Security<\/strong><\/p>\n\n\n\nAs for traceability, it is imperative to centralize all Audit Logs from the various AWS accounts.<\/p>\n\n\n\n
As far as infrastructure security is concerned, we must try to reduce the attack surface as much as possible, keeping all data private and avoiding exposing publicly weak and vulnerable exchange protocols.<\/p>\n\n\n\n
Proper backup management of data and configurations is essential to protect the company from attacks directed against our services.<\/p>\n\n\n\n
Governance and compliance<\/strong><\/p>\n\n\n\nIn order to distribute centrally and in a standard way the basic configurations of the various accounts, the Infrastructure-as-Code<\/strong> (IaC<\/strong>) principle – e.g., through the CloudFormation Stack Sets<\/strong> service – is a fundamental aspect. This service allows us to centrally control the basic configuration stacks of the various corporate organization accounts.<\/p>\n\n\n\nCosts Control<\/strong><\/p>\n\n\n\nImplementing budget alarms<\/strong> defined for each workload or account is important to keep costs under control.<\/p>\n\n\n\nThen costs can be optimized with Saving Plans<\/strong> which offer a discount for a commitment of at least an annual and at most three-year.<\/p>\n\n\n\nDisaster recovery<\/strong><\/p>\n\n\n\nIn the case of companies with few workloads, it is better to start by trying to reduce the impact of Disaster Recovery on costs. Backup & Restore<\/strong> is the perfect strategy to achieve this. The data must be identified and replicated continuously, and the infrastructure must be coded in such a way to automate the recovery procedures.<\/p>\n\n\n\nLarge IT<\/h2>\n\n\n\n Organization<\/strong><\/p>\n\n\n\nCompanies with digital departments that have many teams require a complex and highly stratified organization. However, it is necessary to limit the number of accounts to avoid the structure’s explosion.<\/p>\n\n\n\n
As for the Foundational accounts, you can still think of a single main OU with several accounts divided between security, logging, access management, billing management, and networking.<\/p>\n\n\n\n
Things get more complicated when it comes to the classification of workloads. Since the number of accounts tends to grow in case of many development environments, a trade-off must be found between workloads that are meant to be separated and workloads that can be grouped.<\/p>\n\n\n\n
To provide DevOps<\/strong> with the opportunity to experiment in sandbox environments, it is possible to build an Account Vending Machine<\/em><\/strong> that allows the automatic <\/em>provisioning and de-provisioning of accounts.<\/p>\n\n\n\nIdentity and Access management<\/strong><\/p>\n\n\n\nA centralized dashboard to manage the permissions to the various OUs or the different accounts is another certain need. A Landing Page to facilitate daily access for those who use the console is a must. If you\u2019re also considering integrating your IdP, then the perfect service is AWS Single Sign-on<\/strong>. With AWS SSO it is possible to manage identities and access authorizations to your multi-account structure centrally.<\/p>\n\n\n\nNetworking<\/strong><\/p>\n\n\n\nIt is difficult for companies with a complex network topography to find an exhaustive summary of it. Indeed Transit Gateway is necessary. Connecting two transit gateways set in different regions and accounts is also possible.<\/p>\n\n\n\n
The AWS VPN Client<\/strong> is, in turn, integrated with AWS SSO avoiding the need to manage additional login credentials <\/p>\n\n\n\nIn case of continuous and massive data transfer between offices, datacenters, and virtual environments, it is essential to provide physical connections in order to reduce latency. This is achieved through the creation of a mesh network of private physical connections via Direct Connect<\/strong>, backed up by backup SiteToSite VPNs<\/strong>.<\/p>\n\n\n\nIn a complex company, it is convenient to define the network access requirements by identifying paths that potentially do not meet them. You can achieve this using the Network Access Analyzer<\/strong> service.<\/p>\n\n\n\nSecurity<\/strong><\/p>\n\n\n\nAWS Security Hub<\/strong> allows you to have a centralized dashboard on which to collect and cross-reference all our metrics based on security rules.<\/p>\n\n\n\nThanks to AWS Organization<\/strong>‘s <\/strong>involvement, you can use Firewall Manager<\/strong>, a single service to create firewall rules and security policies and apply them consistently and hierarchically to the entire infrastructure from a central administrator account.<\/p>\n\n\n\nGovernance and compliance<\/p>\n\n\n\n
In the case of very large companies, it is helpful to provide a self-service portal from which to implement configurations validated by the company. Service Catalog<\/strong>, together with CloudFormation<\/strong>, helps you achieve consistent governance and meet compliance requirements.<\/p>\n\n\n\nProcedures must be supported by the collection of metrics; with the Audit Manager<\/strong>, it is easier to evaluate the efficiency of policies, procedures and controls.<\/p>\n\n\n\nCosts control<\/strong><\/p>\n\n\n\nThe cost allocation can be achieved through the Billing Conductor<\/strong> service. It allows you to create ad hoc invoices in case of complex needs in separating the costs (customers or business).<\/p>\n\n\n\nA cost control strategy is necessary, and it must go through a process of optimization of the computational part (AWS Compute Optimizer<\/strong>) and follow the automatic recommendations for the Reservation<\/strong> plans and the Saving Plans<\/strong>.<\/p>\n\n\n\nDisaster recovery<\/strong><\/p>\n\n\n\nCritical workloads with strict business continuity constraints require implementing an active-active multi-site strategy<\/strong>. This strategy consists of two workloads located in different accounts and regions ready to receive all production traffic without creating data split-brain scenarios.<\/p>\n\n\n\nTo conclude<\/h2>\n\n\n\n The Cloud is a revolutionary tool, but only when properly used; therefore, it is essential to have an informed, structured approach to the new model before you even think about services and features. First, companies evaluating a paradigm shift should provide IT teams with adequate training to build a Cloud Center of Excellence (CCoE) within the company. This group will be designated for making strategic decisions based on new responsibilities and available data and will successfully lead the transformation process.<\/p>\n\n\n\n
In this blog series, we focused on the concept of Landing Zone, the primary aspects that a CCoE should be able to understand and apply. The collaboration between the CCoE and an expert partner allows companies to design their own Cloud environments in the best possible way and to customize it according to each company-specific need. Always with evolution in mind: just like any IT project, the Landing Zone is not a static object. Instead, it is something dynamic that must be adapted continuously to the never-ending change both in the company and the AWS world.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Our previous articles discussed what a Landing Zone is and why it is important for any company to implement. Then, […]<\/p>\n","protected":false},"author":5,"featured_media":4713,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[468],"tags":[586,580,566],"class_list":["post-4706","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-management-governance-en","tag-aws-organizations","tag-governance-compliance","tag-landing-zone"],"yoast_head":"\n
Examples of Landing Zone implementations - Proud2beCloud Blog<\/title>\n \n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n \n \n \n \n\t \n\t \n\t \n