Fast and Secure Account Governance with Customizations for AWS Control Tower
AWS Architecture BlogFast and Secure Account Governance with Customizations for AWS Control Towerby Mrudhula Balasubramanyan | on19 MAY 2021| inAdvanced (300),Architecture,AWS Control Tower,AWS Solutions Implementations|Permalink|ShareOrganizations around the world value a secure, well-architected, AWS environment that provides a strong foundation for their cloud operations. They seek a multi-account strategy that delivers operational excellence, security, reliability, performance, and cost optimization of their AWS resources now and into the future.AWS Control Towerdelivers on this multi-account strategy by orchestrating various AWS services. It sets up alanding zoneusingAWS OrganizationsandAWS Service Catalog. A landing zone provides a multi-account AWS environment with account structure, governance, network, and security configurations. Over time, as your organization grows, the landing zone must evolve to secure and organize your workloads and resources.In this blog, I will show you how to customize your landing zone to align with your business needs using anAWS SolutioncalledCustomizations for AWS Control Tower.Architecture overviewWhen you deploy AWS Control Tower, it creates twoOrganizational Units (OUs)under AWS Organizations. One is for shared accounts, and the other is for accounts provisioned by your users. An OU is a construct for grouping accounts for governance. You can create your own OU and add existing or new accounts to it.Customizations for AWS Control Tower enable you to deploy resources and governance at scale in your AWS Control Tower managed landing zone.Figure 1. Architecture for Customizations for AWS Control TowerThe solution must be deployed using anAWS CloudFormationtemplate in the sameAWS Regionand management account as yourAWS Control Tower landing zone. Once deployed, you can configure the solution to your needs using a configuration package. The package contains a manifest file, templates, and related files that are stored inAmazon Simple Storage Service (Amazon S3)by default. You can chooseAWS CodeCommitas your source repository instead of Amazon S3 at the time of deployment. This manifest describes the AWS resources to deploy to your OU or account(s) in specific AWS Regions. It points to the CloudFormation template for resources, and a JSON file for the AWS Organizationsservice control policies (SCPs). The solution deploysAWS CloudFormation StackSetsand AWS Organizations SCPs across multiple accounts and Regions.The solution takes a DevOps approach to deployment by usingAWS CodePipelinefor continuous integration and delivery. CodePipeline extracts the contents of the package stored in your source repository and kicks off the build and deployment process. If a manual approval step is needed, you can configure the pipeline to include one.When you create a new managed account usingAWS Control Tower Account Factory, the solution uses theAWS Control Tower Lifecycle Eventto invoke the CodePipeline workflow. The workflow deploys the existing stack of AWS resources to the new account.Note:The solution usesAWS Key Management Service (AWS KMS)to encrypt the configuration ZIP file in S3. Modify thekey policyto grant theAWS Identity and Access Management (AWS IAM)role or user permission to download/upload the ZIP file.Use case matrixNow let’s look at some typical scenarios. The matrix in figure 2 shows the behavior of the solution to changes in your AWS Control Tower managed landing zone.Let’s start by defining the terms used:New OU:A custom OU that you create in your landing zone. Assume that there are no AWS accounts associated with this OU.Existing OU:An OU that was created by AWS Control Tower, or an OU that has been brought under itsmanagement. Assume that this OU has accounts associated with it.New Account:Account created using AWS Control Tower Account Factory.Existing Account:An account that was previously provisioned using Account Factory orenrolledinto Control Tower.Figure 2. Matrix of use casesLet’s dive into these use cases using concrete examples.Deep dive: Resource deployment and account governanceConsider an organization with multiple projects comprising multiple teams.Figure 3 shows each project mapped to an OU. A project OU has teams with dedicated AWS accounts.Figure 3. Example AWS Control Tower managed landing zone – Current stateProject1 OU has Team1 Acct with storage and compute resources. Team1 uses Amazon S3 to store files andAmazon Elastic Compute Cloud (Amazon EC2)to process them. The admin defines these resources in a CloudFormationtemplateand includes them in the configuration package ready to be deployed for new accounts. Project1 OU hasSCP1in place that denies public access to S3 buckets, and allows launching only specific EC2 instance types. SCP1 governs Team1 Acct.Project2 OU has two team accounts, Team3 and Team4. Team3 works with serverless technologies and usesAWS Lambda. Team4 has yet to decide on a compute strategy. Project2 OU has SCP2 in place that denies public access to S3 buckets. SCP2 governs Team3 and Team4 Accts.New account added to existing OUConsider a future scenario where Project1 expands and hires a second team.Figure 4. Update to landing zone – Team2 Acct added to Project1 OUAn account is provisioned for Team2 using AWS Control Tower Account Factory. This invokes an AWS Control Tower Lifecycle Event that deploys the existing stack of storage and compute resources to Team2 Acct. Project1 OU governance now extends to Team2. This ensures a consistent set of resources and policies across accounts.New resources added to existing accountTeam4 decides on a compute strategy and wants to use containers for its applications. It wants to launchAmazon Elastic Container Service (Amazon ECS)clusters in two different AWS Regions.Figure 5. Update to landing zone – New resources added to Team4 AcctThe admin defines the resources in a CloudFormationtemplateand updates the manifest to include template, target account Team4, and target Regions. Uploading the package to the configuration bucket triggers the CodePipeline workflow that deploys the container resources to Team4 Acct in specified Regions. If needed, the admin can add additional SCPs to Project2 OU to govern compute resources.Best practicesStart with anexample manifestin thesolution’s GitHub repoto get started quickly.To store your customizations, adopt a consistentfile structurethat includes the manifest, templates, policies, and parameters.When adding or modifying SCPs, carefully review existing policies to avoid conflict. Remember, SCPs work with your AWS IAM policies and an explicit deny overrides an explicit allow, perAWS IAM policy evaluation logic.Double check your manifest file to make sure it reflects the correct target account(s) and Region(s). This helps prevent unintended changes to your account resources.ConclusionIn this blog, I highlighted a few use cases for the solution, Customizations for AWS Control Tower. You can use the solution to deploy your resources and governance at scale using the recommended best practices. The built-in DevOps workflows provide business agility and reliability. The result is a secure and scalable multi-account AWS environment that sets you up for growth and success in the cloud.TAGS:aws solutionsMrudhula BalasubramanyanMrudhula Balasubramanyan is a Senior Solutions Architect with AWS WWPS Solutions Architecture. She enjoys working across the breadth and depth of services, and innovating on behalf of her mission-driven, non-profit customers. When not obsessing over them, she can be seen hiking and biking the trails of the great Pacific Northwest.
Organizations around the world value a secure, well-architected, AWS environment that provides a strong foundation for their cloud operations. They seek a multi-account strategy that delivers operational excellence, security, reliability, performance, and cost optimization of their AWS resources now and into the future. AWS Control Tower delivers on this multi-account strategy by orchestrating various AWS […]
Mrudhula Balasubramanyan
Advanced (300) Architecture AWS Control Tower AWS Solutions Implementations