Deploy and Manage Multi-Account Security with AWS Organizations

EXPERT
240 minutes
5 tasks

In this lab, you will configure AWS Organizations to effectively manage and secure a multi-account environment. The lab focuses on creating a new organization and using Service Control Policies (SCPs) to enforce security baselines across all accounts. You'll learn how to set up AWS Control Tower for streamlined account provisioning and governance. By the end of this lab, you will have hands-on experience deploying and managing secure AWS accounts at scale, an essential skill for real-world AWS environments.

Scenario

A growing online retail company, "ShopCo", is expanding its AWS usage and needs to implement robust security controls to manage its multiple AWS accounts efficiently. ShopCo's requirements include centralized billing, strict access controls, and compliance monitoring across its accounts. As the lead AWS architect, your task is to implement AWS Organizations and Control Tower to address these needs, ensuring compliance and security are maintained as the organization scales.

Learning Objectives

  • Create and configure AWS Organizations.
  • Implement Service Control Policies (SCPs) for security enforcement.
  • Configure AWS Control Tower for account governance.
  • Centralize security settings using IAM and delegated administration.

tasks (5)

task 1: Create a Composite Organization with AWS Organizations

45 min

task 2: Configure AWS Control Tower to Set Up Governance Baselines

60 min

task 3: Centralize Security Management via AWS Security Hub

45 min

task 4: Implement IAM Roles for Secure Cross-Service Access

40 min

task 5: Create and Apply IAM Policies for Permission Boundaries

50 min

Prerequisites

  • Understanding of multi-account AWS strategies
  • Basic knowledge of IAM roles and policies
  • Familiarity with AWS security services like AWS Security Hub and GuardDuty

Skills Tested

Configuring AWS Organizations and Control TowerApplying Service Control Policies (SCPs)Centralizing security operations with Security HubSecuring cross-service access using IAM rolesImplementing IAM policies and permission boundaries