Foundations & Governance

Organizations, Control Tower, SCPs and RCPs, Config, audit evidence — 14%

• The Multi-Account Foundation — The organization as the security boundary: Organizations structure, trusted access and delegated administrators, Control Tower landing zones and the three kinds of control, SCPs and the newer RCPs, and root credentials at organization scale. (5 lessons, 65 min)
• Consistent, Secure Deployment — Making every account and every new resource inherit the control: StackSets across accounts and Regions, CloudFormation Guard and cfn-lint shifting policy left, Firewall Manager and Config organization rules enforcing from a central source, tags as the organizing device, and safe sharing with RAM and Service Catalog. (3 lessons, 55 min)
• Compliance and Audit Evidence — Proving it: Config rules with automatic remediation and aggregated compliance, Audit Manager assessments and automated evidence collection, Artifact for AWS’s own reports, and the Well-Architected Tool, Trusted Advisor and Security Hub as three different instruments for measuring an architecture. (3 lessons, 55 min)