AWS landing zone, quotas, migration và incident controls
Multi-account architecture giảm blast radius khi identity/logging/network/billing guardrails được bootstrap và vận hành; account count tự nó không tạo governance.
Organization và account vending
AWS Organizations root/OUs/accounts tạo hierarchy; management account đặc quyền và không dùng workload. Control Tower orchestrates landing zone, Account Factory và controls nhưng có supported-region/version/customization lifecycle. Separate security, log archive, network/shared services, sandbox và workload accounts theo ownership/risk.
SCP và authorization
SCP là maximum permission boundary, không grant; effective allow còn cần identity/resource policies và chịu explicit deny, permission boundary/session policy. Test changes trên sandbox OU, protect break-glass/governance roles và avoid locking organization management. Resource control policies, tag policies và declarative policies giải scopes khác.
Identity
IAM Identity Center federation, short-lived roles, MFA, least privilege và permission sets; workload roles/OIDC thay access keys. Centralize identity but retain emergency access with monitored credentials. Access Analyzer/CloudTrail evidence, rotate/revoke sessions và review cross-account trust/external IDs.
Network foundation
VPC per ownership/failure boundary; Transit Gateway/Cloud WAN/shared VPC patterns có routing/cost/central firewall trade-offs. PrivateLink/endpoints reduce public/NAT path but add DNS/policy/cost. Direct Connect/VPN hybrid redundancy cần route/BGP/failover tests; central egress inspection can become blast radius.
Logging và security services
Organization trails, Config aggregation, GuardDuty/Security Hub findings, VPC/DNS/load-balancer logs and centralized immutable-ish log archive with KMS/access/retention. Service control must prevent disable/delete where supported, but delegated admin and service-linked roles require lifecycle. Findings need ownership/severity/automation guardrails.
Service quotas
Quotas may be account/region/resource/API-rate and adjustable or fixed; quotas are not current capacity. Inventory via Service Quotas/Trusted Advisor/metrics, forecast deployment/failover headroom and request increases before event. DR region/account and IaC parallel creation can hit separate limits; API throttling uses backoff/jitter.
Migration
Portfolio discovery/dependency map and 7Rs; landing zone/security/network/identity before waves. Application Migration Service, Database Migration Service/DataSync/Transfer/Snow options by downtime/change rate/volume. Validate data correctness, performance, cutover/fallback, DNS TTL, credentials and decommission—not only copy completion.
Security incident
Prepare delegated roles/runbooks/evidence storage. Detect → scope principal/accounts/regions/resources → preserve logs/snapshots → contain sessions/keys/network without destroying evidence → eradicate/persisted access → recover/monitor. Quarantine account/instance and rotate trust chains; management-account compromise is highest severity.
DR
Backup/restore, pilot light, warm standby, multi-site by RPO/RTO/cost/data semantics. Cross-region/account backup copy with vault/KMS permissions and restore drills. Route failover, dependencies/quotas/secrets/config and failback/reconciliation are part of DR; Multi-AZ is not region DR.
FinOps
Organizations consolidated billing, cost allocation tags/categories, CUR/Data Exports, budgets/anomaly detection and unit economics. Rightsize after utilization/SLO, commitments after stable baseline, Spot for interruption-tolerant workloads. Audit NAT/egress, idle resources, logs, snapshots, cross-AZ/region and duplicated security/network appliances.