The document discusses operational excellence for identity and access management using an AWS Landing Zone solution, which automates the setup of new AWS multi-account environments based on best practices and recommendations and provides initial security, governance, and shared service controls. It describes the components of the AWS Landing Zone including AWS Organizations, AWS Config, and IAM and how labs can be used to demonstrate creating guardrails, applying governance, and handling drift across accounts to meet security and operational goals.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Operational Excellence for Identity
& Access Management
Sean MacDonald
Security Specialist TAM
AWS
S E C 3 3 4
Johnny Hanley
Enterprise Support Lead
AWS

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
• Once upon a time
• The map
• Today’s chapter
• The adventure begins
• Happily ever after

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Once upon a time …
Tell the story
Agility and short-term development cycles
Organizational governance ensuring proper security
Working in tandem
Lessons learned (why this is necessary)
Cloud enables the ability to iterate quickly
Cloud enables the ability to automate governance during the development cycle
Path forward (what we are proposing)
Guardrails, not gates
Developers + Security = BFFs

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The map
Operational excellence
Perform operations as code
Anticipate failure
Learn from all operational failures
Security pillar best practices
Implement a strong identity foundation
Automate security best practices
Processes for event, incident, and problem management
Enable traceability
https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Requirements
1. Your own device for console access
2. An AWS account that you are able to use for testing, that is not used
for production or other purposes
3. Download the Lab Guide at https://bit.ly/2DxLXx6
https://s3.amazonaws.com/sec334labs/sec334labs/SEC334+Labs.pdf
4. Download 3 files from links in Lab Guide
5. Raise your hand if you need assistance

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Today’s chapter
The main services in today’s story
AWS Organizations
AWS Config
AWS Identity and Access Management (IAM)
AWS Landing Zone (our hero)
Plot twists (decisions you need to make)
Architectural
Operational

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The AWS Landing Zone solution
An easy-to-deploy solution that automates the setup
of new AWS multi-account environments
Based on AWS best
practices and
recommendations
Initial security and
governance controls
Baseline accounts
and account
vending machine
Automated
deployment

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Landing Zone structure - basic
AWS Organizations
Shared Services Log Archive Security
Organizations Account
• Account Provisioning
• Account Access (SSO)
Shared Services Account
• Active Directory
• Log Analytics
Log Archive
• Security Logs
Security Account
• Audit / Break-glass
Parameter
store

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
AWS Organizations
No connection to DC
Service Control Policies
Consolidated billing
Minimal resources
Limited access
Data Center

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Security
Core Accounts
AWS Organizations
Log Archive
Optional data center
connectivity
Security tools and audit
Cross-account read/write
Limited access
Data Center

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Security
Core Accounts
AWS Organizations
Network
Log Archive
Managed by network team
Networking services
AWS Direct Connect
Limited access
Data Center

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive
Connected to DC
DNS
LDAP/Active Directory
Shared Services VPC
Deployment tools
Golden AMI
Pipeline
Scanning infrastructure
Inactive instances
Improper tags
Data Center

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive
No connection to DC
Innovation space
Fixed spending limit
Autonomous
Experimentation
Developer Accounts Data Center

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive
Based on level of needed
isolation
Match your development
lifecycle
Developer Accounts Data Center

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Dev
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive
Develop and iterate quickly
Collaboration space
Stage of SDLC
Developer Accounts Data Center

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Dev Pre-Prod
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive
Connected to DC
Production-like
Staging
QA
Automated deployments
Developer Accounts Data Center

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Dev Pre-Prod
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive Prod
Connected to DC
Production applications
Promoted from Pre-Prod
Limited access
Developer Accounts Data Center

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Dev Pre-Prod
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive Prod
Team Shared
Services
Grows organically
Shared to the BU/team
Product-specific common
services
Data lake
Common tooling
Common services
Developer Accounts Data Center

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Dev Pre-Prod
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive Prod
Team Shared
Services
Network Path
Developer Accounts Data Center
Orgs: Account management
Log Archive: Security logs
Security: Security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: Direct Connect
Dev Sandbox: Experiments, Learning
Dev: Development
Pre-Prod: Staging
Prod: Production
Team SS: Team Shared Services, Data Lake

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What you get with the AWS Landing Zone
• Framework for creating and baselining a multi-account environment
• Initial multi-account structure including security, audit, & shared service requirements
• An account vending machine that enables automated deployment of additional
accounts with a set of security baselines
Account Management
• User account access managed through AWS SSO federation
• Cross-account roles enable centralized management
Identity &
Access Management
• Multiple accounts enable separation of duties
• Initial account security and AWS Config rules baseline
• Network baseline
Security & Governance

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Preventive Controls
Detective Controls
Remediation
Landing Zone – Control Types (Guardrail Types)
Prohibit user from disabling or deleting the baseline controls - SCP
Monitor resources and alert on non-compliance -Config rules
Take corrective action – AWS Lambda triggered from Config rules

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The adventure begins
Creating guardrails
AWS Landing Zone
AWS Organizations
AWS Config
Applied governance
AWS Organizations
AWS Config
Handling estate drift
Amazon CloudWatch
AWS Lambda

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo - Creating guardrails
Explore a deployed Landing Zone
Check Organizations configurations settings
Check CloudTrail configurations settings
Check IAM configuration settings
Goals accomplished with this lab
Perform operations as code
Implement a strong identity foundation
Enable traceability

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The map (goals accomplished in demo)
Operational excellence
Perform operations as code
Anticipate failure
Learn from all operational failures
Security pillar best practices
Implement a strong identity foundation
Automate security best practices
Processes for event, incident, and problem management
Enable traceability
https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 1—Applied governance
Enforce compliance using AWS Organizations
Create service control policies (SCP) to enforce compliance
Apply SCP to an account
Deploy restricted-SSH Config rule from console
Checks whether security groups disallow unrestricted incoming SSH traffic
Goals accomplished with this lab
Perform operations as code
Anticipate failure
Learn from all operational failures
Implement a strong identity foundation
Automate security best practices
Processes for event, incident, and problem management

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 1 (reference materials)
1. Download the lab 2 guide at https://bit.ly/2DxLXx6
https://s3.amazonaws.com/sec334labs/sec334labs/SEC334+Labs.pdf
2. Raise your hand if you need assistance

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The map (goals accomplished in lab 1)
Operational excellence
Perform operations as code
Anticipate failure
Learn from all operational failures
Security pillar best practices
Implement a strong identity foundation
Automate security best practices
Processes for event, incident, and problem management
Enable traceability
https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf

38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

40. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 2—Handling estate drift
Deploy
Monitor CloudTrail Logs to detects changes, and notify via SNS
Monitor IAM for users elevating permissions via inline policy
Use CloudWatch events and a Lambda function to respond to events
Goals accomplished with this lab
Perform operations as code
Anticipate failure
Automate security best practices
Processes for event, incident, and problem management

41. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 2 (reference materials)
1. Download the lab 3 guide at https://bit.ly/2DxLXx6
https://s3.amazonaws.com/sec334labs/sec334labs/SEC334+Labs.pdf
2. Raise your hand if you need assistance

42. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The map (goals accomplished in lab 2)
Operational excellence
Perform operations as code
Anticipate failure
Learn from all operational failures
Security pillar best practices
Implement a strong identity foundation
Automate security best practices
Processes for event, incident, and problem management
Enable traceability
https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf

43. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

44. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Removing lab resources
1. Download the lab teardown guide at https://bit.ly/2DxLXx6
https://s3.amazonaws.com/sec334labs/sec334labs/SEC334+Labs.pdf
2. Raise your hand if you need assistance

45. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

46. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Happily ever after
What we have built
Deployed a multi-account infrastructure based on AWS Well-Architected Framework
Created guardrails to enforce compliance
Created policies to apply governance
Created automation for handling estate drift
How it meets our objectives
Implement a strong identity foundation
Perform operations as code
Processes for event, incident, and problem management
Automate security best practices
Enable traceability

47. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Landing Zone Track: search: awslandingzone
Architecture:
SEC303: Architecting Security & Governance across your AWS Landing Zone (Session)
ENT315: Automate & Audit Cloud Governance & Compliance in Your Landing Zone (Session)
Implementation:
ENT350: AWS Landing Zone Deep Dive (Chalk Talk)
SEC349: Governance at Scale (Chalk Talk)
ENT318: Landing Zone Design: What to Do When Your Company Splits in Half (Session)
Workshops (First three are same content):
ENT351: Enterprise Governance: Build Your AWS Landing Zone (Workshop)
SEC315: Enterprise Governance and Security - Build Your AWS Landing Zone (Workshop)
GPSWS407A: Automated Solution for Deploying AWS Landing Zone (Workshop/Partners)
SEC334: Operational Excellence for Identity & Access Management (Workshop)
Summary/Feedback:
SEC360: AWS Landing Zone Strategies (Chalk Talk)

48. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sean MacDonald Johnny Hanley
seanmacd@amazon.com tjhanley@amazon.com

49. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

50. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

51. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Account Vending Machine
AWS
Service Catalog
Account Vending Machine (AWS Service Catalog)
• Account creation UI
• Account baseline versioning
• Launch constraints
Creates/updates AWS account
Apply account baseline stack sets
Create network baseline
Apply account security control policy
Account Vending
Machine
AWS
Organizations
Security
AWS
Log Archive
AWS
Shared Services
AWS
AWS
New AWS

52. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Landing Zone pricing
No additional charge for the AWS Landing Zone solution.
Customers are responsible for the charges of the underlying
services (e.g., AWS Config Service, AWS CloudTrail, etc.).
Cost for the basic solution: ~$200 / month
Monthly cost for optional add-ons:
• Centralized logging solution: <$400
• Directory Connector: <$50
• AWS Managed AD plus Remote Desktop Gateway: ~$300

53. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Learn More
Web page explains solution
benefits and structure
30-minute webcast overview
Link to form to have AWS follow
up to help you with solution
www.aws.amazon.com/answers/aws-landing-zone

54. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Request AWS follow up
https://bit.ly/2Cv6Qsq