Establishing a data perimeter on AWS
summary
Capital One claims a working “data perimeter” that uses VPC endpoint policies plus service control policies with condition keys (PrincipalOrgID, ResourceOrgID, SourceIp/SourceVpc, ViaAWSService) to stop credential exfiltration; IAM Dsv2 and token restrictions add defense in depth. Implementation hits practical limits: per-service exceptions, maintaining VPC lists, and an org SCP limit (1,000 then 2,000) across thousands of accounts (3,000+). Glue takes ~two years to integrate; afterwards new services go from multi-quarter approvals to enablement in weeks inside a dedicated data perimeter OU.
AI-written summary · about
chapters (7)
- 0:00Introduction and welcome
- 1:08What is a data perimeter?
- 19:19Implementing data perimeter controls
- 23:58Capital One’s journey part 1
- 38:22Capital One’s journey part 2
- 50:49Takeaways and future plans
- 53:46Closing and Q&A
related talks
38mEstablishing a Data Perimeter on AWS
57mEstablishing a data perimeter on AWS
58mCreate enterprise-wide preventive guardrails
53mAchieving End-to-end Security on AWS
01h 02mWhy IAM is the new perimeter, and how to govern it
44mGuardrails in the Cloud
44mAchieve your identity, security, and compliance goals on
34mSecurity best practices for End User Computing Services