Best practices for cloud governance at scale
summary
Practical guidance for bootstrapping multi-account AWS governance: use accounts as security boundaries and group them into OUs, enforce least privilege with IAM Identity Center and MFA, and automate provisioning (Account Factory) so FactSet ships projects five times faster and Symetra cuts account provisioning to under 30 minutes. Manage controls as policy-as-code (CloudFormation Guard, OPA), map controls to frameworks, run proactive CloudFormation hooks to block unencrypted/public S3, and continuously test and monitor with AWS Config, CloudTrail Lake, Control Tower and Service Catalog.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:38What customers have asked us
- 4:19When do you need cloud governance?
- 8:15Bringing cultural and organizational change
- 10:31What our customers have told us about building cloud environments
- 12:39Use accounts as building blocks
- 13:53Recommended OU structure
- 16:37Centralized logging in multi-account environments
- 18:35Scaling through automated account provisioning
- 20:53Managing access permissions to AWS accounts
- 22:49Identity provider for multi-account environments
- 23:20AWS Control Tower architecture
- 24:16Partner ecosystem
- 24:48Key takeaways
- 30:15Use policy-as-code and enforce peer review
- 32:16Align control objectives to a security framework
- 35:09Protect security baselines and stop cloud risks
- 36:20Continuously monitor and test security controls
- 50:31Common governance pain points for developers
- 52:03Governance over your infrastructure as code (laC)
- 53:57Infrastructure as code options
- 54:36Your code platform
related talks
59mBeyond the scripts: Governance automation master class
40mCreating a managed, governed, and secure SaaS foundation on
32mBuilding an Enterprise Grade Multi Account AWS Environment
21mSecuring hundreds of AWS accounts for streamlined governance
44mAchieve your identity, security, and compliance goals on
27mIntroduction to AWS Security
28mStay in Control While Moving Fast
44mGuardrails in the Cloud