Please enable JavaScript.

Coggle requires JavaScript to display documents.

Governance - Coggle Diagram

- - - - Ensures accounts maintain governance by disallowing violating actions
        
        Leverage SCP - Service Control Policies
        
        Statuses: enforced or not enabled
        
        supported in All Regions
        
        Always Compliant
    - - Detects and alerts on noncompliant resources within all accounts
        
        Leverages AWS Config rules
        
        Statuses: clear, in violation or not enabled
        
        Only apply to certain Regions
        
        Compliant/Non-compliant
    - - Check if resources are compliant before the resources are provisioned
        
        If the resources are out of compliance, they are not provisioned
        
        Monitor resources that would be deployed with CloudFormation templates
        
        Implemented with AWS CloudFormation hooks
  - - - General guidance
        
        Do not modify or delete resources created by AWS Control Tower in the management account or in the shared accounts. Modification of these resources can require an update to your landing zone.
        
        Do not modify or delete the AWS IAM roles created within the shared accounts in the core organizational unit (OU). Modification of these resources can require an update to your landing zone
        
        AWS Organizations guidance
        
        Do not use AWS Organizations to update service control policies (SCPs) that are attached by AWS Control Tower to an AWS Control Tower managed OU. Doing so could result in the controls entering an unknown state, which will require you to re-enable affected controls in AWS Control Tower
        
        If you use AWS Organizations to create, invite, or move accounts within an organization created by AWS Control Tower, those outside accounts will not be managed by AWS Control Tower and will not appear in the Accounts table
        
        If you use AWS Organizations to create or move OUs within an organization created by AWS Control Tower, those outside OUs will not be managed by AWS Control Tower and will not appear in the Organizational units table
        
        If you use AWS Organizations to rename or delete an OU that was created by AWS Control Tower, then this OU will continue to be displayed by AWS Control Tower using its original name. You will not be able to provision a new account to this OU using AWS Control Tower account factory
        
        IAM Identity Center guidance
        
        If you reconfigure your directory in IAM Identity Center to Active Directory, all preconfigured users and groups in Identity Center will be deleted
        
        Account factory guidance
        
        When you use account factory to provision new accounts in AWS Service Catalog, do not define TagOptions, enable notifications, or create a provisioned product plan. Doing so can result in a failure to provision a new account.
- - - - Consolidated Billing across all accounts - single payment method
        
        Pricing benefits from aggregated usage (volume discount for EC2, S3...)
    - - Includes consolidated billing features, control member accounts, SCP, prevent account from leaving and integration with supported services
        
        Invited accounts must approve enabling all features
        
        Apply an SCP to prevent member accounts from leaving the org
        
        Can’t switch back to Consolidated Billing Features only
- - - - Use AWS Managed Microsoft AD as a resource forest for Amazon RDS, Amazon FSx for Windows File Server, or Amazon EC2 instances
        On-premise AD <------ AWS Managed AD
        (Users)..........................(Resources)
      - Use AWS Managed Microsoft AD as a resource forest for all other supported AWS applications (AWS IdC, Chime, Connect, Qucksight, Transfer Family, Management Console ...)
        On-premise AD <------> AWS Managed AD
        In this scenario, AWS applications need to be able to look up objects from the on-premises domain in order for them to function
  - - - Ability to connect your on- premises Active Directory to AWS Managed Microsoft AD
        
        Must establish a Direct Connect (DX) or VPN connection
        
        Can setup three kinds of forest trust
        
        One-way trust: AWS => on-premises (On-premises Users can access AWS resources)
        
        One-way trust: on-premises => AWS (AWS Managed AD Users can access on-premises resources)
        
        Two-way forest trust: AWS ó on-premises
        
        Forest trust is different than synchronization Users live independently in both on-premise and AWS Managed AD Trust is NOT User Replication
    - - Create a replica of on-premises AD on EC2 in AWS to minimize latency and HA
        
        Establish trust between the AWS Managed Microsoft AD and EC2
        
        Architecture:
        on-premise AD (opAD.example.com) --replica--> AD on EC2 (opAD.example.com) <--trust--> Managed MS AD (awsAD.example.cm)
- - - - Can check if an S3 bucket is made public
        
        Cannot check for S3 objects that are public inside of your bucket
        
        Use Amazon EventBridge / S3 Events / AWS Config Rules
    - - Limits can only be monitored in Trusted Advisor (cannot be changed)
        
        Cases can be created manually in AWS Support Centre to increase limits
        
        Increase limits automatically using the AWS Service Quotas service