Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Deploy and Govern at Scale with AWS Control Tower

317 views

Published on

AWS Control Tower is a new AWS service for cloud administrators to set up and govern their secure, compliant, multi-account environments on AWS.

In this session, University of York will discuss their implementation of AWS Landing Zone. We’ll also explain how AWS Control Tower automates AWS Landing Zone creation with best-practice blueprints.

  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/qURD } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/qURD } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download doc Ebook here { https://soo.gd/qURD } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Be the first to like this

Deploy and Govern at Scale with AWS Control Tower

  1. 1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Deploy and Govern at Scale with AWS Control Tower Juan Manuel Gomez Solutions Architect – Public Sector UK AWS Dan Miller Infrastructure Engineer University of York
  2. 2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda What’s a landing zone and an AWS Landing Zone? Implementing a landing zone AWS Landing Zone AWS Control Tower University of York’s landing zone journey AWS Landing Zone or AWS Control Tower?
  3. 3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. What do customers want to do on AWS? Focus on what differentiates Ideation to instantiation Secure and compliant environment
  4. 4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. What do customers need to achieve? Meets the organization’s security and auditing requirements Ready to support highly available and scalable workloads Configurable to support evolving business requirements
  5. 5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. You need a “landing zone” H • A configured, secure, scalable, multi-account AWS environment based on AWS best practices • A starting point for net new development and experimentation • A starting point for migrating applications • An environment that allows for iteration and extension over time
  6. 6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Landing Zone vs. landing zone landing zone: • Secure pre-configured environment for your AWS presence • Scalable and flexible • Enables agility and innovation AWS Landing Zone: • Implementation of a landing zone based on multi-account strategy guidance AWS Control Tower: • AWS Service version of AWS Landing Zone
  7. 7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Security/resource boundary API limits/throttling Billing separation AWS account // best isolation boundary
  8. 8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account models One account 1,000s of accounts
  9. 9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Why one account isn’t enough Billing Many teams Security / compliance controls Business process Isolation
  10. 10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Guardrails NOT blockers Auditable Flexible Automated Scalable Self-service Goals
  11. 11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account security considerations Baseline Requirements Lock Enable Define Federate Establish Identify
  12. 12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. What accounts should I create? Security Shared Services Billing Dev ProdSandbox OtherPre-Prod Organizations Account Log Archive Network
  13. 13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Multi-account approach Developer Sandbox Dev Pre-Prod Team/Group Accounts Security Core Accounts AWS Organizations Shared Services Network Log Archive Prod Team Shared Services Network Path Developer Accounts Data Center Orgs: Account management Log Archive: Security logs Security: Security tools, AWS Config rules Shared Services: Directory, limit monitoring Network: AWS Direct Connect Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team Shared Services, Data lake
  14. 14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  15. 15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. The AWS Landing Zone solution An easy-to-deploy solution that automates the setup of new AWS multi-account environments Based on AWS best practices and recommendations Initial security and governance controls Baseline accounts and account vending machine Automated deployment
  16. 16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Landing Zone structure - basic AWS Organizations Shared Services Log Archive Security Organizations Account • Account Provisioning • Account Access (SSO) Shared Services Account • Active Directory • Log Analytics Log Archive • Security Logs Security Account • Audit / Break-glass Parameter store
  17. 17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account Vending Machine AWS Service Catalog Account Vending Machine (AWS Service Catalog) • Account creation factory • User Interface to create new accounts • Account baseline versioning • Launch constraints Creates/updates AWS account Apply account baseline stack sets Create network baseline Apply account security control policy Account Vending Machine AWS Organizations Security AW S Log Archive AW S Shared Services AW S AW S New AWS
  18. 18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  19. 19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Balancing the needs of builders and central cloud IT Builders: Stay agile Innovate with the speed and agility of AWS Cloud IT: Establish governance Govern at scale with central controls
  20. 20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Business agility and governance control Governance — Agility — Self-service access Experiment fast Respond quickly to change
  21. 21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. — Provision — Operate AWS Control Tower: Easiest way to set up and govern AWS at scale — Enable Business agility + governance control
  22. 22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Enable Enable for governance at scale
  23. 23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Enable governance Enable Set up an AWS landing zone Establish guardrails Automate compliant account provisioning Centralize identity and access Manage continuously
  24. 24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Set up an AWS landing zone • Landing zone - a preconfigured, secure, scalable, multi-account AWS environment based on best practice blueprints • Multi-account management using AWS Organizations • Identity and federated access management using AWS SSO • Centralized log archive using AWS CloudTrail and AWS Config • Cross-account audit access using AWS SSO and AWS IAM • End user account provisioning through AWS Service Catalog • Centralized monitoring and notifications using Amazon CloudWatch and Amazon SNS Master account AWS Control Tower AWS Organizations AWS Single Sign-On Stack sets AWS Service Catalog Log archive account Aggregate AWS CloudTrail and AWS Config logs Account baseline Audit account Security cross- account roles Account baseline Provisioned accounts Network baseline Account baseline Amazon CloudWatch aggregator Security notifications Core OU Custom OU AWS SSO directory
  25. 25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Multi-account architecture • Master account: designation of your existing account to create a new organization. Also your master payer account • Organization consists of 2 OUs with pre-configured accounts - o Core OU: AWS Control Tower-created accounts, i.e., Audit account and Log archive account o Custom OU: Your provisioned accounts Master account AWS Organizations Log archive account Audit account Provisioned accounts Core OU Custom OU
  26. 26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Centralize identity and access • AWS SSO provides default directory for identity • AWS SSO also enables federated access management across all accounts in your organization • Preconfigured groups (e.g., AWS Control Tower administrators, auditors, AWS Service Catalog end users) • Preconfigured permission sets (e.g., admin, read-only, write)
  27. 27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Establish guardrails • Guardrails are preconfigured governance rules for security, compliance, and operations • Expressed in plain English to provide abstraction over granular AWS policies • Preventive guardrails: prevent policy violations through enforcement; implemented using AWS CloudFormation and SCPs • Detective guardrails: detect policy violations and alert in the dashboard; implemented using AWS Config rules • Mandatory and strongly recommended guardrails for prescriptive guidance • Easy selection and enablement on organizational units Organizational units Accounts Enable Enable Output Output Output Organizational units Accounts Preventive guardrail Granular AWS policies SCP Detective/remediable guardrails Granular AWS policies AWS Config rules Always compliant Compliant Non- compliant
  28. 28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Guardrail examples Goal/category Example IAM security Require MFA for root user Data security Disallow public read access to Amazon S3 buckets Network security Disallow internet connection via Remote Desktop Protocol (RDP) Audit logs Enable AWS CloudTrail and AWS Config Monitoring Enable AWS CloudTrail integration with Amazon CloudWatch Encryption Ensure encryption of Amazon EBS volumes attached to Amazon EC2 instances Drift Disallow changes to AWS Config rules set up by AWS Control Tower
  29. 29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Automate compliant account provisioning • Built-in account factory provides a template to standardize account provisioning • Configurable network settings (e.g., subnets, IP addresses) • Automatic enforcement of account baselines and guardrails • Published to AWS Service Catalog Account factory Network baseline Network CIDR Network regions OU Account baseline AWS Service Catalog AWS Service Catalog product New AWS account Network baseline Account baseline Guardrails
  30. 30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. — Provision — Operate AWS Control Tower: Easiest way to set up and govern at scale — Enable Business agility + governance control
  31. 31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Self-service account provisioning in AWS Service Catalog Users can configure and provision AWS accounts and resources without needing full privileges to AWS services (e.g., Amazon EC2, Amazon RDS) 3 2 1
  32. 32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. — Provision — Operate AWS Control Tower: Easiest way to set up and govern at scale — Enable Business agility + governance control
  33. 33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Operate with agility + control Operate Dashboard Continuous visibility into your multi-account environment Act Take operational action on resources Audit Audit resource configurations, user access, and policy enforcement Monitor Monitor resources and workloads
  34. 34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Dashboard for oversight
  35. 35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Pricing and availability US East (N. Virginia), US East (Ohio), US West (Oregon), and EU (Ireland
  36. 36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Why use AWS Control Tower? Set up a best-practices AWS environment in a few clicks
  37. 37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Summary of key features
  38. 38. Dan Miller Multi-account AWS environments at scale Systems & Infrastructure Engineer University of York
  39. 39. Who we are… • University of York • Campus in North Yorkshire, United Kingdom • Research intensive University • Over 30 academic departments • Over 18,000 students from 140+ countries • Over 3,000 staff members
  40. 40. Key points to note • BitBucket and BitBucket Pipelines are used to store & deploy code • CloudFormation written in YAML for core infrastructure • SAM (& CloudFormation) / CDK for application infrastructure • Hybrid approach with some data still stored on campus servers* * for now
  41. 41. Our old, monolithic structure
  42. 42. Why this didn’t work for us… • A single development account is a hindrance • A desire to centralise our AWS offering within IT Services • Creating new accounts didn’t scale well • Blast radius was too wide
  43. 43. Landing Zone Benefits • Quick and easy way to create multiple accounts • Achieve a desired state for each account upon provision • Easy management of accounts through Organizational Units • Configuration flexibility for ops teams • Security and auditing baseline
  44. 44. Organizational Units • Sandbox • IT Services • Departmental • Research • Quarantine
  45. 45. Sandbox Infrastructure • Allows a user access to their own isolated environment • Promotes experimentation, adoption and upskill • Fully automated provisioning process (<5 minutes) • Prevents using other accounts for testing • Centralised billing & cost monitoring
  46. 46. Authentication Infrastructure • Shibboleth Single Sign-On • Allows existing University credentials to be used • Duo Multi-Factor Authentication (2FA) • SAML based authentication • Configured via Identity Providers under IAM • Entirely automated provisioning as a baseline
  47. 47. Authentication Infrastructure (Login Screen)
  48. 48. Provisioning Infrastructure • Service Catalog to create accounts • Leverage extensive AWS APIs to streamline the process • Call back to internal authentication APIs to make the account known • Sends account welcome emails through Simple Email Service
  49. 49. • Account Type • Region • Username • Shibboleth Authentication Stack • VPC Type • Workorder (for internal billing) Provisioning Infrastructure
  50. 50. Campus Connectivity • Uses the AWS Transit Gateway service • Direct AWS VPN connectivity to a “shared services” account • Allows us to share a single VPN Gateway to multiple accounts • Reduces cost and allows easier traffic monitoring
  51. 51. • GuardRails to monitor compliance in the environment • AWS Config • Old pricing model was too costly with multiple accounts • “Pay as you go” AWS Config pricing reduces costs • Cloud Custodian • Free, open source & uses AWS APIs Compliance
  52. 52. Internal Tooling • Serverless Ruby application • Lambda, DynamoDB, ElastiCache, ACM, Cognito & ELB • Background lambdas for task processing • Not designed to replace AWS functionality, but assist
  53. 53. Authentication Management Overview * illustrative data
  54. 54. * illustrative data AWS Account Management Overview
  55. 55. * illustrative data Billing & Cost Management Overview
  56. 56. * illustrative data Compliance Management Overview
  57. 57. * illustrative data Compliance Management Rule Hits
  58. 58. * illustrative data Compliance Management non-compliant services
  59. 59. * illustrative data Compliance Management raw service view
  60. 60. The future for York • Continue innovating with serverless architecture • Further expand our AWS offering within the University • Lessen the hybrid restrictions we currently have • Increase automation around accounts & deployments
  61. 61. Thank you! dan.miller@york.ac.uk @danmilleruk
  62. 62. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  63. 63. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Landing Zone vs. AWS Control Tower • AWS Cloudformation deployment • Fully customizable/owned by customer • Most regions supported • Complete flexibility on account structure • Complex requiring significant expertise • Managed service by AWS • Fixed blueprints and guardrails • Four regions at launch • Two non-configurable core accounts, no SS, no Amazon VPC in core • Self service guided deployment configurable through GUI
  64. 64. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Landing Zone to AWS Control Tower? Is there a migration path from AWS Landing Zone to AWS Control Tower? Yes, in the near future, you will be able to migrate your existing accounts created with the AWS Landing Zone solution to AWS Control Tower. The migration path will occur in several phases to ensure compatibility between Control Tower and your AWS Landing Zone solution starting with ability to deploy Control Tower to an existing Organizations, followed by enabling custom guardrails and custom blueprints for Control Tower.
  65. 65. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Which one should I choose? • Review AWS Control Tower and its capabilities. Does it meet what you need? CT • Are you willing to start with fresh new environment? CT • Are you willing to grow with the service? CT • Do you have a team that can take on the complexity of managing the AWS Landing Zone Solution? If Not, CT • Do you have an existing landing zone that meets your current needs and exceeds CT’s feature set? Evaluate CT, but may need to wait • Do you need full customization and full control over every aspect of the landing zone? Use ALZ
  66. 66. Thank you! © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Juan Manuel Gomez Jgrcmz@amazon.co.uk Dan Miller dan.miller@york.ac.uk

×