6 AWS/Azure governance và operations drills

Lab 01 · Dual-cloud landing zone review

Thiết kế AWS OU/accounts và Azure management groups/subscriptions cho platform/security/log/workloads. Map identity, policy, logging, network, billing and vending; threat-model management account/tenant. Gate: decision record + blast-radius table.

Lab 02 · Guardrail rollout

Viết sample SCP + IAM policy và Azure Policy initiative + RBAC/PIM model cho regions, public storage, logging and tags. Mô phỏng audit→canary→enforce, exemption owner/expiry, break-glass and remediation. Gate: no lockout and violation evidence.

Lab 03 · Quota/capacity game day

Inventory quotas for compute/IP/LB/network/API in primary+DR scopes; model peak/failover/IaC burst. Inject denied quota increase or regional capacity unavailable; select degradation/alternate family/region. Gate: headroom alerts and pre-event checklist.

Lab 04 · Migration wave and cutover

Assess a three-tier app/data dependencies; choose rehost/replatform/refactor and AWS/Azure transfer/database tools. Plan replication, validation, DNS/identity/network, freeze/fallback and decommission. Tabletop late data lag and auth failure. Gate: reconciliation/RPO/downtime evidence.

Lab 05 · Security incident tabletop

Scenario CI federation/role or service principal compromised across workload scope. Build timeline from CloudTrail/Entra/Activity/Defender signals, preserve evidence, revoke/quarantine, find persistence, rotate trust and recover. Gate: exact actions/owners and management-scope escalation.

Lab 06 · DR and FinOps drill

Restore/failover Order+Payment architecture to secondary scope with quotas, DNS, keys, data and dependencies; plan failback/reconcile. Analyze synthetic CUR/Cost export: allocate shared cost, find NAT/firewall/log/idle/egress waste and model rightsizing/commitments against SLO. Gate: RPO/RTO plus unit-cost before/after.

Rubric