Governança em escala é um conceito cada vez mais importante para os clientes à medida que eles adotam a nuvem AWS. A governança baseia-se na distribuição de cargas de trabalho em contas separadas e no uso de boas práticas de segurança de acordo com as necessidades dos clientes. Esta sessão abordará como usar dezenas ou até centenas de contas para criar um isolamento entre as cargas de trabalho, com base em padrões de implementação e considerando controle de custos. Palestrante: MV Ferreira

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Mv – Marcus Vinicius Ferreira, Sr. SA, Public Sector
Governance@Scale
Governança em Escala: Implementando Governança com AWS

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Mv (mvferr@amazon.com)
Marcus Vinicius Ferreira
Sr. SA, Public Sector, Education
Mv

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Como AWS pode colaborar para uma
maior governança e
melhor segurança e ainda
garantindo inovação em escala?
Desafio

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serviços fundamentais: core capabilities
Estratégia: classificando workloads
Estratégia: gerenciamento de identidades
Estratégia: separando por custo
Best Practice: AWS Landing Zone
Conclusão
Conteúdo

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serviços Fundamentais: core capabilities
Estratégia: classificando workloads
Estratégia: gerenciamento de identidades
Estratégia: separando por custo
Best Practice: AWS Landing Zone
Conclusão
Conteúdo

6. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS: segurança: serviços
Virtual Private Cloud
Isolated cloud resources
Web Application
Firewall
Filter Malicious Web Traffic
Shield
DDoS protection
Certificate Manager
Provision, manage, and
deploy SSL/TSL
certificates
Key Management
Service
Manage creation and
control of encryption keys
CloudHSM
Hardware-based key
storage
Server-Side Encryption
Flexible data encryption
options
IAM
Manage user access and
encryption keys
SAML Federation
SAML 2.0 support to allow
on-prem identity
integration
Directory Service
Host and manage
Microsoft Active Directory
Organizations
Manage settings for
multiple accounts
Service Catalog
Create and use
standardized products
Config
Track resource inventory
and changes
CloudTrail
Track user activity and API
usage
CloudWatch
Monitor resources and
applications
Inspector
Analyze application
security
Artifact
Self-service for AWS’
compliance reports
Networking Encryption Identity & Management Compliance

7. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS: segurança: recursos
AWS CloudFormation
Amazon
CloudWatch
AWS Config
Config
Rules
AWS CloudTrail
CloudWatch
Events
Manual configuration
Root MFA
Alternate contacts
IAM
Managed
Policies
Roles
Security questions
Amazon
VPC
VPC peering
Flow logs
Amazon
Inspector
Amazon
Systems
Manager

8. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serviços Fundamentais: core capabilities
Estratégia: classificando workloads
Estratégia: gerenciamento de identidades
Estratégia: separando por custo
Best Practice: AWS Landing Zone
Conclusão
Conteúdo

9. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Confidentiality
Risk of
change
Workloads
Classify workloads based on impact
Higher-impact workloads are
more likely to be in accounts
managed by central or
departmental IT groups and
will have more security
controls.
Lower-impact accounts still
have basic security controls,
but can be issued freely to end
users for test, development, or
low impact research and
production workloads.

10. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Risk of change
Confidentiality
Individual dev/test
Web/digital Critical apps
Sensitive apps
Team dev/test
Low-risk apps
Exploratory research/analytics
Data science dev/test
Classify workloads based on impact

11. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Risk of
change
Confidentiality
Classify workloads based on impact

12. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Confidentiality
Risk of
change
Classify workloads based on impact

13. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Impact levelLESS IMPACT MORE IMPACT
Controls
Controles de seguraça progressivos
Low
Medium
Medium
Medium-High
High

14. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multiple accounts: separation by security risk

15. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Antipattern: Conflating classification and network zone
Push back on:
• Classifications on proximity to the Internet
• Different tiers (app, db) of the same app in
different zones
Advocate for:
• Classification that follows the data
• Different tiers (app, db) of the same app in
same account

16. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serviços Fundamentais: core capabilities
Estratégia: classificando workloads
Estratégia: gerenciamento de identidades
Estratégia: separando por custo
Best Practice: AWS Landing Zone
Conclusão
Conteúdo

17. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AD Services: Identity domains
Directory
services
AWS
IAM
Database
authentication
Application
authentication
Local users

18. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Corporate Data Center
Browser interface
Identity
Store
AD Services: Identity and Access Management
Federation Integration
AD Group
Identity and
authentication
Mapping to specific IAM
role with access policy
Access to AWS
http://docs.aws.amazon.com/directoryservice/latest/admin-guide/manage_apps_services.html

19. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Identities and Access Control
Example user types with corresponding access policies
IAM Master
Create policies
IAM Manager
Assign policies
Audit
read-only
Access Managers
Architect
Create landscapes
Storage
Design and build
Network
Design and buildDesign
DevOps
API Access
App Owner
Landscape owner
Application Owners
Billing Support UserOther
Network Admin
Administrator
Service Catalog
Administrators
Managed policies for job functions:
http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html
Database Admin
IAM Roles
AD Groups

20. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Auth/
LDAP
Auth/
LDAP
DB
RDS for
SQL Server
Availability Zone
Private Subnet
10.0.2.0/24
APPWEB
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
APPWEB
App
Server
IIS
Server
Remote
Users/Admins
Domain
Controllers
Corporate data center
Reference Architecture:
AWS Microsoft AD
DB
RDS
SQL Server
AWS Managed Services
AWS Managed Services
Domain
Controller
DC
Domain
Controller
Trust
Application
Auth/
LDAP
VPN
Direct
Connect
AD
Managed AD
Managed AD

21. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Directory Services
AWS Microsoft AD
Actual Microsoft Active
Directory for AWS
workloads.
Simple AD AD Connector
Stand-alone, AD
compatible directory with
common directory features.
Proxy service for
connecting your on-
premises AD to AWS.
Amazon CognitoAmazon Cloud Directory
Sign-up and sign-in for
web and mobile apps.
Specialized store for
hierarchical data.

22. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Directory Services
AWS Microsoft AD
Actual Microsoft Active
Directory for AWS
workloads.
Simple AD AD Connector
Stand-alone, AD
compatible directory with
common directory features.
Proxy service for
connecting your on-
premises AD to AWS.
Amazon CognitoAmazon Cloud Directory
Sign-up and sign-in for
web and mobile apps.
Specialized store for
hierarchical data.

23. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serviços Fundamentais: core capabilities
Estratégia: classificando workloads
Estratégia: gerenciamento de identidades
Estratégia: separando por custo
Best Practice: AWS Landing Zone
Conclusão
Conteúdo

24. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-Account Strategy: AWS Account per Biz Cap Dev Team
Analytics Team 1 Database Team 7
Infra Team
Capital
Markets UX
Team
New App Dev
Team
DevOpsTeam
Random
Contractor
SecOps
Auditor
Admin

25. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-Account Strategy: AWS Accounts and Cost Centers
Projects
Management
Upper Management
Senior Leadership
Executive CXO
VP
Director
Manager Manager
Director
Manager
VP
Director
Manager Manager
Project 1
Project 2
Project 3 Project 4 Project 5
Project 6
Project 7
$
$
$ $$
$
$
$ $ $
$
$$
$
$
$
$
$

26. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-Account Strategy: AWS Organizations

27. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serviços Fundamentais: core capabilities
Estratégia: classificando workloads
Estratégia: gerenciamento de identidades
Estratégia: separando por custo
Best Practice: AWS Landing Zone
Conclusão
Conteúdo

28. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-Account Strategy: AWS Landing Zone

29. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-Account Strategy: AWS Landing Zone

30. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-Account Strategy: AWS Landing Zone
Analytics Team 1 Database Team 7
Infra Team
Capital
Markets UX
Team
New App Dev
Team
DevOpsTeam
Random
Contractor
SecOps
Auditor
Admin

31. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-Account Strategy: AWS Landing Zone
• Landing Zone
• automação de multiple-accounts
• controle de custos via AWS Organizations
• controles de segurança centralizados: AD, logging, transit-VPC

32. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serviços Fundamentais: core capabilities
Estratégia: classificando workloads
Estratégia: gerenciamento de identidades
Estratégia: separando por custo
Best Practice: AWS Landing Zone
Conclusão

33. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Conclusão: Governança em Scala
• Estratégia: Multiple Accounts
• separação por nível de risco em segurança
• separação por custo, centro de custo, projeto
• gerenciamento de identidades via AD
• Escala
• automação via AWS Landing Zones

34. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Perguntas?

35. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Obrigado!
Mv (mvferr@amazon.com)
Marcus Vinicius Ferreira
Sr. SA, Public Sector, Education