</>Học Dev
Bài học

Tuần 3 - Ngày 5: AWS Control Tower

Tuần 3 – Ngày 5

Tuần 3 - Ngày 5: AWS Control Tower

Mục tiêu học tập

  • Hiểu cách hoạt động của AWS Control Tower
  • Nắm vững Guardrails (preventive và detective)
  • Biết cách setup và customize Landing Zone

1. Tổng quan AWS Control Tower

Định nghĩa

AWS Control Tower cung cấp cách dễ nhất để setup và govern multi-account AWS environment, được gọi là Landing Zone.

Core Components

┌─────────────────────────────────────────────────────────┐│AWSControlTower││││┌─────────────────┐┌─────────────────────────────┐│││LandingZone││Guardrails││││(Foundation)││(GovernanceRules)│││└─────────────────┘└─────────────────────────────┘││││┌─────────────────┐┌─────────────────────────────┐│││AccountFactory││Dashboard││││(Provisioning)││(ComplianceVisibility)│││└─────────────────┘└─────────────────────────────┘│└─────────────────────────────────────────────────────────┘

Underlying Services

ControlTowerorchestrates:┌─────────────────────────────────────────────────────────┐│┌───────────────┐┌───────────────┐┌────────────┐│││Organizations││Service││CloudForm││││││Catalog││StackSets│││└───────────────┘└───────────────┘└────────────┘││││┌───────────────┐┌───────────────┐┌────────────┐│││Config││CloudTrail││IAM││││Rules││││Identity││││││││Center│││└───────────────┘└───────────────┘└────────────┘│└─────────────────────────────────────────────────────────┘

2. Landing Zone

Default Structure

Root│├──SecurityOU│├──LogArchiveAccount││-Centralizedlogging││-S3bucketsforCloudTrail,Config│││└──AuditAccount│-Security&compliancetools│-Cross-accountaccessforauditors│├──SandboxOU│└──Developersandboxaccounts│└──[CustomOUs]└──Yourworkloadaccounts

Shared Accounts

┌─────────────────────────────────────────────────────────┐│ManagementAccount││-ControlTowerconfiguration││-Organizationsmanagement││-Billingandcostmanagement││⚠Shouldhaveminimalworkloads│└─────────────────────────────────────────────────────────┘│┌────────────────┴────────────────┐▼▼┌─────────────────────┐┌─────────────────────┐│LogArchiveAccount││AuditAccount││││││Contains:││Contains:││-CloudTraillogs││-Cross-account││-Configlogs││auditrole││-VPCFlowlogs││-Securitytools││-Accesslogs││-Configaggregator││││││⚠Highlyprotected││⚠Read-onlyaccess│└─────────────────────┘└─────────────────────┘

3. Guardrails

Types of Guardrails

┌─────────────────────────────────────────────────────────┐│GUARDRAILS││││┌─────────────────────────────────────────────────┐│││PREVENTIVE(SCP-based)││││││││Blockactionsbeforetheyhappen││││Examples:││││-DisallowchangestoCloudTrailconfig││││-Disallowdeletionoflogarchive││││-DisallowchangestoIAMIdentityCenter│││└─────────────────────────────────────────────────┘││││┌─────────────────────────────────────────────────┐│││DETECTIVE(ConfigRules)││││││││Detectnon-compliantresources││││Examples:││││-DetectpublicS3buckets││││-DetectunencryptedEBSvolumes││││-Detectrootuseraccess│││└─────────────────────────────────────────────────┘││││┌─────────────────────────────────────────────────┐│││PROACTIVE(CFNHooks)││││││││CheckCloudFormationbeforedeployment││││Examples:││││-ValidateS3bucketencryption││││-ValidateRDSencryption│││└─────────────────────────────────────────────────┘│└─────────────────────────────────────────────────────────┘

Guardrail Behaviors

BehaviorDescription
MandatoryAlways enabled, cannot be disabled
Strongly RecommendedBest practices, can be disabled
ElectiveOptional, enable as needed

Common Guardrails

Mandatory Preventive:

  • Disallow changes to CloudTrail
  • Disallow changes to AWS Config rules
  • Disallow deletion of Log Archive

Strongly Recommended:

  • Disallow public read access to S3 buckets
  • Disallow public write access to S3 buckets
  • Enable encryption for EBS volumes
  • Enable encryption for RDS databases

Detective Examples:

┌─────────────────────────────────────────────────────────┐│Guardrail:DetectpublicS3buckets││││Status:☑Enabled││││Findings:││┌─────────────────────────────────────────────────┐│││Account:111122223333││││Resource:my-public-bucket││││Status:NON_COMPLIANT││││Reason:BlockPublicAccessisdisabled│││└─────────────────────────────────────────────────┘│└─────────────────────────────────────────────────────────┘

4. Account Factory

Purpose

Standardized, automated account provisioning với pre-configured:

  • Network configuration
  • IAM roles
  • Guardrail compliance
  • Organizational unit placement

Account Factory Workflow

RequestNewAccount│▼┌─────────────────────────────────────────────────────────┐│AccountFactory(ServiceCatalog)││││AccountDetails:││-Accountname:dev-team-a││-Email:dev-team-a@company.com││-OU:Workloads/Development││-IAMIdentityCenteruser:john.doe││││NetworkConfiguration:││-VPCCIDR:10.1.0.0/16││-Region:ap-southeast-1│└─────────────────────────────────────────────────────────┘│▼┌─────────────────────────────────────────────────────────┐│AutomatedProvisioning││││1.CreateAWSaccount││2.MovetospecifiedOU││3.Applyguardrails││4.DeploybaselineCloudFormation││5.ConfigureIAMIdentityCenteraccess││6.DeployVPC(ifconfigured)│└─────────────────────────────────────────────────────────┘│▼AccountReadytoUse

Customizations for Control Tower (CfCT)

CustomCustomizations:┌─────────────────────────────────────────────────────────┐│manifest.yaml││││-DeployadditionalIAMroles││-ConfigureVPCwithTransitGatewayattachment││-EnableadditionalAWSservices││-ApplycustomConfigrules││-Deploysecuritytools│└─────────────────────────────────────────────────────────┘

5. Dashboard & Compliance

Control Tower Dashboard

┌─────────────────────────────────────────────────────────┐│ControlTowerDashboard││││┌─────────────────────────────────────────────────┐│││OrganizationalUnits:5││││EnrolledAccounts:12││││GuardrailsEnabled:25│││└─────────────────────────────────────────────────┘││││┌─────────────────────────────────────────────────┐│││ComplianceStatus││││││││Compliant:█████████████████████95%││││Non-compliant:█5%││││││││Violations:││││-Account111:PublicS3bucket││││-Account222:UnencryptedEBSvolume│││└─────────────────────────────────────────────────┘│└─────────────────────────────────────────────────────────┘

6. Extending Control Tower

Account Factory for Terraform (AFT)

┌─────────────────────────────────────────────────────────┐│AccountFactoryforTerraform││││Benefits:││-Terraform-basedaccountprovisioning││-GitOpsworkflow││-Customaccountcustomizations││-Pipeline-baseddeployment││││Workflow:││GitRepo→CodePipeline→AccountProvisioning│└─────────────────────────────────────────────────────────┘

Integrations

Control Tower integrates with:
- AWS Security Hub (aggregate findings)
- AWS Config (conformance packs)
- AWS CloudFormation (StackSets)
- AWS Service Catalog (account vending)

7. Limitations & Considerations

Limitations

LimitationDetail
RegionsLimited to specific regions
Existing OrgsRequires migration steps
Nested OUsLimited nesting support
CustomizationSome limits on guardrails

When NOT to use Control Tower

  • Very simple single-account setup
  • Highly customized requirements beyond CfCT
  • Need unsupported regions
  • Existing complex Organization structure

8. Câu hỏi ôn tập

  1. Control Tower sử dụng những AWS services nào underneath?

    Xem đáp án

    Control Tower orchestrate: AWS Organizations (account structure, OUs, SCPs), IAM Identity Center (SSO), AWS Config (compliance rules), CloudTrail (audit logging), Service Catalog (Account Factory), CloudFormation StackSets (deploy baselines to accounts), S3 + CloudWatch (logs). Control Tower là "orchestration layer" — không implement mới mà kết hợp existing services theo best practices.

  2. Sự khác biệt giữa Preventive và Detective guardrails?

    Xem đáp án

    Preventive guardrails: implemented via SCPs — block actions trước khi happen. Ví dụ: prevent disabling CloudTrail, prevent leaving Organization. Detective guardrails: implemented via AWS Config rules — detect non-compliance sau khi happen, generate findings. Ví dụ: detect unencrypted S3 buckets, detect EC2 without required tags. Preventive = hard block; Detective = notify and alert.

  3. Landing Zone mặc định tạo những accounts nào?

    Xem đáp án

    Control Tower setup tạo tự động: Management Account (đã có), Log Archive Account (tập trung CloudTrail logs, Config snapshots), Audit Account (security review, cross-account access cho security tools). Hai accounts này trong Security OU. Cũng tạo sẵn Sandbox OU cho dev/test accounts. Tổng cộng 2 accounts mới và 2 OUs baseline.

  4. Account Factory hoạt động như thế nào?

    Xem đáp án

    Account Factory dùng Service Catalog để provision accounts. Requester fill form (account email, OU, SSO user, VPC config) → Account Factory trigger Account Factory for Terraform (AFT) hoặc built-in provisioning → tạo AWS account → apply baseline StackSets (CloudTrail, Config, VPC, IAM Identity Center assignment) → register với Organizations. Account ready trong 30-60 phút với all governance baselines applied.

  5. Khi nào không nên dùng Control Tower?

    Xem đáp án

    Không phù hợp khi: (1) Organization đã có complex custom setup và Control Tower would conflict, (2) Cần custom networking phức tạp hơn Control Tower opinionated patterns, (3) Compliance requirements rất specific mà Control Tower guardrails không cover đúng, (4) Single account — Control Tower over-engineering cho small setups, (5) Khi team chưa sẵn sàng — Control Tower cần hiểu Organizations, IAM Identity Center, Config để maintain.

9. Bài tập thực hành

  • Setup Control Tower Landing Zone (nếu có sandbox account)
  • Review available guardrails
  • Explore Account Factory options
  • Study Customizations for Control Tower (CfCT)

Tài liệu tham khảo chính thức

Ngày tiếp theo: Quiz tổng kết Tuần 3