The document discusses governance at scale when using AWS. It recommends implementing an AWS account hierarchy using AWS Organizations. It also recommends automating compliance checks and account provisioning. Additionally, it suggests tracking costs by application and environment using AWS Budgets and taking automated actions to avoid overspending budgets. The document provides examples of mapping permissions, users, and centralized access management across multiple AWS accounts for governance at scale.

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
October 2018
Governance @ Scale
Douglas Vanderpool
Principal, Global Advisory
AWS Professional Services

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Governance @ Amazon
• Six Perspectives
• Maintain Speed and Agility
• Governance is not a project
• Integral to the Cloud Team
BusinessCapabilityFocused
Business
Value Realization
People
Roles and Readiness
Governance
Prioritization and Control
TechnicalCapabilityFocused
Platform
Applications and Infrastructure
Security
Risk and Compliance
Operations
Hybrid and Dynamic

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Governance @ Scale
• Account Management
• Cost Management
• Compliance Automation

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Common Governance Challenges
Organizational
Support
Business Unit
Autonomy
Multi-Account
Strategy
Integration
Delegation
& Non-Technical
Interfaces

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Account Management
• Do
• Implement a hierarchy
• Use AWS Organizations
• Use a consolidated Admin AWS account
• Automate AWS account provisioning
• Implement “single sign-on” through federation

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Account Management

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cost Management
• Do
• Implement a hierarchy
• Use AWS Budgets or equivalent
• Start tracking spend by application and environment
• Start tracking spend against budgets
• Use alerts to inform stakeholders of potential budget overruns
(and potentially take actions to stop it)
• Automate actions to avoid budget overruns

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cost Management
$$$$ $$$$
$$$$ $$$$$$$$ $$$$
$$$$
$$$$
$$$$$
$$$$$
$$$$$$ $$$$ $$$$$ $$$ $
$$$$$
$$ $$$
$$$ $$$$ $$$
$$ $$$
$$ $$$
$$ $$$

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Compliance Management
• Do
• Implement a hierarchy
• Use Service Catalog and Landing Zones as a starting point
• Automate compliance at account/environment creation
• Continuously monitor for compliance
• Work towards automating actions when deviations are found

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Compliance Automation
101
1
1 1
6
= PCI = HIPAA
= IAM = Encryption
= Permissions= PII
1
1
1
1
1 1 1 1
1
2 21
2
1
2
1
1
2
1
2
2
1
2
1
3
3
1
2
1
3
1
3
1
1

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Permissions Mapping & Centralized Access
Management of the mapping of:
User->AD Groups->SSO Groups->AWS Roles->AWS Accounts Single point of access

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Full View

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Where do we go from here?
Start an AWS Professional Services Engagement
• Align – A complementary presentation/discussion to ensure the solution is a fit
• Launch – An engagement to create a proof of concept within the customers
environment with working processes and to scope a Scale offering
• Scale – Implementation of a fully functioning enterprise Governance@Scale
solution
Buy a tool that will give you a significant head start
• Cloudtamer.io – Our vendor partner cloudtamer has a team you can work directly
with to implement a solution
• Joint – AWS Professional Services also works with our vendor partner cloudtamer
to implement a solution
Build your own solution

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Reference Material
White Paper:
https://d1.awsstatic.com/whitepapers/Security/AWS_Governance_at_Scale.pdf
Governance@Scale Videos:
Video we showed during the session (6 min):
https://tinyurl.com/ycxosrln
Governance@Scale with cloudtamer.io & AWS Service Catalog video (6 min):
https://www.youtube.com/watch?v=ZbuihXq4c60
Governance@scale explained at 2018 Public Sector Summit (40 min video):
https://www.youtube.com/watch?v=F_tctEZ5plg
Implementing Governance@Scale at the 2018 Public Sector summit (50 min video):
https://www.youtube.com/watch?v=Z8BLRBayl2M

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank You!