit account Security cross- account roles Account baseline Provisioned accounts Network baseline Account baseline Amazon CloudWatch aggregator Security notifications Core OU Custom OU AWS SSO directory
  18. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Multi-account architecture • Master account: designation of your existing account to create a new organization. Also your master payer account • Organization consists of 2 OUs with pre-configured accounts - o Core OU: AWS Control Tower-created accounts, i.e., Audit account and Log archive account o Custom OU: Your provisioned accounts Master account AWS Organizations Log archive account Audit account Provisioned accounts Core OU Custom OU
  19. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Demo
  20. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Centralize identity and access • AWS SSO provides default directory for identity • AWS SSO also enables federated access management across all accounts in your organization • Preconfigured groups (e.g., AWS Control Tower administrators, auditors, AWS Service Catalog end users) • Preconfigured permission sets (e.g., admin, read-only, write)
  21. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Establish guardrails • Guardrails are preconfigured governance rules for security, compliance, and operations • Expressed in plain English to provide abstraction over granular AWS policies • Preventive guardrails: prevent policy violations through enforcement; implemented using AWS CloudFormation and SCPs • Detective guardrails: detect policy violations and alert in the dashboard; implemented using AWS Config rules • Mandatory and strongly recommended guardrails for prescriptive guidance • Easy selection and enablement on organizational units Organizational units Accounts Enable Enable Output Output Output Organizational units Accounts Preventive guardrail Granular AWS policies SCP Detective/remediable guardrails Granular AWS policies AWS Config rules Always compliant Compliant Non- compliant
  22. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Service Control Policies (SCPs) • Enables you to control which AWS service APIs are accessible - Define the list of APIs that are allowed – whitelisting - Define the list of APIs that must be blocked – blacklisting • SCPs are: Invisible to all users in the child account, including root Applied to all users in the child account, including root • Permission: intersection between the SCP and IAM permissions IAM policy simulator is SCP aware
  23. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Disable Service APIs you Won’t be Using { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": ”<Insert unwanted service prefix here>:*", "Resource": "*" } ] } NotAction (Optional) List the AWS actions exempt from the SCP. Used in place of the Action element. Resource List the AWS resources the SCP applies to. Condition (Optional) Specify conditions for when the statement is in effect.
  24. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Organizational Units • Grouping of AWS Accounts • Service Control Polices (SCP) to the groups • Use permission grouping (NOT corporate structure) How likely is the group to need a set of similar policies?
  25. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Guardrail examples Goal/category Example IAM security Require MFA for root user Data security Disallow public read access to Amazon S3 buckets Network security Disallow internet connection via Remote Desktop Protocol (RDP) Audit logs Enable AWS CloudTrail and AWS Config Monitoring Enable AWS CloudTrail integration with Amazon CloudWatch Encryption Ensure encryption of Amazon EBS volumes attached to Amazon EC2 instances Drift Disallow changes to AWS Config rules set up by AWS Control Tower
  26. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Automate compliant account provisioning • Built-in account factory provides a template to standardize account provisioning • Configurable network settings (e.g., subnets, IP addresses) • Automatic enforcement of account baselines and guardrails • Published to AWS Service Catalog Account factory Network baseline Network CIDR Network regions OU Account baseline AWS Service Catalog AWS Service Catalog product New AWS account Network baseline Account baseline Guardrails
  27. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. — Provision — Operate Automate secure self-service provisioning at scale — Enable Business agility and governance control
  28. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. AWS CloudFormation concepts Template JSON or YAML Change set Stack
  29. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. AWS CloudFormation StackSets Template StackSets Stack Stack Stack Stack
  30. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Enable self-service with AWS Service Catalog 2 1
  31. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Automate governance at scale 1 2 3
  32. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. End Users Organizations Curation Compliance Standardization Agility Self-service Time to market Speed Security Service catalogs enable organizations to deploy and manage infrastructure and applications that reflect the organization’s security and operational policies Benefits of governance at scale
  33. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Enabling self-service via AWS & ITSM Tools Users browse and request AWS services Administrators procure, publish, and govern AWS services Operators monitor and manage AWS services AWS Marketplace AWS Service Catalog AWS Cloud Amazon EC2 Amazon Simple Storage Service Amazon WorkSpaces Amazon SageMaker Amazon RDS Amazon EMR AWS IoT Core 1 2 3 Jira Service Desk
  34. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Starter AWS multi-account framework AWS Cloud AWS Organizations Foundational Organizational Units (OUs) Infrastructure Security Δ Shared Services Δ Network Additional OUs
  35. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Starter AWS multi-account framework AWS Cloud AWS Organizations Foundational Organizational Units (OUs) Infrastructure Security Δ Shared Services Δ Network Δ Log Archive Δ Security Tooling Additional OUs Control Tower deploys these automatically
  36. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. AWS multi-account framework AWS Cloud AWS Organizations Master Foundational Organizational Units (OUs) Infrastructure Security Δ Shared Services Δ Network Additional OUs
  37. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. How to customize AWS CT today? https://aws.amazon.com/solutions/customizations-for-aws-control-tower/
  38. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Lifecycle Events • CreateManagedAccount • UpdateManagedAccount • EnableGuardrail • DisableGuardrail • SetupLandingZone • UpdateLandingZone • RegisterOrganizationalUnit • DeregisterOrganizationalUnit
  39. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. — Provision — Operate AWS Control Tower: Easiest way to set up and govern at scale — Enable Business agility + governance control
  40. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Operate with agility + control Operate Dashboard Continuous visibility into your multi-account environment Act Take operational action on resources Audit Audit resource configurations, user access, and policy enforcement Monitor Monitor resources and workloads
  41. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Demo
  42. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Upcoming Features Schedule a roadmap session (under NDA)
  43. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. AWS services that enable agility + governance AWS Control Tower AWS Organizations AWS Service Catalog AWS Well-Architected Tool AWS Budgets AWS License Manager AWS Marketplace (Private Marketplace) AWS CloudTrail AWS Config AWS Security Hub Amazon CloudWatch
  44. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. AWS Control Tower capabilities • Framework for creating and baselining a multi-account environment using AWS Organizations • Initial multi-account structure including security, audit, & shared service requirements • An account vending machine that enables automated deployment of additional accounts with a set of managed and monitored security baselines • A management console that shows compliance status of accounts • The ability to apply AWS best practice guardrails and Blueprints to accounts at account creation • The ability to detect and report on any drift/changes that have occurred that deviate from initial configuration options • User account access managed through AWS SSO federation • Integration options with other 3rd party SSO providers (PING/OKTA, Azure AD – native support) • Cross-account roles enable centralized management • Multiple accounts enable separation of duties • Initial account security and AWS Config rules baseline • Network baseline Account Management Identity & Access Management Security & Governance
  45. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Summary of key features
  46. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Pricing and availability US East (N. Virginia), US East (Ohio), US West (Oregon), and EU (Ireland
  47. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. How do I get started? AWS Control Tower labs: https://controltower.aws-management.tools AWS Control Tower blogs: • Guardrail Mitigation: https://tinyurl.com/y56dsalz • Self-Service Provisioning: https://tinyurl.com/y3fk3fpk • Migrating workloads with AWS Control Tower and CloudEndure: https://tinyurl.com/CTMigrate Getting started (re:Inforce 2019): https://tinyurl.com/y2gtzf9c How-to videos (Management & Governance): https://tinyurl.com/y3yeohkm
  48. © 2020, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. Thank you! Dennis Kieselhorst, Sr. Solutions Architect dkieselh@amazon.de Feedback form: https://amzn.to/35cfKWx