Architecting Security & Governance across Your AWS Landing Zone - SEC301 - Anaheim AWS Summit

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Architecting security and governance
across your AWS Landing Zone
Leo Zhadanovsky
Principal Solutions Architect
AWS
S E C 3 0 1

Agenda
An enterprise-ready Landing Zone framework
BP’s Landing Zone journey
Action plan and checklist

Last year

Once upon a time… (continued)
0
10
20
30
40
50
60
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Sales
Red Riding
Hood

Old-world IT
Bob – IT/security guy Developers

Old-world IT: Scale
More Bobs More developers

The cloud will make this easier!
Same Bobs More developers!

One account, isolation with AWS Identity and Access
Management (IAM) and Amazon Virtual Private Cloud
(Amazon VPC)
“Gray” boundaries
Complicated and messy over time
Difficult to track resources
People stepping on one another
Everything

Separate developer account
Still can’t track resources or spend
Still have isolation and blast-radius concerns
Developers still stepping on one another
Bob now has to manage IAM and VPCs, here, too
Dev Production

The problem
On-premises posture for the cloud
Inheriting ideas from datacenter days
Management and Ops don’t trust Dev with full access
Developers want to work—Really!
DevOps is a great idea
Doesn’t work when Ops is in the way

A new solution—we need:
Access to AWS services without barriers
Ability to fail fast without collateral damage
Smaller blast radius
Operations team → Cloud architects
Everyone able to influence digital transformation
Costs and resources tracked to individuals and teams
Optimize code for AWS

Where do I start? Developer accounts
DeveloperDeveloper DeveloperDeveloper DeveloperDeveloperDeveloper DeveloperDeveloper Developer
DeveloperDeveloper DeveloperDeveloper DeveloperDeveloperDeveloper DeveloperDeveloper Developer DeveloperDeveloper DeveloperDeveloper DeveloperDeveloperDeveloper DeveloperDeveloper Developer

Where Do I Start? Team accounts
Team/Group Team/Group Team/Group Team/Group Team/Group

Where Do I Start? Ops accounts
Production Staging Dev/UAT

Where do I start? Shared services
Core/Shared

What are core shared accounts?
Security
Shared services Log archive
Network
Core/Shared

Shared by tier
Core/Shared
Team Shared
Dev Shared

Shared by tier
Core/Shared
Team
Core/Shared
Dev
Core/Shared

A different approach
Team Dev Team Dev Team Dev Team Dev Team Dev
Core/Shared
Team
Core/Shared
Dev
Core/Shared
Team Stg Team Stg Team Stg Team Stg Team Stg
Team Prod Team Prod Team Prod Team Prod Team ProdProduction
Dev/UAT
Staging
Production
Core/Shared
Staging
Core/Shared

Your own additions
Team Dev Team Dev Team Dev Team Dev Team Dev
Team Stg Team Stg Team Stg Team Stg Team Stg
Team Prod Team Prod Team Prod Team Prod Team ProdProduction
Dev/UAT
Staging
PersonalPersonal PersonalPersonal PersonalPersonalPersonal PersonalPersonal Personal
PersonalPersonal PersonalPersonal PersonalPersonalPersonal PersonalPersonal Personal
Personal
Shared
Dev
Core/Shared
Staging
Core/Shared
Production
Core/Shared

AWS account
Security/Resource
Boundary
API
Limits/Throttling
Billing Separation

Why one account isn’t enough
Billing
Many teams
Security/compliance
controls
Business process
Isolation

Goals
Guardrails NOT Blockers Auditable Flexible
Automated Scalable Self-service

Account security considerations
Baseline requirements
Lock
Enable
Define
Federate
Establish
Identify

What accounts should I create?
Security Shared services Billing
Dev ProductionSandbox OtherPreproduction
Organizations account
Log archive Network

AWS Organizations Master
Network path
Datacenter
No connection to datacenter
Service control policies
Consolidated billing
Volume discount
Minimal resources
Limited access
Restrict Orgs role!

SCP: Stop CloudTrail from being disabled
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": ”cloudtrail:StopLogging",
"Resource": "*"
}
]
}

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
SCP: No internet gateway for Amazon VPC
"Statement": [
{
"Effect": "Deny",
"Action": [
"ec2:AttachInternetGateway”,
“ec2:CreateInternetGateway”,
“ec2:AttachEgressOnlyInternetGateway”,
“ec2:CreateVpcPeeringConnection”,
“ec2:AcceptVpcPeeringConnection"
],
"Resource": "*"
}
]

Core accounts
Core accounts
Network path
Datacenter
Foundational
Building blocks
Once per organization
Have their own development
life cycle (Dev/QA/Prod)

Log archive account
Core accounts
Log archive
Network path
Datacenter
Versioned Amazon S3 bucket
Restricted
MFA delete
CloudTrail logs
Security logs
Single source of truth
Alarm on user login
Limited access

Security account
Core accounts
Log archive
Network path
Datacenter
Optional datacenter
connectivity
Security tools and audit
GuardDuty Master
Cross-account read/write
Automated Tooling
Limited access
Security

Shared services account
Security
Core accounts
Log archive
Network path
Datacenter
Connected to datacenter
DNS
LDAP/Active Directory
Shared Services VPC
Deployment tools
Golden AMI
Pipeline
Scanning infrastructure
Inactive instances
Improper tags
Snapshot life cycle
Monitoring
Limited access
Shared
services

Network account
Security
Core accounts
Shared
services
Log archive
Network path
Datacenter
Managed by network
team
Networking services
AWS Direct Connect
Limited access
Network

Developer sandbox
Security
Core accounts
Shared
services
Network
Log archive
Network path
No connection to
datacenter
Innovation space
Fixed spending limit
Autonomous
Experimentation
Developer
sandbox
Developer accounts

Team/group accounts
Developer
sandbox
Security
Core accounts
Shared
services
Network
Log archive
Network path
Developer accounts Datacenter
Based on level of needed
isolation
Match your development
life cycle
Think small
Team/Group accounts

Dev
Developer
sandbox
Team/Group accounts
Security
Core accounts
Shared
services
Network
Log archive
Network path
Develop and iterate
quickly
Collaboration space
Stage of SDLCDev

Preproduction
Developer
sandbox
Dev
Team/Group accounts
Security
Core accounts
Shared
services
Network
Log archive
Network path
Production-like
Staging
Testing
Automated deployment
Preproduction

Production
Developer
sandbox
Dev Preproduction
Team/Group accounts
Security
Core accounts
Shared
services
Network
Log archive
Network path
Production applications
Promoted from
preproduction
Limited access
Automated deployments
Production

Team shared services
Developer
sandbox
Dev Preproduction
Team/Group accounts
Security
Core accounts
Shared
services
Network
Log archive Production
Network path
Grows organically
Shared to the team
Product-specific common
services
Data lake
Common tooling
Common services
Team shared
services

Innovation pipeline
Developer
accounts
Developer accounts
PoC
Developer
accounts
Developer accounts
Dev
Preproduction
Team/Group accounts
Production
Shared
services
PoC
New initiatives
Experimentation
Innovation

Special/exception
Be flexible
Regulatory/compliance
Additional isolation/security controls (PCI)

Multi-account approach
Developer
sandbox
Dev Preproduction
Team/Group accounts
Security
Core accounts
Shared
services
Network
Team shared
services
Network path
Orgs: Account management
Log Archive: Security logs
Security: Security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: Direct Connect
Dev Sandbox: Experiments, learning
Dev: Development
Preproduction: Staging
Production: Production
Team SS: Team shared services, data lake

Team: Billing tools
Developer
sandbox
Dev Preproduction
Billing Tools Team accounts
Security
Core accounts
Shared
services
Network
Network path
Reduces access to
Organizations account
Billing reports
Usage metrics and reporting
Usage optimizations and RI
management

Team: Internal audit
Developer
sandbox
Dev Preproduction
Internal Audit Team accounts
Security
Core accounts
Shared
services
Network
Network path
Regulatory compliance
Read-only access to needed
logs
Limited access
ENT315: Automate and Audit
Cloud Governance and
Compliance in your Landing
Zone

Team: Amazing new product
Developer
sandbox
Dev Preproduction
Amazing New Product Team accounts
Security
Core accounts
Shared
services
Network
Network path
Match your development
life cycle
Think small

Multi-account approach
Developer
sandbox
Dev Preproduction
Team/Group accounts
Security
Core accounts
AWS Organizations
Shared
services
Network
Team shared
services
Network path
Orgs: Account management
Log archive: Security logs
Security: Security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: Direct connect
Dev sandbox: Experiments, learning
Dev: Development
Preproduction: Staging
Production: Production
Team SS: Team shared services, data lake

QA/Staging for the Landing Zone
Developer
sandbox
Dev Preproduction
Team/Group accounts
Security
Core accounts
Shared
services
Network
Team shared
services
Network path
Test Landing Zone changes
Another Landing Zone

Forensics
Developer
sandbox
Dev Preproduction
Team/Group accounts
Security
Core accounts
Shared
services
Network
Team shared
services
Network path
Isolated forensics area
Nearly invisible
Landing Zone with a twist

Next steps
Define tagging strategy
Define automation strategy
Create Organizations Master account
Create log archive account
Create security account
Create shared services account
Create developer sandbox account(s)

Action plan
• Create temporary Amazon S3 bucket for CloudTrail logs
• Enable CloudTrail locally
• Enable organizations full feature
Create log archive account
• Create bucket(s) for security logs (CloudTrail, AWS Config)
• Enable MFA delete
• Enable versioning
• Define limited access bucket policy
• Add SCP to prevent Amazon S3:delete
• Backfill: Enable CloudTrail in organizations master account
to send logs to log archive account
• Backfill: Copy CloudTrail logs for actions that happened
between Organizations Master creation and log archive
Create security account
• Backfill: Cross-account roles with trust to security account for
organizations master and log archive
• Read-only role
• Read/write role (fewer permissions for assumption)
• <CommonCheckList>
• Create security tooling/Lambda functions for security checks
Create shared services account
• Connect via DX/VPN to datacenter
• Launch common services
• Directory services
• Limit monitoring
Create AWS Network account
• Order your Direct Connect

Common checklist
• Secure Root credentials
MFA
• OTP
• U2F could make this easier for managing them
• https://aws.amazon.com/blogs/security/how-to-
create-and-manage-users-within-aws-sso/
• Complex password
• Establish rotation policy
• Link to Organizations Master account if not already a
member
• Use group email/phone as the contact info
• Enable CloudTrail in all regions, send to log archive
account
• Enable GuardDuty in all regions.
• Security account as GuardDuty master
• Operationalize the findings
• Enable AWS Config, send to log archive account
• Enable appropriate AWS Config rules
• Amazon S3 bucket encryptions
• Amazon S3 world read/write
• Amazon EBS encryption, etc...
• Create read-only cross-account security role
• Create read/write cross-account security role
• Create VPC (non-overlapping IP space)
• Enable federation into account
• http://federationworkshopreinvent2016.s3-website-us-
east-1.amazonaws.com/
• Define roles and access policies
• Peer/Privatelink VPC with Shared Services
• Add a policy for prefix naming conditions to every
account—For example, deny access to Lambda functions
that start with “security*”
• Review CIS Foundations Benchmark and leverage as
appropriate

The AWS Landing Zone solution
An easy-to-deploy solution that automates the setup
of new AWS multi-account environments
Based on AWS best
practices and
recommendations
Initial security
and governance controls
Baseline accounts
and account
vending machine
Automated
deployment

AWS Landing Zone structure: Basic
AWS Organizations
Shared Services Log Archive Security
Organizations Account
• Account provisioning
• Account access (SSO)
Shared services account
• Active Directory
• Log analytics
Log archive
• Security logs
Security account
• Audit/Break-glass
Parameter
store

Account vending machine
AWS
service catalog
Account vending machine (AWS service catalog)
• Account creation factory
• User Interface to create new accounts
• Account baseline versioning
• Launch constraints
Creates/updates AWS account
Apply account baseline stack sets
Create network baseline
Apply account security control policy
Account vending
machine
AWS
Organizations
Security
AWS
Log archive
AWS
Shared services
AWS
AWS
New AWS

Next steps
Define tagging strategy
Define automation strategy
Create Log Archive account
Create Security account
Create Shared Services account
Create developer sandbox account(s)

Action Plan
• Create temporary Amazon S3 bucket for CloudTrail logs
• Enable CloudTrail locally
• Enable organizations full feature
Create Log Archive account
• Create bucket(s) for security logs (CloudTrail, AWS Config)
• Enable MFA delete
• Enable versioning
• Define limited access bucket policy
• Add SCP to prevent Amazon S3:delete
• Backfill: Enable CloudTrail in organizations master account
to send logs to log archive account
• Backfill: Copy CloudTrail logs for actions that happened
between Organizations Master creation and log archive
Create Security account
• Backfill: cross-account roles with trust to security account for
organizations master and log archive
• Read-only role
• Read/Write role (fewer permissions for assumption)
• Create security tooling/Lambda functions for security checks
Create Shared Services account
• Connect via DX/VPN to datacenter
• Launch common services
• Directory services
• Limit monitoring
Create AWS Network account
• Order your Direct Connect

Common Checklist
• Secure root credentials
MFA
• OTP
• U2F could make this easier for managing them
• https://aws.amazon.com/blogs/security/how-to-
create-and-manage-users-within-aws-sso/
• Complex password
• Establish rotation policy
• Link to Organizations Master account if not already a
member
• Use group email/phone as the contact info
• Enable CloudTrail in all regions, send to Log Archive
account
• Enable GuardDuty in all regions.
• Security Account as GuardDuty master
• Operationalize the findings
• Enable AWS Config, send to log archive account
• Enable appropriate AWS Config rules
• Amazon S3 bucket encryptions
• Amazon S3 world read/write
• Amazon EBS encryption etc...
• Create read-only cross-account Security role
• Create read/write cross-account Security role
• Create VPC (non-overlapping IP space)
• Enable federation into account
• http://federationworkshopreinvent2016.s3-website-us-
east-1.amazonaws.com/
• Define roles and access policies
• Peer/Privatelink VPC with shared services
• Add a policy for prefix naming conditions to every
account—For example, deny access to Lambda functions
that start with “security*”
• Review CIS Foundations Benchmark and leverage as
appropriate

Putting it all together
Policy
enforcement
AWS Landing
Zone
Policy
deployment
Notification Remediation
Account metadata: Owner, Function,
Policies, BU, SDLC, Cost Center, etc.
Prod
• Encrypt EBS
• No IGW
• Guardrail “x”
QA
• Encrypt EBS
• Guardrail “x”
• Guardrail “y”
Policy “p”
• Encrypt EBS
• No IGW
• Guardrail “y”

AWS Control Tower
Set up and govern a secured, compliant, multi-account AWS environment

Introducing AWS Control Tower (preview)
Consistentandsimplemulti-account management
Automated AWS setup
Launch an automated
Landing Zone with best-
practices blueprints
Policy enforcement
Prepackaged guardrails to
enforce policies or detect
violations
Dashboard for oversight
Continuous visibility into
workload compliance with
controls

Key Features and Benefits
Account Setup
Automated, secure, and scalable
Landing Zone
Multi-account management using
AWS Organizations
Central logging and multi-account
configuration consistency
Built-in best practices
Multi-account preventive and
detective guardrails
Easy to use dashboard and
notifications
Curated rules in plain EnglishAccount provisioning wizard
Guardrails
Landing
Zone

Thank you!
Leo Zhadanovsky
@leozh

Architecting Security & Governance across Your AWS Landing Zone - SEC301 - Anaheim AWS Summit

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Architecting Security & Governance across Your AWS Landing Zone - SEC301 - Anaheim AWS Summit

Semelhante a Architecting Security & Governance across Your AWS Landing Zone - SEC301 - Anaheim AWS Summit (20)

Mais de Amazon Web Services

Mais de Amazon Web Services (20)

Architecting Security & Governance across Your AWS Landing Zone - SEC301 - Anaheim AWS Summit