Patterns to securely manage your AWS services with Meta
summary
Meta runs AWS for roughly four billion users using AWS Organizations with OUs like Staging, Main, Prod, Dev, Sandbox (two-week accounts), DMZ for root, Suspended, and Lockdown; enforcement uses dynamic per-account SCPs generated from requested services and privacy approvals, a Cloud CLI wrapping Terraform to force IaC, and CloudTrail analysis to onboard acquired accounts automatically. Detection uses GuardDuty, Config, CloudTrail and Health events to trigger an automatic Lockdown OU with network NACL cuts that severs APIs and networking so incident response can investigate.
AI-written summary · about
chapters (4)
- 0:00Introduction and overview
- 1:02AWS account organization
- 4:44Static and dynamic policies
- 8:02Incident response and tooling
related talks
55mBest practices
28mStay in Control While Moving Fast
33mMetabadger: Automating IMDS Protection at Scale in AWS
58mCreate enterprise-wide preventive guardrails
34mLayering AWS security services to automate incident response
44mGuardrails in the Cloud
27mIntroduction to AWS Security
49mCloud operations: A catalyst for innovation