Automating Multi-Account Governance and Security

This guide covers the strategies and AWS services required to automate the creation, onboarding, and securing of AWS accounts at scale, specifically focusing on AWS Control Tower, AWS Organizations, and centralized governance tools.

Learning Objectives

After studying this guide, you should be able to:

• Standardize account provisioning using AWS Control Tower and Account Factory.
• Implement centralized governance using Service Control Policies (SCPs) within AWS Organizations.
• Configure multi-account, multi-Region data aggregation using AWS Config.
• Deploy baseline security resources across an entire organization using CloudFormation StackSets.

Key Terms & Glossary

• Landing Zone: A well-architected, multi-account AWS environment that is a starting point from which you can deploy workloads and applications.
• Guardrails: High-level rules for ongoing governance of your AWS environment. They can be Preventive (block actions) or Detective (alert on non-compliance).
• Account Factory: A component of AWS Control Tower that automates the provisioning of new accounts with pre-approved configurations.
• Aggregator: An AWS Config resource type that collects configuration and compliance data from multiple accounts and Regions into a single account.
• SCP (Service Control Policy): A type of organization policy used to manage permissions in your organization, offering central control over the maximum available permissions for all accounts.

The "Big Idea"

In a modern enterprise, managing AWS accounts manually is a security risk and an operational bottleneck. The "Big Idea" is to treat Accounts as Code. By using AWS Control Tower to orchestrate AWS Organizations, you create a repeatable, automated "factory" that ensures every new account is born with the same security DNA—including logging, VPC structures, and permission boundaries—regardless of which Region it resides in.

Formula / Concept Box

Hierarchical Outline

1. Centralized Management Foundations
   • AWS Organizations: The underlying layer for account grouping (OUs) and billing.
   • Organizational Units (OUs): Logical groupings of accounts (e.g., Prod, SDLC, Security) to apply specific policies.
2. AWS Control Tower Orchestration
   • Landing Zone Setup: Automates multi-account structure, identity (IAM Identity Center), and logging (S3/CloudWatch).
   • Guardrails: Implementation of SCPs and AWS Config Rules.
3. Governance at Scale
   • AWS Config Multi-Account Multi-Region Data Aggregation: Centralizing compliance views.
   • AWS Service Catalog: Providing self-service account or resource provisioning with pre-defined constraints.
4. Security & Identity
   • IAM Identity Center: Centralized SSO for all accounts in the Organization.
   • Security Hub & GuardDuty: Aggregating security findings across the organization.

Visual Anchors

Account Provisioning Workflow

Multi-Region Config Aggregation

Definition-Example Pairs

• Preventive Guardrail: A policy that stops restricted actions from happening.
  • Example: An SCP that prevents any user (including the root user of a member account) from deleting S3 buckets in the Logging account.
• Detective Guardrail: A policy that monitors for non-compliance and alerts when it occurs.
  • Example: An AWS Config rule that triggers an SNS notification if any EC2 instance is launched without an encrypted EBS volume.
• Drift Detection: The ability to identify when a Landing Zone or account configuration has deviated from the established baseline.
  • Example: Control Tower notifying an administrator that a member account has manually disabled the CloudTrail log stream.

Worked Examples

Scenario: Securing a New Business Unit

Task: A company acquires a new startup and needs to onboard their 10 AWS accounts into the corporate structure while ensuring they cannot disable security logging.

Step-by-Step Solution:

1. Invite Accounts: Use AWS Organizations to send invitations to the startup accounts or use the Control Tower Enrollment process.
2. Organize: Create a new Organizational Unit (OU) called Acquisition-Startup and move the accounts into it.
3. Apply SCPs: Attach an SCP to the Acquisition-Startup OU that explicitly Denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.
4. Centralize Audit: Update the AWS Config Aggregator in the Security account to include the new OU ID, ensuring their resource compliance appears in the master dashboard.
5. Baseline: Deploy a CloudFormation StackSet to the new OU to automatically create a cross-account IAM role for the central security team.

Checkpoint Questions

1. What is the main difference between an SCP and an IAM policy?
2. How does AWS Control Tower use AWS Config to enforce governance?
3. Why would a DevOps engineer use CloudFormation StackSets instead of individual CloudFormation stacks in a multi-account environment?
4. True/False: An SCP can be used to grant permissions to a user who has no IAM policies attached.

▶Click to see answers

1. SCPs set the maximum available permissions (a boundary) for an account/OU but do not grant permissions. IAM policies grant specific permissions to identities within the account.
2. Control Tower deploys Config Rules as detective guardrails to monitor if accounts remain compliant with best practices.
3. StackSets allow you to deploy and manage stacks across multiple accounts and Regions with a single operation, ensuring consistency.
4. False. SCPs only filter permissions; the user still needs an IAM policy to be granted access.

Muddy Points & Cross-Refs

• SCP vs. IAM Identity Center: Students often confuse these. Remember: SCPs are the "fences" (limits), while IAM Identity Center (SSO) is the "key" (how users log in).
• Control Tower vs. Landing Zone (Solution): AWS used to offer a "Landing Zone Solution" (a custom template). AWS Control Tower is the managed service that replaced it. For the exam, always prefer the managed service (Control Tower).
• Config Aggregation vs. Security Hub: Config is for resource configuration (Is the volume encrypted?); Security Hub is for security findings (Is there a malware alert?).

Comparison Tables