SlideShare a Scribd company logo
S A D E G H N A D I M I
Setting up a Landing Zone
Introducing an automated solution for setting up AWS environments at scale
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is a Landing Zone?
H
• A configured, secure, multi-account AWS environment based on
AWS best practices
• A starting point for net new development and experimentation
• A starting point for your application migration journey
• An environment that allows for iteration & extension over time
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
You Need a Landing Zone That Is…
meets the organization’s
security and auditing
requirements
ready to support highly
available and scalable
workloads
configurable to
support evolving business
requirements
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Common Business Outcomes
focus on what
differentiates
reduce time from
ideation to instantiation
secure and compliant
environment
migrate undifferentiated
workloads
deploy and run at a
global scale
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
And Even Though There is Plenty of Support…
• Professional Services
• Technical Account Managers
• Solutions Architects
• AWS Marketplace
• AWS Partner Ecosystem
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Setup Can Still Be Challenging
Numerous design decisions Configuration of multiple
accounts and services
Creation of a security
baseline and governance
100+ Services Documentation
User Access
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Common Design
Considerations
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Starting at the Beginning: AWS Accounts
Security/Resource
Boundary
API Limits/Throttling Billing Separation
Define your AWS account strategy
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
But keep in Mind, One Account Is Not Enough
Multiple Teams
Isolation
Security Controls Business ProcessBilling
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
So What Kinds of Accounts Should I Create?
Security Shared
Services
Billing
Dev ProdSandbox OtherPre-Prod
Organizations Master Account
NetworkLogging
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Define Your Account Security Strategy
InfoSec’s
Cross-
Account
Roles
AWS Account
Credential
Management
(“Root
Account”)
Federation
Baseline Requirements
Actions &
Conditions
Map
Enterprise
Roles
AWS
CloudTrail
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
And Choose Among Multiple VPC Options
AWS Services in
Your VPC
VPC Endpoints for
Amazon S3
DNS in-VPC with
Amazon Route 53
Logging VPC Traffic
with VPC Flow Logs
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Multi-Account Approach
Orgs: Account management
Logging: Centralized logs
Security: AWS Config Rules,
security tools
Shared services: Directory,
DNS, limit monitoring
Billing Tooling: Cost
monitoring
Sandbox: Experiments
Dev: Development
Pre-Prod: Staging
Prod: Production
Developer
Sandbox
Dev Pre-Prod
BU/Product/Resource Accounts
Developer Accounts
Security
Core Accounts
AWS Organizations Master
Billing
Tooling
Shared
Services
Sandbox
Direct
Connect
Internal
Audit
Logging
Prod
Shared
Services
Data Center
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How Can We
Make This Easy?
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Introducing the AWS Landing Zone Solution BETA
An automated, easy-to-deploy solution implementing collective best practices for
running secure and scalable workloads in AWS
Automated
deployment
Based on AWS best
practices and
recommendations
Foundational
security and
governance controls
Baseline accounts
and account vending
machine
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is the AWS Landing Zone? BETA
The AWS Landing Zone is a baseline AWS environment
that includes the following components:
AWS
Multiple Accounts
Identity and Access
Management
Network DesignData Security Centralized Logging
Governance
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Landing Zone Tenets
Designed for scalability. Able to grow and scale with your business.
Prescriptive. Implements prescriptive defaults when creating new accounts.
Flexible. Allows you to modify default configurations or add capabilities.
Easy to deploy. Leverages automation to simplify the experience.
Well-architected “compatible”. Allows you to build well-architected applications.
BETA
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What You Get with the AWS Landing Zone BETA
Account
Management
• A multi-account architecture based on AWS best practices
• An account vending machine which enables automated
deployment of new accounts with a set of security baselines
Security &
Governance
• Account security baseline with auditing capabilities (CloudTrail &
Config)
• Data security baseline with governance checks
• Network security baseline
Logging • Centralized logging
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
BETA
Tagging
mechanism
• Service Catalog default tags for Admin product launches
• Service Catalog custom tags for end users
Mechanism for
separation of
duties out of
the box
• Multiple accounts and defining cross account-roles allow
implementation of separation of duties across all accounts
Enable SSO • Eliminate IAM account sprawl
What You Get with the AWS Landing Zone
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Landing Zone Architecture BETA
ACCOUNT
VENDING
MACHINE
LANDING ZONE INITIATION
“MASTER” ACCOUNT
AWS LAMBDA
AWS SSM
PARAMETER
STORE
AWS
SERVICE
CATALOG
AWS
CLOUDFORMATION
STACKSETS
NO
DEFAULT VPC
AWS
ORGANIZATIONS
AMAZON
SNS
CORE OU
CLOUDTRAIL
CONFIG
EBS ENCRYPTION
CLV2
IAM ROLESSTACKS
AMAZON VPC AWS
CLOUDTRAIL
AWS CONFIG CONFIG RULE
(EBS ENCRYPTION)
SHARED SERVICES ACCOUNT
DIRECTORY
SERVICE
CENTRALIZED
LOGGING
(MASTER)
IAM ROLES
EC2
KEY PAIR
LOGGING ACCOUNT
AWS
CLOUDTRAIL
AWS
CONFIG
CONFIG RULE
(EBS ENCRYPTION)
CENTRALIZED
LOGGING
(SPOKE)
IAM ROLES
NO
DEFAULT VPC
S3 BUCKET FOR
CLOUDTRAIL/C
ONFIG
SECURITY ACCOUNT
AWS STSCENTRALIZED
LOGGING
(SPOKE)
CONFIG RULE
(EBS ENCRYPTION)
NO
DEFAULT VPC
AMAZON
SNS
AMAZON
SNS
AMAZON
SNS
AWS
CLOUDTRAIL
AWS
CONFIG
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Landing Zone Vending Machine BETA
MASTER ACCOUNT
LOGGING ACCOUNT NEW AWS ACCOUNT
AWS
CLOUDTRAIL
STACK
AWS CONFIG
STACK
EBS ENCRYPTION
STACK
CLV2
SPOKE
ADMIN
ROLE
AMAZON VPC
(DEFAULT)
READ ONLY
ROLE
AMAZON S3
BUCKET
AWS
SERVICE CATALOG
LAMBDA-BACKED
CUSTOM RESOURCE
AWS
ORGANIZATIONS
EXISTING OR
NEW OU
AWS CLOUDFORMATION
STACKSETS
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Benefits of the AWS Automated Landing Zone
Guardrails NOT Blockers Auditable Flexible
Automated Scalable Self-service
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Landing Zone Pricing and Availability
• Monthly charges for deployed resources apply
• No additional charge for the AWS Landing Zone solution
• Available in private beta
BETA
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Next steps
• Lookout for GA release in Q2 2018
• Work with your account team to sign up for beta
• Deploy the solution
• Provide feedback to help prioritize new features
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank You!

More Related Content

What's hot

AWS Training For Beginners | AWS Certified Solutions Architect Tutorial | AWS...
AWS Training For Beginners | AWS Certified Solutions Architect Tutorial | AWS...AWS Training For Beginners | AWS Certified Solutions Architect Tutorial | AWS...
AWS Training For Beginners | AWS Certified Solutions Architect Tutorial | AWS...
Simplilearn
 
Using AWS Control Tower to govern multi-account AWS environments at scale - G...
Using AWS Control Tower to govern multi-account AWS environments at scale - G...Using AWS Control Tower to govern multi-account AWS environments at scale - G...
Using AWS Control Tower to govern multi-account AWS environments at scale - G...
Amazon Web Services
 
Aws landing zone
Aws landing zoneAws landing zone
Aws landing zone
Igor Ivanovic
 
Introduction to AWS Cost Management
Introduction to AWS Cost ManagementIntroduction to AWS Cost Management
Introduction to AWS Cost Management
Amazon Web Services
 
Enterprise Governance: Build Your AWS Landing Zone (ENT351-R1) - AWS re:Inven...
Enterprise Governance: Build Your AWS Landing Zone (ENT351-R1) - AWS re:Inven...Enterprise Governance: Build Your AWS Landing Zone (ENT351-R1) - AWS re:Inven...
Enterprise Governance: Build Your AWS Landing Zone (ENT351-R1) - AWS re:Inven...
Amazon Web Services
 
Access Control for the Cloud: AWS Identity and Access Management (IAM) (SEC20...
Access Control for the Cloud: AWS Identity and Access Management (IAM) (SEC20...Access Control for the Cloud: AWS Identity and Access Management (IAM) (SEC20...
Access Control for the Cloud: AWS Identity and Access Management (IAM) (SEC20...
Amazon Web Services
 
Overview of Amazon Web Services
Overview of Amazon Web ServicesOverview of Amazon Web Services
Overview of Amazon Web Services
Amazon Web Services
 
Identity and Access Management: The First Step in AWS Security
Identity and Access Management: The First Step in AWS SecurityIdentity and Access Management: The First Step in AWS Security
Identity and Access Management: The First Step in AWS Security
Amazon Web Services
 
Implementing your landing zone - FND210 - AWS re:Inforce 2019
Implementing your landing zone - FND210 - AWS re:Inforce 2019 Implementing your landing zone - FND210 - AWS re:Inforce 2019
Implementing your landing zone - FND210 - AWS re:Inforce 2019
Amazon Web Services
 
AWS 101
AWS 101AWS 101
Elastic Load Balancing Deep Dive - AWS Online Tech Talk
Elastic  Load Balancing Deep Dive - AWS Online Tech TalkElastic  Load Balancing Deep Dive - AWS Online Tech Talk
Elastic Load Balancing Deep Dive - AWS Online Tech Talk
Amazon Web Services
 
Living the AWS Well Architected Framework
Living the AWS Well Architected FrameworkLiving the AWS Well Architected Framework
Living the AWS Well Architected Framework
Adam Dillman
 
Kubernetes on AWS with Amazon EKS
Kubernetes on AWS with Amazon EKSKubernetes on AWS with Amazon EKS
Kubernetes on AWS with Amazon EKS
Amazon Web Services
 
Fundamentals of AWS Security
Fundamentals of AWS SecurityFundamentals of AWS Security
Fundamentals of AWS Security
Amazon Web Services
 
Module 2: Core AWS Compute and Storage Services - Virtual AWSome Day June 2018
Module 2: Core AWS Compute and Storage Services - Virtual AWSome Day June 2018Module 2: Core AWS Compute and Storage Services - Virtual AWSome Day June 2018
Module 2: Core AWS Compute and Storage Services - Virtual AWSome Day June 2018
Amazon Web Services
 
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
Amazon Web Services
 
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Amazon Web Services
 
Azure role based access control (rbac)
Azure role based access control (rbac)Azure role based access control (rbac)
Azure role based access control (rbac)
Srikanth Kappagantula
 
Introduction to Amazon EKS
Introduction to Amazon EKSIntroduction to Amazon EKS
Introduction to Amazon EKS
Amazon Web Services
 
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Amazon Web Services
 

What's hot (20)

AWS Training For Beginners | AWS Certified Solutions Architect Tutorial | AWS...
AWS Training For Beginners | AWS Certified Solutions Architect Tutorial | AWS...AWS Training For Beginners | AWS Certified Solutions Architect Tutorial | AWS...
AWS Training For Beginners | AWS Certified Solutions Architect Tutorial | AWS...
 
Using AWS Control Tower to govern multi-account AWS environments at scale - G...
Using AWS Control Tower to govern multi-account AWS environments at scale - G...Using AWS Control Tower to govern multi-account AWS environments at scale - G...
Using AWS Control Tower to govern multi-account AWS environments at scale - G...
 
Aws landing zone
Aws landing zoneAws landing zone
Aws landing zone
 
Introduction to AWS Cost Management
Introduction to AWS Cost ManagementIntroduction to AWS Cost Management
Introduction to AWS Cost Management
 
Enterprise Governance: Build Your AWS Landing Zone (ENT351-R1) - AWS re:Inven...
Enterprise Governance: Build Your AWS Landing Zone (ENT351-R1) - AWS re:Inven...Enterprise Governance: Build Your AWS Landing Zone (ENT351-R1) - AWS re:Inven...
Enterprise Governance: Build Your AWS Landing Zone (ENT351-R1) - AWS re:Inven...
 
Access Control for the Cloud: AWS Identity and Access Management (IAM) (SEC20...
Access Control for the Cloud: AWS Identity and Access Management (IAM) (SEC20...Access Control for the Cloud: AWS Identity and Access Management (IAM) (SEC20...
Access Control for the Cloud: AWS Identity and Access Management (IAM) (SEC20...
 
Overview of Amazon Web Services
Overview of Amazon Web ServicesOverview of Amazon Web Services
Overview of Amazon Web Services
 
Identity and Access Management: The First Step in AWS Security
Identity and Access Management: The First Step in AWS SecurityIdentity and Access Management: The First Step in AWS Security
Identity and Access Management: The First Step in AWS Security
 
Implementing your landing zone - FND210 - AWS re:Inforce 2019
Implementing your landing zone - FND210 - AWS re:Inforce 2019 Implementing your landing zone - FND210 - AWS re:Inforce 2019
Implementing your landing zone - FND210 - AWS re:Inforce 2019
 
AWS 101
AWS 101AWS 101
AWS 101
 
Elastic Load Balancing Deep Dive - AWS Online Tech Talk
Elastic  Load Balancing Deep Dive - AWS Online Tech TalkElastic  Load Balancing Deep Dive - AWS Online Tech Talk
Elastic Load Balancing Deep Dive - AWS Online Tech Talk
 
Living the AWS Well Architected Framework
Living the AWS Well Architected FrameworkLiving the AWS Well Architected Framework
Living the AWS Well Architected Framework
 
Kubernetes on AWS with Amazon EKS
Kubernetes on AWS with Amazon EKSKubernetes on AWS with Amazon EKS
Kubernetes on AWS with Amazon EKS
 
Fundamentals of AWS Security
Fundamentals of AWS SecurityFundamentals of AWS Security
Fundamentals of AWS Security
 
Module 2: Core AWS Compute and Storage Services - Virtual AWSome Day June 2018
Module 2: Core AWS Compute and Storage Services - Virtual AWSome Day June 2018Module 2: Core AWS Compute and Storage Services - Virtual AWSome Day June 2018
Module 2: Core AWS Compute and Storage Services - Virtual AWSome Day June 2018
 
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
 
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
 
Azure role based access control (rbac)
Azure role based access control (rbac)Azure role based access control (rbac)
Azure role based access control (rbac)
 
Introduction to Amazon EKS
Introduction to Amazon EKSIntroduction to Amazon EKS
Introduction to Amazon EKS
 
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
 

Similar to Setting Up a Landing Zone

Launch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Launch AWS Faster using Automated Landing Zones - AWS Online Tech TalksLaunch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Launch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Amazon Web Services
 
AWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best PracticesAWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best Practices
Amazon Web Services
 
AWS Accounts@Scale Using AWS Landing Zone_AWSPSSummit_Singapore
AWS Accounts@Scale Using AWS Landing Zone_AWSPSSummit_SingaporeAWS Accounts@Scale Using AWS Landing Zone_AWSPSSummit_Singapore
AWS Accounts@Scale Using AWS Landing Zone_AWSPSSummit_Singapore
Amazon Web Services
 
Enterprise Governance and Security Build Your AWS Landing Zone (SEC315) - AWS...
Enterprise Governance and Security Build Your AWS Landing Zone (SEC315) - AWS...Enterprise Governance and Security Build Your AWS Landing Zone (SEC315) - AWS...
Enterprise Governance and Security Build Your AWS Landing Zone (SEC315) - AWS...
Amazon Web Services
 
Migrate & Modernize your legacy Microsoft applications with AWS
Migrate & Modernize your legacy Microsoft applications with AWSMigrate & Modernize your legacy Microsoft applications with AWS
Migrate & Modernize your legacy Microsoft applications with AWS
Amazon Web Services
 
Cloud Migration Insights Forum, Perth
Cloud Migration Insights Forum, PerthCloud Migration Insights Forum, Perth
Cloud Migration Insights Forum, Perth
Amazon Web Services
 
Hybrid Cloud on AWS - Introduction and Art of the Possible
Hybrid Cloud on AWS - Introduction and Art of the PossibleHybrid Cloud on AWS - Introduction and Art of the Possible
Hybrid Cloud on AWS - Introduction and Art of the Possible
Tom Laszewski
 
Security Automation using AWS Management Tools
Security Automation using AWS Management ToolsSecurity Automation using AWS Management Tools
Security Automation using AWS Management Tools
Amazon Web Services
 
Lock it Down: How to Secure your AWS Account and your Organization's Accounts
Lock it Down: How to Secure your AWS Account and your Organization's AccountsLock it Down: How to Secure your AWS Account and your Organization's Accounts
Lock it Down: How to Secure your AWS Account and your Organization's Accounts
Amazon Web Services
 
ARC325_Managing Multiple AWS Accounts at Scale
ARC325_Managing Multiple AWS Accounts at ScaleARC325_Managing Multiple AWS Accounts at Scale
ARC325_Managing Multiple AWS Accounts at Scale
Amazon Web Services
 
Cloud Migration Insights Forum, Sydney
Cloud Migration Insights Forum, SydneyCloud Migration Insights Forum, Sydney
Cloud Migration Insights Forum, Sydney
Amazon Web Services
 
Cloud Migration Insights Forum, Melbourne
Cloud Migration Insights Forum, MelbourneCloud Migration Insights Forum, Melbourne
Cloud Migration Insights Forum, Melbourne
Amazon Web Services
 
Simplify & Standardise Your Migration to AWS with a Migration Landing Zone
Simplify & Standardise Your Migration to AWS with a Migration Landing ZoneSimplify & Standardise Your Migration to AWS with a Migration Landing Zone
Simplify & Standardise Your Migration to AWS with a Migration Landing Zone
Amazon Web Services
 
AWS Security By Design
AWS Security By DesignAWS Security By Design
AWS Security By Design
Amazon Web Services
 
Enabling Governance, Compliance, Operational, and Risk Auditing with AWS Mana...
Enabling Governance, Compliance, Operational, and Risk Auditing with AWS Mana...Enabling Governance, Compliance, Operational, and Risk Auditing with AWS Mana...
Enabling Governance, Compliance, Operational, and Risk Auditing with AWS Mana...
Amazon Web Services
 
Enterprise Security
Enterprise SecurityEnterprise Security
Enterprise Security
Amazon Web Services
 
AWS Initiate - Landing Zone: Como saber se sua base está preparada
AWS Initiate - Landing Zone: Como saber se sua base está preparadaAWS Initiate - Landing Zone: Como saber se sua base está preparada
AWS Initiate - Landing Zone: Como saber se sua base está preparada
Amazon Web Services LATAM
 
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS SummitThreat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Amazon Web Services
 
Introduction to Threat Detection and Remediation on AWS
Introduction to Threat Detection and Remediation on AWSIntroduction to Threat Detection and Remediation on AWS
Introduction to Threat Detection and Remediation on AWS
Amazon Web Services
 
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Amazon Web Services
 

Similar to Setting Up a Landing Zone (20)

Launch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Launch AWS Faster using Automated Landing Zones - AWS Online Tech TalksLaunch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Launch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
 
AWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best PracticesAWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best Practices
 
AWS Accounts@Scale Using AWS Landing Zone_AWSPSSummit_Singapore
AWS Accounts@Scale Using AWS Landing Zone_AWSPSSummit_SingaporeAWS Accounts@Scale Using AWS Landing Zone_AWSPSSummit_Singapore
AWS Accounts@Scale Using AWS Landing Zone_AWSPSSummit_Singapore
 
Enterprise Governance and Security Build Your AWS Landing Zone (SEC315) - AWS...
Enterprise Governance and Security Build Your AWS Landing Zone (SEC315) - AWS...Enterprise Governance and Security Build Your AWS Landing Zone (SEC315) - AWS...
Enterprise Governance and Security Build Your AWS Landing Zone (SEC315) - AWS...
 
Migrate & Modernize your legacy Microsoft applications with AWS
Migrate & Modernize your legacy Microsoft applications with AWSMigrate & Modernize your legacy Microsoft applications with AWS
Migrate & Modernize your legacy Microsoft applications with AWS
 
Cloud Migration Insights Forum, Perth
Cloud Migration Insights Forum, PerthCloud Migration Insights Forum, Perth
Cloud Migration Insights Forum, Perth
 
Hybrid Cloud on AWS - Introduction and Art of the Possible
Hybrid Cloud on AWS - Introduction and Art of the PossibleHybrid Cloud on AWS - Introduction and Art of the Possible
Hybrid Cloud on AWS - Introduction and Art of the Possible
 
Security Automation using AWS Management Tools
Security Automation using AWS Management ToolsSecurity Automation using AWS Management Tools
Security Automation using AWS Management Tools
 
Lock it Down: How to Secure your AWS Account and your Organization's Accounts
Lock it Down: How to Secure your AWS Account and your Organization's AccountsLock it Down: How to Secure your AWS Account and your Organization's Accounts
Lock it Down: How to Secure your AWS Account and your Organization's Accounts
 
ARC325_Managing Multiple AWS Accounts at Scale
ARC325_Managing Multiple AWS Accounts at ScaleARC325_Managing Multiple AWS Accounts at Scale
ARC325_Managing Multiple AWS Accounts at Scale
 
Cloud Migration Insights Forum, Sydney
Cloud Migration Insights Forum, SydneyCloud Migration Insights Forum, Sydney
Cloud Migration Insights Forum, Sydney
 
Cloud Migration Insights Forum, Melbourne
Cloud Migration Insights Forum, MelbourneCloud Migration Insights Forum, Melbourne
Cloud Migration Insights Forum, Melbourne
 
Simplify & Standardise Your Migration to AWS with a Migration Landing Zone
Simplify & Standardise Your Migration to AWS with a Migration Landing ZoneSimplify & Standardise Your Migration to AWS with a Migration Landing Zone
Simplify & Standardise Your Migration to AWS with a Migration Landing Zone
 
AWS Security By Design
AWS Security By DesignAWS Security By Design
AWS Security By Design
 
Enabling Governance, Compliance, Operational, and Risk Auditing with AWS Mana...
Enabling Governance, Compliance, Operational, and Risk Auditing with AWS Mana...Enabling Governance, Compliance, Operational, and Risk Auditing with AWS Mana...
Enabling Governance, Compliance, Operational, and Risk Auditing with AWS Mana...
 
Enterprise Security
Enterprise SecurityEnterprise Security
Enterprise Security
 
AWS Initiate - Landing Zone: Como saber se sua base está preparada
AWS Initiate - Landing Zone: Como saber se sua base está preparadaAWS Initiate - Landing Zone: Como saber se sua base está preparada
AWS Initiate - Landing Zone: Como saber se sua base está preparada
 
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS SummitThreat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
 
Introduction to Threat Detection and Remediation on AWS
Introduction to Threat Detection and Remediation on AWSIntroduction to Threat Detection and Remediation on AWS
Introduction to Threat Detection and Remediation on AWS
 
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
 

More from Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
Amazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
Amazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
Amazon Web Services
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Amazon Web Services
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
Amazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
Amazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Amazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
Amazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Amazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
Amazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
Amazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
Amazon Web Services
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
Amazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
Amazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
Amazon Web Services
 

More from Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 

Setting Up a Landing Zone

  • 1. S A D E G H N A D I M I Setting up a Landing Zone Introducing an automated solution for setting up AWS environments at scale
  • 2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. What is a Landing Zone? H • A configured, secure, multi-account AWS environment based on AWS best practices • A starting point for net new development and experimentation • A starting point for your application migration journey • An environment that allows for iteration & extension over time
  • 3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. You Need a Landing Zone That Is… meets the organization’s security and auditing requirements ready to support highly available and scalable workloads configurable to support evolving business requirements
  • 4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Common Business Outcomes focus on what differentiates reduce time from ideation to instantiation secure and compliant environment migrate undifferentiated workloads deploy and run at a global scale
  • 5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. And Even Though There is Plenty of Support… • Professional Services • Technical Account Managers • Solutions Architects • AWS Marketplace • AWS Partner Ecosystem
  • 6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Setup Can Still Be Challenging Numerous design decisions Configuration of multiple accounts and services Creation of a security baseline and governance 100+ Services Documentation User Access
  • 7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Common Design Considerations
  • 8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Starting at the Beginning: AWS Accounts Security/Resource Boundary API Limits/Throttling Billing Separation Define your AWS account strategy
  • 9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. But keep in Mind, One Account Is Not Enough Multiple Teams Isolation Security Controls Business ProcessBilling
  • 10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. So What Kinds of Accounts Should I Create? Security Shared Services Billing Dev ProdSandbox OtherPre-Prod Organizations Master Account NetworkLogging
  • 11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Define Your Account Security Strategy InfoSec’s Cross- Account Roles AWS Account Credential Management (“Root Account”) Federation Baseline Requirements Actions & Conditions Map Enterprise Roles AWS CloudTrail
  • 12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. And Choose Among Multiple VPC Options AWS Services in Your VPC VPC Endpoints for Amazon S3 DNS in-VPC with Amazon Route 53 Logging VPC Traffic with VPC Flow Logs
  • 13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. The Multi-Account Approach Orgs: Account management Logging: Centralized logs Security: AWS Config Rules, security tools Shared services: Directory, DNS, limit monitoring Billing Tooling: Cost monitoring Sandbox: Experiments Dev: Development Pre-Prod: Staging Prod: Production Developer Sandbox Dev Pre-Prod BU/Product/Resource Accounts Developer Accounts Security Core Accounts AWS Organizations Master Billing Tooling Shared Services Sandbox Direct Connect Internal Audit Logging Prod Shared Services Data Center
  • 14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. How Can We Make This Easy?
  • 15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Introducing the AWS Landing Zone Solution BETA An automated, easy-to-deploy solution implementing collective best practices for running secure and scalable workloads in AWS Automated deployment Based on AWS best practices and recommendations Foundational security and governance controls Baseline accounts and account vending machine
  • 16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. What is the AWS Landing Zone? BETA The AWS Landing Zone is a baseline AWS environment that includes the following components: AWS Multiple Accounts Identity and Access Management Network DesignData Security Centralized Logging Governance
  • 17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Landing Zone Tenets Designed for scalability. Able to grow and scale with your business. Prescriptive. Implements prescriptive defaults when creating new accounts. Flexible. Allows you to modify default configurations or add capabilities. Easy to deploy. Leverages automation to simplify the experience. Well-architected “compatible”. Allows you to build well-architected applications. BETA
  • 18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. What You Get with the AWS Landing Zone BETA Account Management • A multi-account architecture based on AWS best practices • An account vending machine which enables automated deployment of new accounts with a set of security baselines Security & Governance • Account security baseline with auditing capabilities (CloudTrail & Config) • Data security baseline with governance checks • Network security baseline Logging • Centralized logging
  • 19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. BETA Tagging mechanism • Service Catalog default tags for Admin product launches • Service Catalog custom tags for end users Mechanism for separation of duties out of the box • Multiple accounts and defining cross account-roles allow implementation of separation of duties across all accounts Enable SSO • Eliminate IAM account sprawl What You Get with the AWS Landing Zone
  • 20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Landing Zone Architecture BETA ACCOUNT VENDING MACHINE LANDING ZONE INITIATION “MASTER” ACCOUNT AWS LAMBDA AWS SSM PARAMETER STORE AWS SERVICE CATALOG AWS CLOUDFORMATION STACKSETS NO DEFAULT VPC AWS ORGANIZATIONS AMAZON SNS CORE OU CLOUDTRAIL CONFIG EBS ENCRYPTION CLV2 IAM ROLESSTACKS AMAZON VPC AWS CLOUDTRAIL AWS CONFIG CONFIG RULE (EBS ENCRYPTION) SHARED SERVICES ACCOUNT DIRECTORY SERVICE CENTRALIZED LOGGING (MASTER) IAM ROLES EC2 KEY PAIR LOGGING ACCOUNT AWS CLOUDTRAIL AWS CONFIG CONFIG RULE (EBS ENCRYPTION) CENTRALIZED LOGGING (SPOKE) IAM ROLES NO DEFAULT VPC S3 BUCKET FOR CLOUDTRAIL/C ONFIG SECURITY ACCOUNT AWS STSCENTRALIZED LOGGING (SPOKE) CONFIG RULE (EBS ENCRYPTION) NO DEFAULT VPC AMAZON SNS AMAZON SNS AMAZON SNS AWS CLOUDTRAIL AWS CONFIG
  • 21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Landing Zone Vending Machine BETA MASTER ACCOUNT LOGGING ACCOUNT NEW AWS ACCOUNT AWS CLOUDTRAIL STACK AWS CONFIG STACK EBS ENCRYPTION STACK CLV2 SPOKE ADMIN ROLE AMAZON VPC (DEFAULT) READ ONLY ROLE AMAZON S3 BUCKET AWS SERVICE CATALOG LAMBDA-BACKED CUSTOM RESOURCE AWS ORGANIZATIONS EXISTING OR NEW OU AWS CLOUDFORMATION STACKSETS
  • 22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits of the AWS Automated Landing Zone Guardrails NOT Blockers Auditable Flexible Automated Scalable Self-service
  • 23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Landing Zone Pricing and Availability • Monthly charges for deployed resources apply • No additional charge for the AWS Landing Zone solution • Available in private beta BETA
  • 24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Next steps • Lookout for GA release in Q2 2018 • Work with your account team to sign up for beta • Deploy the solution • Provide feedback to help prioritize new features
  • 25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Thank You!