Automating Security Controls in Multi-Account AWS Environments

Learning Objectives

After studying this guide, you will be able to:

• Architect a multi-account security strategy using AWS Organizations and AWS Control Tower.
• Implement preventive security controls using Service Control Policies (SCPs).
• Deploy detective and responsive controls across multiple Regions using AWS Config and CloudFormation StackSets.
• Centralize security findings and compliance posture management via AWS Security Hub.
• Automate remediation and operational security tasks using AWS Systems Manager.

Key Terms & Glossary

• Landing Zone: A well-architected, multi-account environment that is a starting point from which you can deploy workloads and applications.
• Service Control Policy (SCP): A type of organization policy used to manage permissions in your organization, acting as a filter for what actions accounts can perform.
• Finding: A standardized record generated by security services (like GuardDuty or Inspector) that indicates a potential security issue.
• Insight: A collection of related findings in AWS Security Hub grouped by specific filters to identify high-priority issues.
• Drift: When the actual configuration of a stack or resource differs from its expected configuration defined in IaC (Infrastructure as Code).

The "Big Idea"

In a modern enterprise, security cannot be managed per-account. The "Big Idea" is Security by Design at Scale. Instead of reactive auditing, we use AWS Control Tower to establish a secure Landing Zone, SCPs to create un-bypassable guardrails, and AWS Security Hub to provide a single "pane of glass" for all findings. Automation replaces manual intervention, ensuring that security controls are applied the moment an account is created, regardless of the Region it resides in.

Formula / Concept Box

Hierarchical Outline

• I. Organizational Governance
  • AWS Organizations: Centralized billing and account management.
  • AWS Control Tower: Automates the setup of a landing zone with pre-configured security.
  • Guardrails: Mandatory and strongly recommended SCPs and Config Rules.
• II. Policy Enforcement (Preventive)
  • SCPs: Define the "Maximum Permissions" (Deny-list approach).
  • IAM Identity Center: Single Sign-On (SSO) for centralized access management.
• III. Multi-Account Deployment (Scale)
  • CloudFormation StackSets: Deploying security baselines (IAM roles, VPC Flow Logs) to all accounts/Regions.
  • AWS Service Catalog: Providing pre-approved, secure infrastructure templates.
• IV. Security Monitoring (Detective)
  • AWS Security Hub: Aggregating findings from GuardDuty, Macie, Inspector, and Config.
  • AWS Config: Tracking resource changes and compliance against desired states.
• V. Automated Response
  • Amazon EventBridge: Triggering actions based on Security Hub findings.
  • AWS Systems Manager: Running remediation scripts or patching fleets.

Visual Anchors

Multi-Account Hierarchy & SCP Flow

Security Finding Aggregation Flow

Definition-Example Pairs

• Drift Detection: The process of identifying when a resource's configuration has changed from its IaC template.
  • Example: A developer manually opens port 22 on a Security Group that was defined as closed in CloudFormation; StackSets detect this "drift."
• Remediation Action: An automated script or task that corrects a non-compliant resource.
  • Example: If AWS Config detects an S3 bucket is public, an SSM Automation Document is triggered to immediately set the bucket to private.
• Delegated Administrator: Assigning a specific member account to manage a service for the entire organization.
  • Example: Designating the "Audit Account" as the delegated administrator for AWS Security Hub so all other accounts send their data there.

Worked Examples

Example 1: Enforcing Regional Restrictions with SCPs

Scenario: A company only operates in us-east-1 and wants to prevent any resources from being created in other Regions to reduce the attack surface.

Step-by-Step Implementation:

1. Draft SCP: Create a policy with a Deny effect on all actions StringNotEquals to aws:RequestedRegion: us-east-1.
2. Exemptions: Add exemptions for global services like IAM, Route 53, and CloudFront within the policy condition.
3. Attach Policy: Attach the SCP at the Root level of AWS Organizations.
4. Verification: Attempt to launch an EC2 instance in eu-west-1 using a member account; the action will be denied even if the user has AdministratorAccess IAM permissions.

Example 2: Multi-Account Patching with Systems Manager (SSM)

Scenario: You need to ensure all EC2 instances across 50 accounts are patched every Tuesday at 2 AM.

Step-by-Step Implementation:

1. Resource Data Sync: Set up a Resource Data Sync in SSM to aggregate inventory data into a central S3 bucket.
2. Patch Baseline: Define a standard Patch Baseline (e.g., approve all critical security updates after 2 days).
3. State Manager Association: Create an association that applies this baseline to all instances tagged Env: Production.
4. Execution: SSM uses the SSM Agent on each instance to evaluate and install patches cross-account and cross-Region.

Checkpoint Questions

1. Why would a DevOps engineer use CloudFormation StackSets instead of regular Stacks for security baselining?
2. What is the primary difference between a Service Control Policy (SCP) and an IAM Policy?
3. How does AWS Security Hub use AWS Config to determine compliance?
4. If an SCP denies s3:PutObject at the OU level, but an IAM policy allows it at the account level, can the user upload a file?

Muddy Points & Cross-Refs

• SCP vs. IAM: Remember that SCPs set the maximum available permissions (the ceiling). They do not grant permissions; they only filter them. Even if an SCP allows an action, an IAM policy must still explicitly grant it.
• Regionality of Security Hub: Security Hub is a regional service. To see a global view, you must designate an Aggregator Region within the Security Hub settings to collect findings from all other enabled Regions.
• Cross-Reference: For deeper dive into identity, see the IAM Identity Center (SSO) Study Guide.

Comparison Tables

Security Monitoring Comparison

Control Tower vs. AWS Organizations