Design Solutions for Organizational Complexity
Learning goals
- Connect many VPCs and on-premises sites with Transit Gateway, Direct Connect, Site-to-Site VPN and PrivateLink, and design hybrid DNS with Route 53 Resolver
- Design multi-account governance and log aggregation with Organizations, Control Tower, SCPs, RCPs and delegated administrators
- Design organization-wide access and encryption with IAM Identity Center and external identity providers, cross-account roles and KMS key policies
- Design DR by RPO/RTO (including Elastic Disaster Recovery) and cost visibility with tags, Cost Categories and purchase options
Key points
- With dozens of VPCs or more, use a Transit Gateway hub-and-spoke rather than a mesh of peering. Separate route tables enable isolation such as keeping production and development VPCs from talking to each other while both reach a shared services VPC (peering does not route transitively).
- On-premises connectivity: use Direct Connect when you need stable bandwidth and low latency (redundant with two or more connections at multiple locations), and Site-to-Site VPN when you need it right away or as a backup line. Reach VPCs in multiple Regions through a Direct Connect gateway.
- Hybrid DNS: to resolve on-premises names from AWS, use Route 53 Resolver outbound endpoints and forwarding rules; to resolve AWS private hosted zones from on-premises, use inbound endpoints. Forwarding rules can be shared with other accounts through RAM.
- To expose just one service in another VPC or account, use PrivateLink (endpoint services). It works even with overlapping CIDRs and does not connect the whole VPC.
- Multi-account: separate log archive and audit accounts with a Control Tower landing zone, and aggregate with an organization CloudTrail trail and a Config aggregator. Make a security account the delegated administrator for GuardDuty and Security Hub to manage all accounts centrally.
- SCPs set the maximum permissions available to IAM principals in accounts, and RCPs set the maximum access to resources (S3, KMS and so on), organization-wide. Neither grants permissions.
- Cost visibility: allocate costs per business unit with cost allocation tags (values standardized with tag policies) and Cost Categories, and alert on overruns and anomalies with Budgets and Cost Anomaly Detection. With consolidated billing, Savings Plans and RI discounts are shared within the organization.
Workplace uses
- General AffairsSet up about 40 accounts of 8 group companies with Control Tower and consolidate each company's VPCs on Transit Gateway. Connect to the head-office data center with Direct Connect at two locations.
- AccountingStandardize “CostCenter” tag values with a tag policy and allocate costs by business unit every month with Cost Categories. Notify department heads at 80% of budget.
- SalesExpose only the order API to sales agents' accounts through PrivateLink, without connecting them to the entire internal network.
Exam objectives (from the exam guide)
- 1.1 ネットワーク接続戦略を設計する。
- 1.2 セキュリティコントロールを規定する。
- 1.3 信頼性とレジリエンスに優れたアーキテクチャを設計する。
- 1.4 マルチアカウント AWS 環境を設計する。
- 1.5 コスト最適化と可視化の戦略を決定する。