cyber.hendryadrian.com
Interesting Stuff · wiz.io

How to Scale AWS Account Vending Beyond Landing Zones

· Original article ↗

Summary

The article explains how an AWS account-vending strategy can extend landing-zone controls by automating account setup, ownership, IaC workflows, alerts, networking, and security requirements as organizations scale.

Key points

  • Landing zones standardize controls inside AWS accounts, while account vending also automates the surrounding systems and integrations.
  • Baseline landing-zone controls can include CloudTrail, service control policies, single sign-on, encryption settings, security tooling, and shared networking.
  • A scalable process should accommodate account-specific owners, cost alerts, guardrails, networking, and production-versus-sandbox requirements.
  • Organizations should be able to onboard acquired or shadow IT accounts, adapt accounts as their purposes change, and delete accounts when needed.
  • Account vending can create a repository with IaC templates, configure automated scanning and deployment, and send security alerts to account owners.
  • Reusable infrastructure modules and automatically provisioned development, staging, and production accounts can encourage secure, consistent deployments.
  • The article recommends enforcing isolation expectations through tooling, including separation between production and development and preventing PII in development accounts.

Article Details

Topic
AWS account vending strategies for scaling multi-account cloud security and automating account setup

Vendors

AmazonBack in 2019, Amazon’s retail business publicly mentioned they had over 10,000 AWS accounts — and they certainly aren’t the only business with a high account volume. 

Products

AWSBack in 2019, Amazon’s retail business publicly mentioned they had over 10,000 AWS accounts — and they certainly aren’t the only business with a high account volume. AWS Control Towerare implemented everywhere.  To address this need, many companies deploy a Landing Zone, such as AWS Control Tower. But they may not be aware of what additional steps can be taken as part of a broader accountCloudTrailCloudTrail and possibly other AWS security services or logging sources enabled. EC2to attribute ownership for cost and security fixes.  It is much easier to find the owner of an expensive EC2 or a public S3 bucket when a small team or individual explicitly owns the account containing that resource.Landing Zone AcceleratorTower as a service to deliver this capability, and has also provided alternatives such as Landing Zone Accelerator. Meanwhile, some companies opt for custom solutions. S3ownership for cost and security fixes.  It is much easier to find the owner of an expensive EC2 or a public S3 bucket when a small team or individual explicitly owns the account containing that resource. The other waySlackSlack) to the account owners for security alerts or other issues.TerraformCreate a Github repo related to the account and include a skeleton terraform or other Infrastructure as Code (IaC) template. 

Related Articles