[Governance] AWS Organizations & Multi-Accounts¶

🛬 [Landing Zones] Cloud-Foundation using AWS Organizations¶

Quickly and securely deploy your application workloads and solutions across a centrally governed multi-account environment

Identity Management using IAM Identity Center (AWS SSO) & Okta¶

Foundational Organizational Unit (OU) Structure and Accounts¶

Manage AWS Resources with Terraform: account folder will hold all the AWS accounts, management and non-management accounts.

Core-Root || management-account: [email protected] have a root with 5 children OUs.
Terraform-code: refer to Core-Root || Management-Account in DevOps/account/management/organization/main.tf

Each business domain generally has 3 top-level environments:
- 📘 ou-sandbox: Sandboxes
- 📘 ou-non-prod: Non-Prod (which may in turn contain VPCs for dev, test, etc as required)
- 📗 ou-prod: Prod
Each environment has the structure
- API: which is exposed externally and protected by WAF etc. Also the place for presentation layers. Transient storage only.
- App: back end and persistent storage layer.
- In addition: each environment has, but SHARES an authentication layer which implements common authentication using SAML2 & Cognito

Other notes:
- No Landing Zone or Control Tower: May be consider in future
- Guardrails SCP and AWS Config are coming
- AWS config alternative: Dome9 scanning vulnerabilities

AWS Organizational Units (OUs) and Accounts

ou-security OU & Security Accounts

OU	Environment	Account Alias	Root Email	Description
Security (ou-security)	prod	aws-log-archive	[email protected]	Centralized logging (CloudTrail, AWS Config)
Security (ou-security)	prod	aws-audit	[email protected]	Security tooling (Security Hub, GuardDuty)

ou-shared-services & Shared Services Accounts

OU	Environment	Account Alias	Root Email	Description
`management account`	prod	aws-admin	[email protected]	Management account + Centralized identity and user management
Shared Services	prod	aws-shared-services	[email protected]	Centralized networking (Transit Gateway, VPCs)
Centralized Ops	prod	aws-centralized-ops	[email protected]	Centralized operational services
Shared Services	prod	aws-backup	[email protected]	Backup services

ou-applications & Workload (Applications) Accounts

OU	Environment	Account Alias	Root Email	Description
Applications (ou-applications)	prod	aws-apps-prod	[email protected]	Production workloads
Applications (ou-applications)	non-prod	aws-apps-nonprod	[email protected]	Pre-production workloads (SIT, and UAT)
Applications (ou-applications)	sandbox	aws-sandbox	[email protected]	Dev/Test workloads (Development, QA, Test)

ou-exceptions & Exceptions Accounts

OU	Environment	Account Alias	Root Email	Description
Exceptions	prod	aws-exception	[email protected]	Accounts requiring policy exceptions

Email Address Convention Using Subaddressing

The recommended approach for email addresses leverages RFC-5233 (subaddressing, plus addressing), facilitating easy management of email addresses without creating multiple mailboxes:

Account Alias	Recommended Root Email (subaddressed)	Email Example	Description
aws-admin	[email protected]	[email protected]	`management account` Central identity and access management account
aws-log-archive	[email protected]	[email protected]	Centralized logs account (CloudTrail, Config logs)
aws-audit	[email protected]	[email protected]	Security tools management (GuardDuty, Security Hub)
aws-backup	[email protected]	[email protected]	Backup services account
aws-shared-services	[email protected]	[email protected]	Central network management (Transit Gateway), File/Print Servers
aws-centralized-ops	[email protected]	[email protected]	Central operations management account
aws-apps-prod	[email protected]	[email protected]	Production applications account
aws-apps-nonprod	[email protected]	[email protected]	Non-production applications account
aws-sandbox	[email protected]	[email protected]	Sandbox environment
aws-exception	[email protected]	[email protected]	Account requiring security policy exceptions

Service Control Policies (SCPs) & Permission Sets¶

Recommended SCP

  * [x] Deny_IAM_UserCreation: attached directly on all of the child OU, except `ou-exceptions`
  * [ ] DenyAllEC2Actions
  * [ ] DenyLaunchVeryLargeEc2InstanceTypes
  * [x] DenyLaunchVeryLargeEc2InstanceTypes_DenyGlueService: attached by ^^AttachDefaultSCPs^^ Lambda
  * [ ] DenyGlueService
  * [ ] DenyNetworkResourceCreation
  * [x] DenyNetworkResourceCreationExemptSRE: attached by ^^AttachDefaultSCPs^^ Lambda, for security and simplicity purpose - to prevent the creation of a `VPC` without an attached `TGW` (AWS Transit Gateway)
  * [x] DenyNonSydneyRegionalResources: attached by ^^AttachDefaultSCPs^^ Lambda, for billing purpose
  * [x] DenyLaunchInstanceWithoutMandatoryTags: attached by ^^AttachDefaultSCPs^^ Lambda, SRE patch-group for batching automation using `SSM`; also for Instance-Scheduler in [Cloud Custodian (c7n) open-source](https://github.com/cloud-custodian/cloud-custodian).
  * [ ] DenyAssumeRoleToManagementAccount
  * [ ] AI_opt-out_policy
  * [ ] Billing Tag Policy
  * [ ] FullAWSAccess

Runbooks: AttachDefaultSCPs.py Lambda

AccountCreationResultMonitor-tf EventBridge

EventBridge >> Environment variables:
- Key: SCP_LIST
- Value: DenyLaunchVeryLargeEc2InstanceTypes_DenyGlueService, DenyNetworkResourceCreationExemptSRE, DenyNonSydneyRegionalResources, DenyLaunchInstanceWithoutMandatoryTags
EventBridge >> Event pattern:

{
  "detail": {
    "eventName": ["CreateAccountResult"],
    "eventSource": ["organizations.amazonaws.com"]
  },
  "detail-type": ["AWS Service Event via CloudTrail"],
  "source": ["aws.organizations"]
}

Permission Sets¶

Our access to the cloud is exclusively through AWS SSO, which has been integrated with Okta.
So, a group should exist in Okta, the user should be a member of that group, and that group should be attached to the required permission set (with appropriate roles).

CloudOps-Admin: Only the Cloud Team should be granted this access AT ANY COST!
power-user: Can be granted to someone with the approval of the account owner.
admin-user: Can be granted to someone with the approval of the account owner.
ReadOnlyAccess: Can be granted to someone with the approval of the account owner.

Centralized EC2 Images¶

  ├───centralized-images
      ├───amzn-2
      ├───amzn-2023
      ├───rhel-8.10
      ├───rhel-9.2
      ├───ubuntu-20.04
      ├───win-2019
      └───win-2022