Let’s Architect! Governance best practices
AWS Architecture BlogLet’s Architect! Governance best practicesby Luca Mezzalira, Federica Ciuffo, Laura Hyatt, Vittorio Denti, and Zamira Jaupaj | on05 JUL 2023| inArchitecture,Management & Governance,Thought Leadership|Permalink|ShareGovernance plays a crucial role in AWS environments, as it ensures compliance, security, and operational efficiency.In thisLet’s Architect!, we aim to provide valuable insights and best practices on how to configure governance appropriately within a company’s AWS infrastructure. By implementing these best practices, you can establish robust controls, enhance security, and maintain compliance, enabling your organization to fully leverage the power of AWS services while mitigating risks and maximizing operational efficiency.If you are hungry for more information on governance, check out theArchitecture Center’s management and governance page, where you can find a collection of AWS solutions, blueprints, and best practices on this topic.How Global Payments scales on AWS with governance and controlsAs global financial and regulated industry organizations increasingly turn to AWS for scaling their operations, they face the critical challenge of balancing growth with stringent governance and control regulatory requirements.During this re:Invent 2022 session, Global Payments sheds light on how they leverage AWS cloud operations services to address this challenge head-on. By utilizingAWS Service Catalog, they streamline the deployment of pre-approved, compliant resources and services across their AWS accounts. This not only expedites the provisioning process but also ensures that all resources meet the required regulatory standards.Take me to this re:Invent 2022 video!The combination of AWS Service Catalog andAWS Organizationsempowers Global Payments to establish robust governance and control mechanismsGovernance and security with infrastructure as codeMaintaining security and compliance throughout the entire deployment process is critical.In this video, you will discover how cfn-guard can be utilized to validate your deployment pipelines built usingAWS CloudFormation. By defining and applying custom rules, cfn-guard empowers you to enforce security policies, prevent misconfigurations, and ensure compliance with regulatory requirements. Moreover, by leveraging cdk-nag, you can catch potential security vulnerabilities and compliance risks early in the development process.Take me to this governance video!Learn how to use AWS CloudFormation and theAWS Cloud Development Kitto deploy cloud applications in regulated environments while enforcing security controlsGet more out of service control policies in a multi-account environmentAWS customers often utilizeAWS Organizationsto effectively manage multiple AWS accounts. There are numerous advantages to employing this approach within an organization, including grouping workloads with shared business objectives, ensuring compliance with regulatory frameworks, and establishing robust isolation barriers based on ownership. Customers commonly utilize separate accounts for development, testing, and production purposes. However, as the number of these accounts grows, the need arises for a centralized approach to establish control mechanisms and guidelines.In thisAWS Security Blogpost, we will guide you through various techniques that can enhance the utilization of AWS Organizations’ service control policies (SCPs) in a multi-account environment.Take me to this AWS Security Blog post!A sample organization showing the maximum number of SCPs applicable at each level (root, OU, account)Centralized Logging on AWSHaving a single pane of glass where allAmazon CloudWatchLogs are displayed is crucial for effectively monitoring and understanding the overall performance and health of a system or application.The AWS Centralized Logging solution facilitates the aggregation, examination, and visualization of CloudWatch Logs through a unified dashboard.This solution streamlines the consolidation, administration, and analysis of log files originating from diverse sources, including access audit logs, configuration change records, and billing events. Furthermore, it enables the collection of CloudWatch Logs from numerous AWS accounts and Regions.Take me to this AWS solution!The Centralized Logging on AWS solution contains the following components log ingestion, indexing, and visualizationSee you next time!Thanks for joining our discussion on governance best practices! We’ll be back in 2 weeks, when we’ll explore DevOps best practices.To find all the blogs from this series, you can check theLet’s Architect!list of content on theAWS Architecture Blog.TAGS:Architecture,Let's Architect,Management & GovernanceLuca MezzaliraLuca is Principal Solutions Architect based in London. He has authored several books and is an international speaker. He lent his expertise predominantly in the solution architecture field. Luca has gained accolades for revolutionizing the scalability of front-end architectures with micro-frontends, from increasing the efficiency of workflows, to delivering quality in products.Federica CiuffoFederica is a Solutions Architect at Amazon Web Services. She is specialized in container services and is passionate about building infrastructure with code. Outside of the office, she enjoys reading, drawing, and spending time with her friends, preferably in restaurants trying out new dishes from different cuisines.Laura HyattLaura Hyatt is a Solutions Architect for AWS Public Sector and helps Education customers in the UK. Laura helps customers not only architect and develop scalable solutions but also think big on innovative solutions facing the education sector at present. Laura's specialty is IoT, and she is also the Alexa SME for Education across EMEA.Vittorio DentiVittorio Denti is a Machine Learning Engineer at Amazon based in London. After completing his M.Sc. in Computer Science and Engineering at Politecnico di Milano (Milan) and the KTH Royal Institute of Technology (Stockholm), he joined AWS. Vittorio has a background in distributed systems and machine learning. He's especially passionate about software engineering and the latest innovations in machine learning science.Zamira JaupajZamira is an Enterprise Solutions Architect based in the Netherlands. She is highly passionate IT professional with over 10 years of multi-national experience in designing and implementing critical and complex solutions with containers, serverless, and data analytics for small and enterprise companies.
Governance plays a crucial role in AWS environments, as it ensures compliance, security, and operational efficiency. In this Let’s Architect!, we aim to provide valuable insights and best practices on how to configure governance appropriately within a company’s AWS infrastructure. By implementing these best practices, you can establish robust controls, enhance security, and maintain compliance, […]
Luca Mezzalira
Architecture Management & Governance Thought Leadership