Control Tower And AWS Landing Zone

Easiest way to set up and govern a new, secure, multi-account AWS environment. It establishes a landing zone that is based on best-practices blueprints and enables governance using guardrails. Witch is the right service to use, some pros and cons. What are my security, governance, and baseline, how many account should I create? Some best practices on how to design and implement the Landing Zone.

Transcript

1. @zamirajaupaj About me Solution Architect AWS User Group Organizer 5 years using AWS @zamirajaupaj
2. @zamirajaupaj Agenda •Control Tower •AWS Landing Zone
3. @zamirajaupaj How I build and implement Landing Zone? • Additional product and services, there there's plenty of design decisions: • How many accounts should I create? • which would my network topology look like? • How many services don't launch? • what are my security, governance and baselines? • And how do I deploy that in a way?
4. @zamirajaupaj HOW WE WORK Scalability Security Hight Availability Speed and easy way
5. @zamirajaupaj What Control Tower do? • Quickly setup and configure a new AWS environment • Automate ongoing policy management
6. @zamirajaupaj Setup of an AWS landing zone Centralize identity and Access Establish guardrails for governance Automate compliant account provisioning Control Tower
7. @zamirajaupaj What AWS Landing Zone do? • Setup, in a secure, scalable, multi-account AWS environment based on AWS best practices • A starting point for net new development and experimentation • A starting point for customers’ application migration journey • An environment that allows for iteration and extension over time
8. @zamirajaupaj Master Account VENDET ACCOUNT Aws Organization Core OU Custom OU SSO Group Users Permissions default Custom Both Guardrails Service Catalog Setup Landing Zone Disallow public read access to log archive Enable CloudTrail in all available regions Disallow configuration changes to AWS Config Enable encryption for EBS volumes attached to EC2 instances Disallow access to IAM users without MFA Enable encryption for EBS volumes attached to EC2 instances Enable integrity validation for CloudTrail log file Guardrails
9. @zamirajaupaj Centralize identity and Access Directory AWS Accounts Application Dashboard Users Groups Account Permissions Custom Applications Andrea Chiara Alexander Tomm Angelo Dev Operation Custom Group Read Access Write Access Admin Dev Account Pre-prod Account Prod Account SSO NO IAM USER
10. @zamirajaupaj SSO ReadOnly EC2 FullAccessS3 Assign Group to account and Permission set Angelo Paolo Add Users ang Group in SSO User sign into the user portal access AWS Accounts Create Permission Set 1 2 4 3 Master Account Prod Account Custom Account Dev Account Prod Account AI Account Log Account
11. @zamirajaupaj Master Account Control Tower Aws Organization Core OU Custom OU Shared Account Audit Account Log Account SSO Group Users Permissions default Custom Both Guardrails Service Catalog Setup Landing Zone Account Baseline SecurityCross- Account Roles Account Baseline S3 Bucket • New Account from AWS Service Catalog) • Account creation UI • Account Baseline Versioning • Launch Constraints • Creates/Updates AWS Account • Apply Account Baseline stack sets • Create Network Baseline • Apply account Security Control Policy
12. @zamirajaupaj AWS CloudTrail • Central Amazon S3 bucket and local AWS CloudWatch Logs AWS Config • Config Rules (EBS/RDS/S3 encryption, IAM password policy, root MFA, S3 public read/write permissions) IAM Password Policy • User password change, password complexity/reuse/age/minimum length Amazon VPC • Delete default VPC, (optional) create VPC Account baseline
13. @zamirajaupaj More … Lock AWS Account Credential Management (“RootAccount”) Enable AWS CloudTrail Define Map Enterprise Roles and Permissions Federate Use Identity Solutions Establish InfoSec Cross Account Roles Identify Actions and Conditions to Enforce Governance Baseline Requirements
14. @zamirajaupaj Shared Account Log Account Audit Account Shared Account CloudTrail All Region Amazon Config CloudWatch Alarms S3 Bucket IAM Role/Policy CloudTrail All Region Amazon Config CloudWatch Alarms IAM Role/Policy SNS Topic Lambda Function Baseline Config Baseline Config
15. @zamirajaupaj Shared Service Account! • Services and tooling and our common to our organization • Active Directory • Inactive Instances • EBS volumes • Golden AMI • Simple DNS • Disaster Recovery Purpose • Shared service network
16. @zamirajaupaj Account A Account B Account Z CloudWatch Subscription Data Stream Firehose Transformation Storage in s3 log Account ES What About Logs?
17. @zamirajaupaj Master Account Control Tower Aws Organization Core OU Custom OU Shared Account Audit Account Log Account Ci-CD Account Dev Account Pre-prod Account Prod Account Custom Account SSO Group Users Permissions default Custom Both Guardrails Service Catalog Setup Landing Zone Account Baseline SecurityCross- Account Roles Account Baseline S3 Bucket
18. @zamirajaupaj Master Account Control Tower Aws Organization Core OU Custom OU Shared Account Audit Account Log Account Ci-CD Account Dev Account Pre-prod Account Prod Account Custom Account SSO Group Users Permissions default Custom Both Guardrails Service Catalog Setup Landing Zone Account Baseline SecurityCross- Account Roles Account Baseline S3 Bucket AWS CodePipeline Account Baseline Account Baseline Account Baseline Account Baseline S3 Bucket SecurityCross- Account Roles
19. @zamirajaupaj Custom Account Dev/PreProd/Prod Ci-CD Account Dev Account Pre-prod Account Prod Account Custom Account Deploy Test/Build Source Feedback Canary Blue/Green Feedback Blue Green Blue Green Temporary Dev Team
20. @zamirajaupaj Benefits of the AWS Automated Landing Zone Automated Scalable Self-Service Guardrails NOT Blockers Auditable Flexible
21. @zamirajaupaj Recommendation SSM NO Port 22 NO Public IP No Key Pair EC2 Infrastructure Secret Manager CloudWatch CloudTrail Config HTTPS Protocol Encryption KMS NO IAM USER NO Public Bucket NO “*” per le policy
22. @zamirajaupaj THANK YOU