78. AWS Control Tower

最新推荐文章于 2022-02-17 16:52:05 发布

JessicaWind

最新推荐文章于 2022-02-17 16:52:05 发布

阅读量213

点赞数

分类专栏： AWS Certification 文章标签： aws

本文链接：https://blog.csdn.net/meiyubaihe/article/details/122930090

版权

106 篇文章 2 订阅

订阅专栏

Overview

AWS Control Tower offers a straightforward way to set up and govern an AWS multi-account environment, following prescriptive best practices.
AWS Control Tower orchestrates the capabilities of several other AWS services, including AWS Organizations, AWS Service Catalog, and AWS Single Sign-on, to build a landing zone in less than an hour. Resources are set up and managed on your behalf.
With AWS Control Tower, you can more easily adhere to corporate standards, meet regulatory requirements, and follow best practices.
You can adopt AWS Control Tower as your primary way to provision accounts and infrastructure.
In short, AWS Control Tower offers the easiest way to set up and govern a secure, compliant, multi-account AWS environment based on best practices established by working with thousands of enterprises.
AWS Control Tower enables end users on your distributed teams to provision new AWS accounts quickly, by means of configurable account templates in Account Factory.

Landing zone
- A landing zone is a well-architected, multi-account environment that's based on security and compliance best practices.
- It is the enterprise-wide container that holds all of your organizational units (OUs), accounts, users, and other resources that you want to be subject to compliance regulation.
- A landing zone can scale to fit the needs of an enterprise of any size.
Guardrails
- A guardrail is a high-level rule that provides ongoing governance for your overall AWS environment.
- It's expressed in plain language.
- Two kinds of guardrails exist: preventive and detective.
  - Preventive guardrails prevent actions from occurring.
  - Detective guardrails detect specific events when they occur and log the action in CloudTrail.
- Three categories of guidance apply to the two kinds of guardrails: mandatory, strongly recommended, or elective.
Account Factory
- An Account Factory is a configurable account template that helps to standardize the provisioning of new accounts with pre-approved account configurations.
- AWS Control Tower offers a built-in Account Factory that helps automate the account provisioning workflow in your organization.
Dashboard
- The dashboard offers continuous oversight of your landing zone to your team of central cloud administrators.

Root – The parent that contains all other OUs in your landing zone.
Security OU – This OU contains the Log Archive and Audit accounts. These accounts often are referred to as shared accounts. You can choose customized names for these shared accounts when you launch your landing zone. However, they cannot be renamed later.
Sandbox OU – The Sandbox OU is created when you launch your landing zone, if you enable it. This and other registered OUs contain the enrolled accounts that your users work with to perform their AWS workloads.
AWS SSO directory – This directory houses your AWS SSO users. It defines the scope of permissions for each AWS SSO user.
AWS SSO users – These are the identities that your users can assume to perform their AWS workloads in your landing zone.

When you set up a landing zone, AWS Control Tower performs the following actions in your management account on your behalf:

Creates two AWS Organizations organizational units (OUs): Security, and Sandbox (optional), contained within the organizational root structure.
Creates two shared accounts in the Security OU: the Log Archive account and the Audit account.
Creates a cloud-native directory in AWS SSO, with preconfigured groups and single sign-on access.
Applies 20 mandatory, preventive guardrails to enforce policies.
Applies two mandatory, detective guardrails to detect configuration violations.
Preventive guardrails are not applied to the management account.
Except for the management account, guardrails are applied to the organization as a whole.

AWS Control Tower uses AWS CloudFormation StackSets to set up resources in your accounts.
Each stack set has StackInstances that correspond to accounts, and to AWS Regions per account.
AWS Control Tower deploys one stack set instance per account and Region.

关注