‫Okay, so, let's talk about control tower.
‫And a control tower is a way to set up a multi-account
‫AWS environment with the best practices.
‫And so as such it's going to be automated setup,
‫we're gonna have policy management,
‫and a dashboard for visibility.
‫You don't pay for control tower,
‫but you're going to pay obviously for all the accounts
‫and services that are enabled by control tower.
‫So let's go ahead and set up our landing zone.
‫And, a landing zone is a way to have multiple accounts.
‫So, there is shared accounts
‫and there are three accounts
‫according to control tower best practices.
‫We're going to have a master account,
‫to use your account email right now that you have
‫and create the selling zone.
‫And by the way, you don't have to follow along this hands-on
‫because it's going to show you a lot of things
‫that you probably don't need,
‫but I will do it just to demo it to you.
‫Then we have a log archive account.
‫So this is an account dedicated to receive logs,
‫and is best security practice
‫to separate your master account
‫and your log archive account, so I can have.
‫And then an audit account so as...
‫So I'm just creating different accounts for control tower.
‫And then for service permissions
‫we can learn more about permissions right here,
‫and you can learn more about guidance.
‫And guidance is how you should manage your accounts
‫once you've enabled control tower.
‫So, I'm not going to read it out to you,
‫but if you do intend to use control tower in your enterprise
‫please read this guidance because it do provide
‫very strong guidances around what you can and cannot do,
‫and what you should and shouldn't do.
‫And then where you're happy, you say, "Yes, I'm happy,"
‫and I set up my landing zone.
‫And this is going to go ahead and set up
‫all these different accounts on top of your organization,
‫to get you started with control tower.
‫So as you can see the setup
‫is going to take about 60 minutes,
‫and it's going to take a long time,
‫it's going to set up two OU,
‫three shared accounts, a native cloud directory
‫with pre-configured groups and single sign-on access,
‫and 20 preventive guardrails to enforce policies
‫and two detective guardrails
‫to detect configuration violations.
‫So, a lot of things are being set up,
‫I'm just going to wait a little bit until this is done.
‫Okay, so my landing zone is now available,
‫and it has set up two things, two organizational units,
‫three shared accounts with a master accounts
‫and isolated accounts for log archive and security audits,
‫there's a native cloud directory with single sign-on access,
‫and I'll show you this in a second,
‫and then 20 preventive guardrails to enforce policies
‫and two detective guardrails
‫to detect configuration violations.
‫So, a lot of things was created using control tower,
‫and if I go to organizations right now,
‫I can show you right away what was created.
‫So as we can see here
‫we have the three accounts already in my organization,
‫and if I look through organize accounts,
‫we see there's custom and core organizational units,
‫so in core we have the audits and archive,
‫and in the custom we currently have no accounts, okay.
‫So, we shouldn't manage the account
‫through organizations though,
‫we should every time manage the account
‫through control tower.
‫And so here are some recommended actions.
‫So, add or register OUs,
‫configure your account factory, more guardrails,
‫and review users and access,
‫and then review shared accounts.
‫So, a lot of things are happening here in this dashboard,
‫we get also access to noncompliant resources
‫based on the rules that we have defined,
‫we get some information around the registered OU
‫that have been created
‫and whether or not they're compliant so that's perfect,
‫as well as all the enrolled accounts into my account,
‫and for the guardrails
‫we can view all the guardrails right here
‫if there's only a few guardrails.
‫And so here we get the information around all the rules
‫that are enforced on OUs for example.
‫Disallow the deletion of log archive,
‫obviously that makes a lot of sense,
‫disallow public read access to log archive and so on,
‫disallow configuration changes to CloudTrail,
‫all these kinda things are excellent to have
‫and are set up by control tower
‫according to best practices, okay.
‫You could always create accounts right here,
‫so you can view all the accounts here,
‫and then in the OU you can finish on your OU
‫and add an OU if you wanted to.
‫And, here is the guardrails.
‫The account factory is how you enroll an account
‫into your control tower which is great.
‫Users and access, so this is how you manage the user access
‫to your whole account sets.
‫So we have single sign-on right here,
‫and there is a user portal URL right here.
‫And the way to handle a user identity management right now
‫is with single sign-on.
‫It is a service by AWS.
‫Shared accounts are here,
‫landing zone settings and so and so,
‫as you can see this is a full management suite
‫for multiple accounts.
‫And so if we go into the SSO portal,
‫as you can see here there's a second button,
‫and then there's a password that I have to share,
‫so I'll just use the password that I have right here
‫that I've created from before,
‫and I sign in, and now I am into my SSO,
‫and I'm able to login into any of my three AWS accounts.
‫So we have the audit account, the log archive account,
‫and this defense CCP account
‫directly accessible from this UI.
‫So for example, if I want you to go into the audits
‫I can click here to go into the management console
‫of this audit account,
‫or click here for get command line or programmatic access.
‫So it is really, really neat, and here we go,
‫I am into my audit account right now.
‫So, it really shows you the power of control tower,
‫no, it's not something that you would do on your own
‫obviously, and now that I've moved away from my accounts
‫and then to (speaks faintly) my screen but...
‫This is to show you that yeah, it's quite handy,
‫I would say so I'm just going to login
‫back into my CCP account.
‫It's quite handy to use control tower in your account
‫to set up multiple accounts that aren't your best practices
‫and manage it from there.
‫So, if you are an organization
‫that wants to have a multiple best practice AWS set up,
‫then please use control tower.
‫Okay, that's it, I hope you like this lecture,
‫and I will see you in the next lecture.