Securing hundreds of AWS accounts for streamlined governance
summary
Around 140 accounts spread across about 40 organizational units are governed using AWS Control Tower for a landing zone with region deny and a centralized logging account so CloudTrail logs are centralized and immutable and cannot be stopped from member accounts. Identity is handled via AWS IAM Identity Center. Security Hub aggregates findings organization-wide while GuardDuty uses malware snapshots to scan even stopped EC2s and Amazon Inspector runs agent-based vulnerability scans on EC2, ECR and Lambda. Systems Manager features—Session Manager, Fleet Manager, Distributor, Inventory and Patch Manager—enable agent-driven access, package distribution, inventory aggregation (Glue/Athena) and patch reporting.
AI-written summary · about
chapters (7)
- 0:00Managing multi-account scale
- 1:08Account and identity basics
- 3:47Control tower orchestration
- 8:08Centralized logging and audit
- 11:00Threat detection and scanning
- 13:42Advanced resource querying
- 15:40Systems manager for fleets
related talks
27mIntroduction to AWS Security
57mScaling compliance with AWS Control Tower
27mIntroduction to AWS Security
40mCreating a managed, governed, and secure SaaS foundation on
32mAdvanced threat detection and response on AWS
49mCloud operations: A catalyst for innovation
57mBest practices for cloud governance at scale
32mBuilding an Enterprise Grade Multi Account AWS Environment