Balancing agility and security: SBB’s journey to AWS(SEC204)
summary
SBB moves more than 60% of its systems to AWS, scales from one AWS account to 220+ accounts, and manages resilience for 11,000 trains and 1.3M daily passengers while protecting 175,000 tons of cargo. Architecture uses AWS Organizations, custom landing zones replacing Control Tower, guardrails via Service Control Policies, centralized posture in Security Hub with CloudTrail and Config, GitOps deployments with Argo CD, standardized developer stacks (ASA) on OpenShift, regular Well‑Architected reviews and blameless postmortems.
AI-written summary · about
chapters (14)
- 0:00Introduction and welcome
- 1:30Overview of SBB and its IT
- 6:51SBB’s cloud journey timeline
- 9:20Challenges with shared AWS accounts
- 11:50Introduction to AWS Landing Zone
- 13:40Moving to multiple AWS accounts
- 16:51Customizing the Landing Zone model
- 19:41AWS Organization and guardrails
- 23:13Shifting responsibility to DevOps teams
- 28:39Building resiliency and culture
- 31:52Well-Architected Reviews at SBB
- 34:41Improving punctuality with features
- 37:50Standardizing DevOps toolchain
- 40:00Closing and survey request
related talks
01h 03mContinuous Security in the Cloud
45mSecurity Lessons Learned Moving a Bank 100% in the Cloud
28mAmtrak's cloud adoption is riding the high-speed rail
28mSecrets Management at Swiss Federal Railways (SBB)
26mCase Study of Success
44mGuardrails in the Cloud
42mAspects of Continuous Deployment – A Multi-Dimensional View
52mManaging security with a unified strategy, featuring Nubank