AWS Cloud Governance

It’s important to consider your approach to DevOps as part of any governance strategy. Using Infrastructure as Code, for example, creates an auditable way to manage infrastructure, deployments, and configurations. These types of automation steps provide strict controls and consistency, which is critical to good governance. In general you’ll want to think about how you are using your resources, their security and compliance needs, and what operational excellence looks like for your particular environment.

With the help of AWS Control Tower, we often recommend an organizational hierarchy, where accounts are structured based on departments or projects, to make it easier to manage permissions, budgets, and resources at both granular and broad levels. The idea is to build accounts and permissions for distinct purposes and with the principle of least privilege, thereby compartmentalizing your environment and making it more secure.

Yes! As part of our work for customers, we consistently measure their environment against best practices. One way you can do that yourself is to use Mission Cloud Score, our free assessment tool for measuring your environment against best practices from the well-architected framework. You can sign up via the AWS Marketplace an Mission Cloud Score is powered by Mission Control, our proprietary cloud services platform, which is available to all customers of our managed services.

AWS comes with native tools to do precisely this. Amazon CloudWatch can monitor resources and applications, and be configured to notify you in the case of anomalous activity or the crossing of a predefined threshold. AWS CloudTrail offers similar visibility into APIs, the Amazon CLI, and others, allowing you to log any configuration changes made from the console or other locations. We often recommend AWS Config for tracking and securing the configuration of resources, along with Security Hub to review your security posture, and Systems Manager for handling operational tasks with your servers.

Take advantage of AWS native tooling wherever possible. Adopt practices like Infrastructure as Code (IaC) to remove the manual work from your operations. Ensure you’re centralizing your logging and alerts are tuned to your specification with Amazon CloudWatch and AWS CloudTrail; use AWS Config to ensure resources stay consistently configured; managed backups with tools like AWS Backup; and if possible, adopt a full cost management solution, like CloudHealth, to give you visibility into usage. Take advantage of automated security assessments from AWS Security Hub, and consider adopting event-driven automation with the help of services like AWS Lambda, to notify, log, or even automatically revert changes which go against your policies.

The real answer is: it depends on how complex the workload is and the cloud migration strategy. A lift and shift strategy, for example, can be faster than a refactor strategy—but it may also take more tuning and right-sizing to meet your performance and cost objectives. Some migrations take weeks. Some unfold over multiple phases while taking a year or more. But you won’t know the real answer without an accurate assessment of your current environment and objectives for AWS adoption.