AWS Initiate - Landing Zone: Como saber se sua base está preparada
•Als PPTX, PDF herunterladen•
0 gefällt mir•287 views
Apresentação utilizada no AWS Initiate Brasília em 17/09/2019
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie AWS Initiate - Landing Zone: Como saber se sua base está preparada
Ähnlich wie AWS Initiate - Landing Zone: Como saber se sua base está preparada (20)
Mehr von Amazon Web Services LATAM
Mehr von Amazon Web Services LATAM (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
AWS Initiate - Landing Zone: Como saber se sua base está preparada
- 1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Landing Zone: Como ter certeza que sua Fundação está preparada Landing Zone: How to Ensure Your Foundation is Ready Mv – Marcus Ferreira, Sr. Solutions Architect
- 2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Mv – Marcus Vinicius Ferreira mvferr@amazon.com Sr. SolutionsArchitect BR, Public Sector, Education Previous: Oracle, Sun, Abril, Dinda, NubankMv
- 3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Session Agenda Defining the Problem Landing Zone Overview Components of a Landing Zone Next Steps
- 4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. What Problem Are We Solving?
- 5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 8. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved. Confidentiality Risk of change Workloads Classify workloads based on impact Higher-impact workloads are more likely to be in accounts managed by central or departmental IT groups and will have more security controls. Lower-impact accounts still have basic security controls, but can be issued freely to end users for test, development, or low impact research and production workloads.
- 9. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved. Risk of change Confidentiality Individual dev/test Web/digital Critical apps Sensitive apps Team dev/test Low-risk apps Exploratory research/analytics Data science dev/test Classify workloads based on impact
- 10. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved. Risk of change Confidentiality Classify workloads based on impact
- 11. © 2018 Amazon Web Services, Inc. or its Affiliates. All rights reserved. Confidentiality Risk of change Classify workloads based on impact
- 12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Control What is it that we need?
- 13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Components of Landing Zone
- 14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Components of Landing Zone
- 15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. What is a Landing Zone? H • AWS best practices • AWS account structure • Patterns based • Standards defined • Adaptable foundation • Governance guardrails • Automation driven • Versioned infrastructure
- 16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Components of Landing Zone
- 17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account Structure Network Design Identity / Access Components of Landing Zone Security / Visibility Shared Services Automation / Change
- 18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account Structure Network Design Identity / Access Components of Landing Zone Security / Visibility Shared Services Automation / Change
- 19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Security/Resource Boundary Limits Billing Separation AWS Account
- 20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. DEV PROD HOMOLOG Initial Account Structure
- 21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Limits Why One Isn’t Enough ManyTeams Isolation Security Controls Business Process Billing
- 22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Organizations Organizational Hierarchy Security Policy Billing Visibility Automation Driven
- 23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. DEV PROD INFOSEC LOG Shared SVC Network Landing Zone Account Structure Organization
- 24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Landing Zone structure - basic Amazon S3 Bucket (manifest file) AWS CodePipeline AWS Service Catalog Account Baseline Core OU AWS SSOAWS Organizations AWS Organizations Account Shared Services Account Log Archive Account Account Baseline Security Account Network Baseline Account Baseline Aggregate CloudTrail and Config Logs Account Baseline Security Cross-Account Roles Security Notifications Organizations Account • Account Provisioning • Account Access (SSO) Shared Services Account • Active Directory • Log Analytics Log Archive • Security Logs Security Account • Audit / Break-glass Amazon GuardDuty Master Parameter store Vended Accounts All other Accounts
- 25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account Structure Network Design Identity / Access Components of Landing Zone Security / Visibility Shared Services Automation / Change
- 26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. IAM Roles Federation IAM Users Managed Policies KMS Keys Job/Function Based, Cross Account Leverage existing Directory, Map Roles Limit Use, Rotate Keys, Securely Stored, MFA AWS Managed to start, Limit Inline policies CMK Per Service Identity & Access Foundation
- 27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Landing Zone structure – with Add-Ons Amazon S3 Bucket (manifest file) AWS CodePipeline AWS Service Catalog Account Baseline Core OU AWS SSOAWS Organizations AWS Organizations Account Shared Services Account Log Archive Account Account Baseline Security Account Network Baseline Account Baseline Aggregate CloudTrail and Config Logs Account Baseline Security Cross-Account Roles Security Notifications Organizations Account • Directory Connector Shared Services Account • Microsoft AD • Centralized Logging Solution Centralized Logging Solution AWS Microsoft AD Directory Connector Amazon GuardDuty Master Parameter store Vended Accounts All other Accounts
- 28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account Structure Network Design Identity / Access Components of Landing Zone Security / Visibility Shared Services Automation / Change
- 29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Multi-AZ Public vs. Private Ingress/ Egress points VPC Design
- 30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. DEV PROD HOMOLOG Accounts and VPCs
- 31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Network Paths
- 32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Multi-account Approach: Landing Zone Developer Sandbox Dev Pre-Prod BU/Product/Resource Accounts Developer Accounts Security Enterprise Accounts AWS Organizations Master Billing Tooling Shared Services Sandbox Direct Connect Internal Audit Data Center Logging Prod Shared Services Orgs: Account management Logging: Centralized logs Security: AWS Config Rules, security tools Shared services: Directory, DNS, limit monitoring Billing Tooling: Cost monitoring Sandbox: Experiments Dev: Development Pre-Prod: Staging Prod: Production
- 33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account Structure Network Design Identity / Access Components of Landing Zone Security / Visibility Shared Services Automation / Change
- 34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Log Analysis Cloudwatch Events Config Rules GuardDuty Config VPC Flow Logs CloudTrail Data Gathering Analysis / Enforcement Access Logs Continuous Compliance
- 35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Landing Zone structure – Log Archive Amazon S3 Bucket (manifest file) AWS CodePipeline AWS Service Catalog Account Baseline Core OU AWS SSOAWS Organizations AWS Organizations Account Shared Services Account Log Archive Account Account Baseline Security Account Network Baseline Account Baseline Aggregate CloudTrail and Config Logs Account Baseline Security Cross-Account Roles Security Notifications Centralized Logging • S3 • ELK: ElasticSearch, Kibana, et al... Centralized Logging Solution AWS Microsoft AD Directory Connector Amazon GuardDuty Master Parameter store Vended Accounts All other Accounts
- 36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account Structure Network Design Identity / Access Components of Landing Zone Security / Visibility Shared Services Automation / Change
- 37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Directory Code RepoMonitoring AMI / EC2 Management Common Shared Services
- 38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Account Structure Network Design Identity / Access Components of Landing Zone Security / Visibility Shared Services Automation / Change
- 39. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudFormation StackSets Automation & Change Management Service Catalog Pipeline
- 40. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Service Catalog Provides Governance We can be thought of as a “launch plane” onto AWS ADMINISTRATION Provisioned products Product Permissions Constraints Users/groups Portfolios CF Templates/productsTagOptions ConstraintsAccounts Cloud Formation Resource launch END-USER
- 41. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. DevOps: What is AWS CloudFormation? Declarative programming language for deploying AWS resources. Uses templates and stacks to provision resources. Create, update, and delete a set of resources as a single unit (stack). Create/delete AWS CloudFormation Create/delete AWS resources Template Stack - Basic definition of resources to create - JSON text file - Collection of AWS resources
- 42. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Service Catalog Cycle Catalog Instance Pay for UsageSoftware + Gold AMI Customer
- 43. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Brand Your Console lets companies insert their own colors and brands into the AWS Service Catalog console D E FA U LT E X P E R I E N C E B R A N D E D E X P E R I E N C E AWSServiceCatalog BrandYourConsole 43
- 44. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Next Steps • YouTube: https://www.youtube.com/watch?v=IF-0WFBw2g8 • Engage with your AWS Account Team • Leverage the APN • Check out new the AWS Landing Zone solution • https://aws.amazon.com/answers/aws-landing-zone/
- 45. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Multi-Account Strategy: AWS Landing Zone
- 46. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Multi-Account Strategy: AWS Landing Zone
- 47. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Perguntas?
- 48. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. mvferr@amazon.com Obrigado!
Hinweis der Redaktion
- https://www.istockphoto.com/photo/traffic-lights-gm671167014-122997487
- https://www.istockphoto.com/photo/eggs-gm145831917-5551969 Inconsistency starts to rear its head. Different groups are doing things differently
- Resulting in a big ball of Spaghetti.
- What you are lacking is the feeling of Control. We don’t want to be in the way of making progress, but we have to be in Control of what is being deployed. The Concept of a Landing Zone does just that.
- Landing Zones are a culmination of AWS Best practices that have been identified over the years in our work with customers. Identify and define the Patterns and Standards that you want to build to. This will drive consistency as well as help you to define the Preventative and Corresponding Detective/Responsive controls you have in place for your Organization's Security & Compliance Directives. Defining and building your Governance posture into your infrastructure allows you to strike the balance of Speed/Agilty/Autonomy but with the must have Guardrails in place. When you provision a new account, VPC, application, what are your must haves? This will change over time, so incorporate those lessons learned into your evolving baseline. Treating your infrastructure and associate baseline as version code allows you to consistently maintain your quality and governance standards. Adopting Automation into your Change/Configuration methods is critical. AWS provides some powerful capabilities in this area, but yours may work just fine as well.
- Core Accounts Organizations Master account: AWS Organizations enabled with governance over three additional Core Accounts - Security, Shared Services, Logging. Security account: The Security account creates auditor (read-only) and administrator (full-access) cross-account roles from a Security account to all AWS Landing Zone managed accounts. The intent of these roles is to be used by security and compliance team operational tooling to audit (such as hosting custom AWS Config Rule lambda functions) or perform automated security operations (such as perform automated remediation actions). As a result, we strongly recommend that this account be restricted to authorized security and compliance personnel, and their related security or audit tools. Shared services account: a core shared services account will be created for hosting landing zone infrastructure dependencies. Log archive account: a dedicated account for securely storing logs for archiving and forensic activities Service Catalog enabled as 'Account Vending Machine' with a Minimally Secured Account product already configured and ready to deploy Account Security AWS CloudTrail with remote trail logging to the an S3 bucket in the central logging account AWS Config and configuring configuration logging to an S3 bucket in the central logging account Provision security account audit and administrative access (Admin and Read Only roles in Security account and execution roles in all other accounts) Configure account security SNS notifications Amazon GuardDuty Master to view and manage Amazon GuardDuty findings from security and their member accounts Network Security Deletes the default VPC in all regions Logging Centralized location for log storage Data Security Enables Config Rules for monitoring EBS volume encryption
- Organizations Account: Option for Directory Connector Add-On Amazon Elasticsearch Service integration Kibana-based log reporting and analysis AWS CloudTrail Amazon VPC Flow Logs Amazon CloudWatch Logs (Apache web server, Common Log Format, Space Delimited, JSON Account Security Option for Microsoft AD Add-On Option for Centralized Logging Add-On
- That icon is stacksets
- Organizations Account: Option for Directory Connector Add-On Amazon Elasticsearch Service integration Kibana-based log reporting and analysis AWS CloudTrail Amazon VPC Flow Logs Amazon CloudWatch Logs (Apache web server, Common Log Format, Space Delimited, JSON Account Security Option for Microsoft AD Add-On Option for Centralized Logging Add-On
- AWS CloudFormation enables you to create and provision AWS infrastructure deployments in a predictable, repeatable, and automated fashion. You can create templates for the service or application architectures you want and then have AWS CloudFormation use those templates for quick and reliable provisioning of the services or applications (called “stacks”). When you use AWS CloudFormation, you work with templates and stacks. An AWS CloudFormation template is a JSON text file used to describe the AWS resources and their properties in your infrastructure. For example, in a template, you can describe an Amazon EC2 instance, such as the instance type, the AMI ID, block device mappings, and its Amazon EC2 key pair name. You use these templates to create a stack. A stack is a collection of AWS resources that has been created from a template. You may provision (create) a stack numerous times. When a stack is provisioned, the AWS resources specified by its template are created. Any AWS usage changes incurred from using these services will start accruing as they are created as part of the AWS CloudFormation stack. When a stack is deleted, the resources associated with the stack are deleted. The order of deletion is determined by AWS CloudFormation; you do not have direct control over what gets deleted when.
- Private Image Build enables customers to build and run private custom Amazon Machine Images (AMIs) that combine their “gold images” with installable packages provided by AWS Marketplace software vendors. This helps customers comply with their own specific IT policies and server hardening requirements while still taking advantage of all the conveniences of AWS Marketplace, including consolidated AWS billing, AWS Marketplace pricing and licensing models, and rapid, automated deployment