Create enterprise-wide preventive guardrails
summary
Explains concrete guardrails: use AWS Organizations and Service Control Policies with 5120 byte policy limit and five SCPs per OU; prefer coarse-grain denies at high levels and allows only when attached along the full path. Operationalize with infrastructure as code + CI/CD, CloudFormation, IAM Access Analyzer and whitespace-minification to stay under limits. Inter automates account onboarding (creates five accounts per acquisition), enforces region/KMS/S3/snapshot/VPN controls, runs tagged resources (13 tags), finishes a one‑year rollout, and handles >10M authentications/day and >1M API calls/min.
AI-written summary · about
chapters (16)
- 0:00Introduction to scps
- 2:26How scps work
- 6:41Key considerations for scps
- 9:23Poll and organizational structure
- 12:02Advanced organization patterns
- 15:48Poll and key considerations part 2
- 17:01Technical best practices
- 24:17Automated deployment
- 27:13Delegated administration
- 28:59Interco case study
- 37:27Planning the implementation
- 39:30Automation and execution
- 44:09Account structure in practice
- 46:20Specific scp examples
- 51:01Results and lessons learned
- 54:42Key takeaways and resources
related talks
44mGuardrails in the Cloud
44mAchieve your identity, security, and compliance goals on
38mSecuring Amazon S3 with guardrails and fine-grained access controls
21mSecuring hundreds of AWS accounts for streamlined governance
54mEstablishing a data perimeter on AWS
59mBeyond the scripts: Governance automation master class
51mAWS Security Essentials
25mUse lessons learned from the field to build for security