Day 17: AWS Governance

Organization and Accounts

AWS Organizations allow the creation of new AWS accounts and offer centralized management of billing, access control, compliance, security, and resource sharing across AWS accounts.

• Root Account User: A single sign-in identity with complete access to all AWS services and resources within an account. Every account has a Root Account User.

• Organization Units: Groups of AWS accounts within an organization, which can include other organizational units, creating a hierarchy.

• Service Control Policies (SCPs): Provide central control over permissions for all accounts in your organization, ensuring adherence to organizational guidelines.

• AWS Organizations Activation: Once activated, AWS Organizations cannot be turned off. You can create multiple AWS accounts, with one being the Master/Root Account.

• AWS Account: Distinct from a User Account; it is a fundamental unit within AWS Organizations.

AWS Control Tower

AWS Control Tower helps enterprises quickly set up a secure, multi-account AWS environment, providing a baseline environment to start with a multi-account architecture.

• Landing Zone: A baseline environment adhering to well-architected and best practices for launching production-ready workloads. Features centralized logging (AWS CloudTrail), AWS SSO, and cross-account security auditing.

• Account Factory: Automates the provisioning of new accounts, standardizing account creation with pre-approved configurations and enabling self-service for account provisioning through AWS Service Catalog.

• Guardrails: Pre-packaged governance rules for security, operations, and compliance that can be applied enterprise-wide or to specific groups of accounts. AWS Control Tower replaces AWS Landing Zones.

AWS Config

Change Management: In cloud infrastructure, it involves monitoring, enforcing, and remediating changes systematically.

• Compliance-as-Code (CaC): Automates the monitoring, enforcement, and remediation of changes to maintain compliance with programs or configurations.

• AWS Config: A Compliance-as-Code framework that manages changes to AWS accounts on a per-region basis.

  • When to Use AWS Config:

    • To ensure a resource stays configured for compliance.

    • To track configuration changes to resources.

    • To list all resources within a region.

    • To analyze potential security weaknesses with detailed historical information.

AWS Quick Starts

AWS Quick Starts are prebuilt templates designed to help deploy a wide range of stacks efficiently.

• Components:

  • Reference Architecture: Provides a blueprint for deployment.

  • AWS CloudFormation Templates: Automate and configure the deployment.

  • Deployment Guide: Detailed explanation of the architecture and implementation.

• Features: Quick Starts can spin up a fully functional architecture in less than an hour, reducing manual procedures.

Tagging

Tags are key-value pairs assigned to AWS resources to help with:

• Resource Management: Organizing specific workloads and environments (e.g., Developer Environments).

• Cost Management and Optimization: Tracking costs, budgets, and alerts.

• Operations Management: Managing business commitments and SLA operations (e.g., Mission-Critical Services).

• Security: Data classification and security impact.

• Governance and Regulatory Compliance: Ensuring adherence to regulations.

• Automation: Optimizing workloads.

Tag Examples:

• Dept = Finance

• Status = Approved

• Team = Compliance

• Environment = Production

• Project = Enterprise

• Location = Canada

Resource Groups

Resource Groups are collections of resources sharing one or more tags. They help in organizing and consolidating information based on:

• Metrics

• Alarms

• Configuration Settings

Resource Groups can be modified to change the resources that appear in them and are accessible via the Global Console Header and Systems Manager.

Business-Centric Services

• Amazon Connect: A virtual call center service for creating workflows, recording calls, and managing call queues. Based on Amazon's customer service system.

• WorkSpaces: A virtual desktop service for provisioning Windows or Linux desktops quickly and securely, with scalability to thousands of desktops.

• WorkDocs: A shared collaboration service similar to Microsoft SharePoint, offering centralized storage for company content and files.

• Chime: A video-conferencing service similar to Zoom or Skype, offering screensharing, multiple participants, and a secure environment with an integrated calendar.

• WorkMail: A managed business email service with support for existing desktop and mobile email clients (IMAP), similar to Gmail or Exchange.

• Pinpoint: A marketing campaign management service for sending targeted emails, SMS, push notifications, and voice messages. It includes A/B testing and journey creation.

• Simple Email Service (SES): A transactional email service for integrating email sending capabilities into applications, with support for templates, open-rate tracking, and reputation management.

• QuickSight: A Business Intelligence (BI) service for visualizing data from multiple sources in graphs, requiring minimal programming knowledge.