AWS Control Tower
1 like83 views
AWS Control Tower allows organizations to govern and orchestrate multi-account environments in AWS. It enforces global rules and compliance across accounts through centralized guardrails and blueprints. Changes can be applied from a single place to multiple accounts, automating processes like account creation at scale. Landing zones define the configuration for other accounts in a customizable and centralized manner.
AWS Control Tower
- 1. Govern and orchestrate multi-account environments AWS Control Tower Jackson Oliveira @cyberjso
- 2. The multiple accounts approach ➢ Isolate different workloads and allow distinct operation models ➢ Compliance and security ➢ Better cost management ➢ Speed up innovation ➢ Smaller blast radious
- 4. Organization units - limitations ➢ Operate at scale (dozens, hundreds or thousands) ○ Hard to guarantee compliance ○ Maintenance. How to apply changed on all of them? ○ Security. Difficult to track suspicious activities ○ Cost. Dedicated engineers and teams to maintain and evolve the structure, difficult to self-serve engineers
- 5. AWS Control Tower Orchestration Organization units AWS SSO SCP Service Catalog Parameter store Cloudformation AWS Control Tower S3 VPC Config Well ARchitected Best Practices
- 6. AWS Control Tower - Main features ➢ Single view of the entire multi-account architecture ➢ Govern multiple-accounts from blueprints (landing zone) ➢ Enforces global rules (guardrails) for all accounts ➢ Apply changes from a central place ➢ Automates the account creation process at scale ➢ Customizable
- 7. AWS Control Tower - Typical setup
- 8. AWS Control Tower - Landing zone ➢ Central place where configuration for other accounts are set ➢ Resides on the master account ➢ Define what goes inside each OU/account ➢ Contains all the dashboards
- 10. AWS Control Tower - Takeaways ➢ Existent accounts can be added into the structure after the initial setup. ➢ For small environments can be an overkill ➢ Can be customizable via terraform ➢ Errors can be hard to track sometimes ➢ Once defined, master account cannot be changed ➢ Not recommended for envs that requires too much customizations ➢ Errors are hard to troubleshoot sometimes
- 11. Govern and orchestrate multi-account environments AWS Control Tower Jackson Oliveira @cyberjso Thank you!