This presentation will cover Cloud Governance with desired security and admin controls provided by AWS Landing zone solution.

1. Secure Cloud Governance
Tushar Gupta
Senior Cloud Consultant – APAC, SoftwareOne

2. Introduction

3. Tushar Gupta
- 10+ years of experience across Enterprise Datacenter and
Cloud technologies
- Specialized in Cloud Migration and Hybrid Architectures to
onboard customers to AWS Cloud
3x AWS Certifications:
- AWS Certified Advanced Networking Specialty
- AWS Certified Solution Architect- Professional
- AWS Certified Solution Architect- Associate
Connect with me on LinkedIn

4. Typical Enterprise Situation
Infrastructure
Request
Infrastructure Provisioning
Governance Service Management
▪ High Lead time – ~ days to weeks
▪ Process heavy Service Management
▪ Governance and Compliance Issues

5. Agility v/s Control
We want Agility for
innovation and Faster
time to Market
Line of Business Central ITHow to achieve Strong
Business-IT alignment ??

6. Opportunity to achieve Agility & Control
Infrastructure
Templates, Policies
& Best Practices
Governance
and Control
Monitor
and Logging
Automated
Provisioning
▪ Lead time in minutes
▪ Service Catalogue for Landscape
Management
▪ Automated Service Management

7. Cloud Governance at Scale

8. Governance at AWS
▪ AWS’s focus is to maintain speed and agility
in Cloud
▪ Governance is not a Project
▪ Requires collaboration of other teams
and integrations of different perspectives
of Cloud Adoption Framework
Cloud Governance is one of the key perspectives of AWS Cloud Adoption Framework (CAF)

9. Security
Standardization
Operational
Efficiency
Key Drivers for Cloud Governance
Standardization across multiple accounts for different
business units
Secure and compliant Infrastructure for data protection and
audit purpose
Quick Infrastructure provisioning and service management
for business workloads in Cloud

10. Common Governance Challenges
Control and Visibility
Multi-Account Strategy
Integration challenges
Delegation of
Responsibility

11. Need of the Hour
01 Automated
Provisioning
02 Compliance
Automation
03 Multi-Account
Structure
04 Consolidated
Billing

12. AWS Landing Zone
Solution

13. Why one AWS Account is not enough?
Chargeback
Security and Compliance Controls
Isolation
Business Process
Multi-Environment

14. Issues with Multi-Account structure - AWS
• Issue with centralized management
• No standard Security or Account
level Baselines
• Manual Provisioning with high lead
time
• Distributed Service Management
• Cost Management issues

15. AWS Landing Zone - Solution
Configured, Secure & Scalable Multi-account AWS environment
based on AWS best practices
Starting point for customer’s Application Migration journey
Environment that allows for Iteration & Extension
over time

16. AWS Landing Zone - Outcomes
• Framework for creating and baselining a multi-account
environment
• Initial multi-account structure that includes security, audit, and
shared service requirements
Account Management
• User account access managed through AWS SSO federation
• Cross-account roles enable centralized management
Identity & Access
Management
• Multiple accounts enable separation of duties
• Initial account security and AWS Config rules baseline
• Network baseline
Security & Governance

17. AWS Landing Zone
Mitigating Cloud Governance Challenges

18. AWS Landing Zone Solution
▪ Account provisioning via Account Factory
▪ Standardized account security baselines, AWS
Guardrails
▪ Centralized Logging for AWS CloudTrail or AWS
Config services
▪ Centralized multi-account account authentication
via AWS Single Sign-On (AWS SSO) with an integrated
directory
▪ Simple and interactive Dashboard for Alerts and
Notifications for Compliance Management

19. 3 Pillars of Cloud Governance
Account Management Cost Management Compliance Automation

20. Account Management
AWS Organizations
▪ Centrally manage multiple AWS
Accounts
▪ Standard account and security
baselines for other AWS Accounts
AWS Service Catalog
▪ Automated Account
provisioning using Account
Factory
Service Control Policies
▪ Access Management and
control at AWS account level

21. Cost Management
AWS Consolidated Billing
▪ Consolidated billing of all AWS
accounts under one Master
account
AWS Budgets
▪ AWS Budgets for Cost
Management across different
AWS accounts
AWS Alerts & Notifications
▪ Automated alerts &
notifications to stakeholders
for potential budget overruns

22. Compliance Automation
AWS Config Rules AWS CloudWatch
▪ Compliance automation at
account and service levels with
AWS Guardrails
▪ Continuous Monitoring for
Compliance rules change and
logs sent to S3 Bucket
Interactive Dashboard
▪ Centralized & Interactive dashboard
for comprehensive view of
compliance status across AWS
accounts

23. Live Demonstration
AWS Cloud Governance

24. Questions ??

25. Thank You !!