When migrating lots of applications to the AWS Cloud, it’s important to architect cloud environments that are efficient, secure, and compliant. Landing zones are a prescriptive set of instructions for deploying an AWS-recommended foundation of interrelated AWS accounts, networks, and core services for your initial AWS application environments. In this session, we will review the benefits and best practices for developing landing zones as well as how to incorporate them into your migration process.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
Landing Zones
Creati ng a F ound ation for Your AWS Mi grati ons
E n t e r p r i s e T r a c k E N T 3 1 5
N o v e m b e r 2 7 , 2 0 1 7
J o e H e a l y – A W S P r i n c i p a l C o n s u l t a n t
C a r l M a s s a – M i n i s t r y o f J u s t i c e U K

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Session Agenda
1
Definition of the Problem
2
Landing Zone Concept
3
Components of a Landing Zone
4
Customer Story – Ministry of Justice UK

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is a Landing Zone?
H
• AWS best practices
• AWS account structure
• Patterns based
• Standards defined
• Adaptable foundation
• Governance guardrails
• Automation driven
• Versioned infrastructure

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Landing Zone – Account Structure
Outcomes
• Billing visibility
• Environment
isolation
• Small blast radius
• Centralized services
• Centralized logs

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Landing Zone – Identity Management

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Landing Zone – VPC Design
Multi-AZ
Public vs.
Private Ingress/
Egress
points

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Landing Zone – Networking

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Landing Zone – Continuous Compliance
Event
Driven
Deployment
Pipeline
Holistic
Inspection

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Build Buy
VS.
Landing Zone – Implementation Paths

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Landing Zone – Customer Story

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Landing Zones:
Flexible
Foundations

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
UK GOVT. BUDGET WILL BE CUT BY 15% BY 2020
Ministry of Justice (MoJ) digital
services are essential to
protecting and advancing the
principles of justice in the UK
MoJ Digital uses open standards
and open-source technologies
to maximize cross-
organization re-use
Digital transformation pace has
left no time for re-inventing
how we ”keep the lights on”

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ALL OFFICIAL SERVICES IN CLOUD BY 2020
Almost 100 cloud-
native digital
services born in
the cloud
Transformation
to achieve
synergy
Over 1,000 existing monolith workloads with history of
transformations undercover, “big bang” release schedule, and “gated”
culture, which is no longer fit for purpose
Platform Security OperationsGovernance Spend Culture
A Landing Zone is not just a platform
Scaling up best
practices

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
LANDING ZONES ARE ENABLING US TO
ACHIEVE OUR STRATEGIC GOALS
Platform Security OperationsGovernance Spend Culture
A Landing Zone is more than a place to deploy application code
Multiple AWS
accounts and VPCs
with network
connectivity back to
legacy data centers
Evolving,
versioned,
configuration
available as re-
usable patterns
Cost visibility,
predictability,
and reporting
for every digital
service
Usual conversation scope
Information
assurance
baseline defined,
continuously
monitored and
enforced
through
automation
Self-service
culture,
migration skills
acquired are
easily deployed
to next project
Resiliency for
minimized on-
call duties, and
integrated
operations
across the
organization

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CONTINUOUS ASSURANCE
Framework to evaluate the security of
cloud services, and to ensure the approach
used is secure enough to handle the data
Non-negotiable baseline enabling a
consistent, quick start for new agencies
Re-usable templates are provided to
teams for common architectures, using the
most common services
Security OperationsCulture
Landing Zones are an essential part of improving our security posture
MoJ risks register and platforms
data classification
NCSC cloud
security principles
CIS
Frame-
work

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Central Team
Service Manager
Infrastructure Architect
WebOps & Reliability
Engineers
BUILT BY BUILDERS, FOR BUILDERS
Internal skills develop as migrations are completed and repeated
Different perspectives and disciplines working together as a blended team
OperationsCulture
Landing Zones empower product teams to take ownership
+
Shared
between
multiple
agency
teams
Transformation / Migration Lead
Transformation / Migration Lead
Product Owner
Delivery Manager
Developers
Security Operations
Information Assurance
Agency Migration Team(s)
Transformation/Migration Lead
Programme Manager
Delivery Manager
Developers
Information Assurance
Service Manager
Technical Architect
QA Testers
DBAs
WebOps & Reliability
Engineers

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
SLAs ARE PROPORTIONATE TO LEVEL OF
STANDARDIZATION
Operations
Landing Zones provide a Service Level framework
Variability from stable/foundational to specific to every application/platform
Infrequent changes, all configuration
is versioned and can be ‘assured’
Occasional changes, can be centrally
assured based on data classification
May change
frequently
Frequent change
Administrative
Identity &
Access
Network
Configuration
Patterns
Shared Data &
Services
Platform/
Application Data
Application
Infrastructure
Application Code
Central Team
Local Platform Team Application Team
Lean
WebOps
Team
Service Catalog Coverage
Baseline level of automation &
standardization to ensure efficiency
and continuous assurance
Desired level of automation
for existing applications
(entry-level managed services)
Default level of
automation for
cloud-native
services
Born in the cloud applications
Existing core business applications

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
LEGAL AID AGENCY IS PIONEERING THE
“NEW NORMAL”
Seeking change
the existing infrastructure contract is expiring in
October 2018
Isolatedfrom broader UK MoJ
organization which minimizes the risk – sometimes
limitation can be a benefit too!
Business need -
platform transformation will allow greater cost
optimization, agility, increased resiliency (DR was one of
main business risks) and rationalization of technology
debt (moving off SPARC)
Existing skillset was
there as applications were developed by internal teams
and only infrastructure was outsourced
2,000,000 people
in England and Wales provided with criminal legal
aid and advice annually

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
“DO AND REFLECT” APPROACH HELPED TO BUILD
CONFIDENCE AND MOVE THROUGH
UNCERTAINTY
Initial effort estimation (30+ months)
1. Sort and practice
Components and concerns
were grouped into patterns
with most critical ones
tested as a Proof of Concept
(with AWS Envision
Engineering Center)
2. Re-usable approach
As PoC were deployed to
AWS, local team was able
quickly scale PoC results and
do spikes covering broader
platform scope
Current migration estimation (9-12 months)
(thanks to 2.)
First pattern cutover (3 months)
(thanks to 4 & 5.)
3. Sprint workshop
LAA, partner and AWS
teams working together,
sharing their findings and
planning the migration
4. Automated testing (in
progress)
Accelerating application
transformation process,
enabling quicker release
process
5. Landing Zone
Starting small and simple,
iterating on Landing Zone
design, addressing all parts
in parallel

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
“REVOLVING DOOR” DECISION APPROACH AND
RE-USABLE BITS ALLOW US TO MOVE QUICKLY
WITH THE LANDING ZONES
Platform Security OperationsGovernance Spend Culture
Landing Zones force us to constantly iterative and improve
4 accounts, 2 VPC
patterns, VPN and
cross-account IAM
roles management
CI/CD pipeline for
the first application
pattern
10 tags sitting
inside
templates (no
way to miss
them)
CIS Framework
baseline + UK
Official + NSCS
recommendations
Infrastructure
as Code (IaC)
CI/CD pipeline
Centralized
logging and
monitoring
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
LANDING ZONE CAN BE EXTENDED OR RE -USED
AS PATTERN BY OTHER AGENCIES
Anticipated to be scaled horizontally
(multiple accounts)
Anticipated to be scaled vertically (more
agencies sharing processes and tools)

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
OperationsCultureSecuritySpendGovernancePlatform
WE ANTICIPATE THE CURRENT TARGET VISION
WILL BE REFINED THROUGH EXPERIENCE…
Landing Zones get better as we complete each migration
> 100 accounts,
integrated SSO &
IAM roles
management,
scalable on-premises
connectivity
Service catalog as
a single source of
truth for
infrastructure and
application
lifecycle needs &
patterns
Cost prediction
and optimization
based on
automation
Continuous
assurance
framework
implemented
and updated as
part of IaaC
Teams
architecting for
cost efficiency
and resiliency,
re-using
patterns
Proactive
resilience and
recovery,
integrated
teams

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
YET THE FRAMEWORK WILL STAY THE SAME
A single set of
directive, preventive,
detective, and
responsive controls
across the landing
zone
Payer account
Legal Aid Agency (Agency Pattern)
Resources &
Environments
Resources &
Environments
Resources &
Environments
Shared services account (s)
Network Access
Resources &
Environments
Resources &
Environments
Resources &
Environments
Network Access Network Access Network Access Network Access Network Access
Shared logging account (s)
Shared audit account (s)
Shared user federation account (TBD)
Partner accounts
Current scope
Final outlook will be defined by MoJ-wide operations model

29. OUR PLANS TO MOVE FORWARD
Application and infrastructure
patterns reiteration sourced
by next agencies coming on
the platform
Cross-pollinating new ways of
working by rotating team
membership and mentoring
Processes refinement based
on practical experience of
operation in the cloud
Next iterations for central
team functional scope,
extending financial team
involvement
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
LEARNINGS SO FAR...
- Move quickly
- Have executive buy-in
- Use revolving door decisions, ensure all stakeholders are participating
- Keep on eye on available skills vs. managed services choices
- Leverage AWS Support

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!