Landing Zones, Organizations, OUs and Multi-Account Environments
Tags: aws, security, organizations
Published: 2021-07-21 16:33:54

## This Post is a notes-summary of AWS Best Practices for:

* Governance, risk, and compliance when establishing your cloud presence ([AWS Blog Page](https://aws.amazon.com/blogs/mt/governance-risk-and-compliance-when-establishing-your-cloud-presence/?blog_multi_account_ct))

* Organizational Units with AWS Organizations ([AWS Blog Page](https://aws.amazon.com/blogs/mt/best-practices-for-organizational-units-with-aws-organizations/))

* Managing the multi-account environment using AWS Organizations and AWS Control Tower ([AWS Blog Page](https://aws.amazon.com/blogs/mt/managing-the-multi-account-environment-using-aws-organizations-and-aws-control-tower/))

---

#PART 1. Best Practices for... Governance, risk, and compliance when establishing your cloud presence
[AWS Blog Page](https://aws.amazon.com/blogs/mt/governance-risk-and-compliance-when-establishing-your-cloud-presence/?blog_multi_account_ct)
* Check the [Management and Governance Lens](https://docs.aws.amazon.com/wellarchitected/latest/management-and-governance-lens/management-and-governance-lens.html?did=wp_card&trk=wp_card) (A Well-Architected Lens extension)
This is built up from years of migrations and best practices learned along the way

##Introducing a Landing Zone
* Separation of concerns get more important and also difficult as companies grow in AWS
* Separate costs for budgets and billing
* Security enforcement, resource isolation

A Landing Zone is a...__Well-architected multi-account AWS environment that is stable and secure__

It is:
* The starting point for your cloud journey
* Built on AWS Organization w/ multiple accounts

##Landing Zone Framework
![Landing Zone Framework](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bbejzqjzumktywesglob.jpg)
###Foundational OUs
__Shared Services__ OU is for things like log archival, networking - Usually the responsibility of central teams
* __Infrastructure__ - Shared IT Services & Networking
* __Security__ - Log Archival, security tools, break-glass / forensics

###Additional OUs
* __Sandbox OU__ to allow developers to have their own accountsa to spike/experiment
* __Workloads OU__ to isolate and tightly control production/app services
* __etc__ - These are a guide, pick which fits the company the best

##Landing Zone Automation
2 Tools to assist here...
* __AWS Control Tower__ - AWS Managed Service to setup and govern multi-account env
** It uses AWS Organizations and a number of other services to automate the orchestration
** Easier option, minimal customisations; Still allows your to centrally manage governance and has preconfigured best practices
* __AWS Organizations__ - Use this directly, high levels of customisation
Personal Note: Check out [org-formation](https://github.com/org-formation/org-formation-cli) or Terraform


---


#PART 2. Best Practices for... Organizational Units with AWS Organizations
[AWS Blog Page](https://aws.amazon.com/blogs/mt/governance-risk-and-compliance-when-establishing-your-cloud-presence/?blog_multi_account_ct)
* Apply SCPs at an OU Level
* __SDLC OUs__ - Think of having SCPs at each stage of the lifecycle of the application
![SDLC OUs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fxw0oqvidpe1n1tsxjw4.jpg)
e.g Different Policies in different Stages/Environments (Dev vs Test)

* __Deployments OU__ - If you have different governance and operational models for CICD compared to accounts in Workloads OU (Prod / SDLC)
** Reduces dependency on shared CI/CD environments
** Pipelines and CICD should match the operational model of the software service it builds and deploys
![Deployments OUs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2t04wjay8lscub15q00x.jpg)

* __Infra OU__ may looks like this:
![Infra OU](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dtqqmh6mvs3ybcecofjh.jpg)

* __Security OU__ for hosting security-related services, should be managed by Security team(s)
![Security OU](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fwc743gn3yczf4zdwygb.jpg)

* __Log Archive__ - Audits

* __ReadOnlyAccess__ - Humans for Read-Only permission, cross-account role from here

* __Breakglass__ - Humans in rare scenarios/security incidents, special authorisation would be required, all access to this logged in detail

* __Tooling__ - MINIMAL Humans, Master Account for Guard Duty, Security Hub and Amazon Detective...Human Access for Admin purposes only, infrequent
** IaC should be heavily used

* __Sandbox OU__ for individuals wanting to play, should limit internet access if possible
** Individuals Accounts created in here e.g ColinWillisAccount

* __Workloads OUs__
![Workloads OUs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sh81vb7d69yw3krfnnud.jpg)

* __Suspended OU__ - Accounts that are to be deleted from the Organisation
** Apply an SCP to deny all actions, add Tags for traceability if they need to be restored
** Accounts are permanent deleted after 90 days

* __Exceptions OU__ - Accounts that warrant exceptions to Security or Auditing conditions
** SCP may be applied directly to the accounts here

Think Top-Secret Project Account; it may have MORE scrutiny than standard accounts

---

#PART 3. Best Practices for... Managing the multi-account environment using AWS Organizations and AWS Control Tower
[AWS Blog Page](https://aws.amazon.com/blogs/mt/managing-the-multi-account-environment-using-aws-organizations-and-aws-control-tower/)

##Permissions Management
* Once Organization is created, enable AWS SSO
* AWS SSO can recognize existing users and groups who need access
* Prebuild in AWS or use External Identity store (like Azure AD or Okta)
* SCP can restrict boundaries e.g Which AZ a user can work in
* [https://docs.aws.amazon.com/controltower/latest/userguide/guardrails.html](Guardrails in Control Tower) is good to reference

** __Preventative guardrails__ are SCPs that limit actions based on your policies.

** __Detection guardrails__ are AWS Config rules paired with AWS Lambda

*** These detect noncompliant resources and alert you through the Control Tower dashboard for remediation

##Security
* AWS offers a feature called Delegated Administration, which allows you to designate an account (such as via Security Tooling Account)
** Use this to then manage the following AWS security and audit services on behalf of the entire organization

```
AWS Audit Manager - automates the continuous collection of evidence to help you audit your use of cloud services.
AWS Config - detects and provides mitigation recommendations for incorrectly configured resources.
Amazon GuardDuty - detects unexpected and potentially unauthorized and malicious activity in your AWS environment.
Amazon Macie - continuously evaluates your content to identify business-critical or potentially confidential data.
AWS Trusted Advisor - identifies opportunities to improve stability, save money, or help close security gaps.
IAM Access Analyzer - helps you identify any resources or data in your AWS environment that are shared with external entities.
AWS Security Hub - provides you with security checks and recommendations across your organization.
```
* Security users can then centrally view and manage security events
* NOTE: You may need to enable certain Security Services at the management/organizational account level

##Account Management
* After initial Organization setup, new or invited Accounts can be assigned to OUs
* Integrated into AWS Organizations, these help you get accounts ready to use:

** __AWS Resource Access Manager__ - Make resources available cross-account e.g EC2 Capacity Reservation, VPC Endpoints

** __AWS CloudFormation StackSets__ - Share Stacks cross account e.g Automatically delete or create resources when an Account joins or leaves the Organization