Professional Documents
Culture Documents
Pravin Menghani
Challenges
• Complex process in setting up multiple accounts
• Need of understanding multiple services
• Applying similar security practises across multiple
accounts
• Implementing same RBAC structure across
accounts
• Setting up multiple AWS Accounts and user
accounts, their accesses
• Setting up multiple VPC across multiple accounts
• Following AWS Best Practises
AWS Landing zone
• AWS Landing Zone is a solution that helps
customers more quickly set up a secure, multi-
account AWS environment based on AWS best
practices.
Promises that AWS Landing zone can
fulfill
• Automated AWS multi-account setup
• Basic security guidelines
• Codified best practices (including updates directly from
AWS); for example, automated CloudTrail setup and
VPC/network design
• DevOps best practices: Infrastructure-as-Code with the use
of codified templates and continuous delivery, whereby
your own extensions can be rolled out globally.
• High adaptability owing to the use of templates
• Modularity
• Single Sign-On and central management of access rights
(optional)
Multi-Account structure
Multi-Account structure
• AWS Organizations Account
• The AWS Landing Zone is deployed into an AWS
Organizations account. This account is used to manage
configuration and access to AWS Landing Zone
managed accounts. The AWS Organizations account
provides the ability to create and financially manage
member accounts. It contains the AWS Landing Zone
configuration Amazon Simple Storage Service (Amazon
S3) bucket and pipeline, account configuration
StackSets, AWS Organizations Service Control
Policies (SCPS), and AWS Single Sign-On (SSO)
configuration.
Shared Services Account
• The Shared Services account is a reference for
creating infrastructure shared services such as
directory services. By default, this account
hosts AWS Managed Active Directory for AWS
SSO integration in a shared Amazon Virtual
Private Cloud (Amazon VPC) that can be
automatically peered with new AWS accounts
created with the Account Vending Machine
(AVM).
Logging Account