Walkthroughs on Adam Divall

AWS Landing Zone Accelerator - Part 6: Security

Fri, 07 Mar 2025 11:36:24 +0000

Welcome back to our deep dive into the AWS Landing Zone Accelerator (LZA)!

In the previous five parts of this series, we’ve covered a lot of ground:

Part 1: Introduced the LZA and its benefits for building a well-managed AWS environment
Part 2: Walked through setting up your AWS Organization and creating new accounts
Part 3: Explored the LZA’s global settings for standardized configurations across your AWS organization
Part 4: Delved into the LZA’s network configuration, establishing a secure and scalable network foundation
Part 5: Tackled Identity and Access Management (IAM), including setting up IAM Identity Center, break-glass access, and temporary elevated access.

In this sixth installment, we’ll shift our focus to a critical aspect of any well-architected cloud environment: Security. We’ll explore how the LZA helps you establish a secure baseline for your AWS workloads, but we’ll also go beyond the LZA’s default security configuration. I’ll explain the rationale behind some of our decisions to use custom solutions instead of relying solely on the LZA’s native security features, giving you a deeper understanding of how to tailor your security posture to your specific needs. Get ready to dive into the world of security best practices and learn how to fortify your AWS environment!

AWS Landing Zone Accelerator - Part 5: Identity & Access Management

Mon, 03 Mar 2025 13:55:16 +0000

Welcome back to our ongoing exploration of the AWS Landing Zone Accelerator (LZA)!

We’ve made some solid headway together. As you’ll recall, in Part 1, we kicked things off by introducing the LZA and highlighting its key benefits for building a robust and well-managed AWS environment. We then rolled up our sleeves in Part 2, walking through the essential steps of setting up your AWS Organization and creating those all-important new accounts. In Part 3, we delved into the LZA’s global settings, learning how to establish standardized configurations across your entire AWS organization, ensuring consistency and streamlined management. And as we just covered in Part 4, we’ve recently taken a detour into the foundational networking capabilities.

AWS Landing Zone Accelerator - Part 4: Networking

Thu, 13 Feb 2025 09:16:36 +0000

Welcome back to my deep dive into the AWS Landing Zone Accelerator (LZA)!

We’ve made some good progress. In Part 1, we introduced the LZA and its benefits for building a well-managed AWS environment. Part 2 walked through setting up your AWS Organisation and creating new accounts. Then, in Part 3, we explored the LZA’s global settings, which allow for standardised configurations across your entire AWS organisation, ensuring consistency and simplified management.

Now, I’m going to shift our focus to a critical aspect of any AWS environment: networking. This part of the series will delve into the network configurations provided by the LZA, exploring how it helps you establish a secure, scalable, and well-structured network foundation for your AWS workloads.

AWS Landing Zone Accelerator - Part 3: Configuring Global Settings for Your Organization

Wed, 05 Feb 2025 08:36:27 +0000

Welcome back to my deep dive into the AWS Landing Zone Accelerator (LZA)!

We’ve made some good progress so far. In Part 1, we introduced the LZA and explained how it can help you build a well-managed AWS environment. In Part 2, we got hands-on and learned how to set up your AWS Organization and create new accounts.

Now, in Part 3, we’re going to take a broader perspective and explore the global settings that the LZA provides. These settings let you establish standardised configurations across your entire AWS organization, ensuring consistency and simplifying management.

AWS Landing Zone Accelerator - Part 2: Organizational Units and Account Configuration

Thu, 30 Jan 2025 16:14:11 +0000

In Part 1 of our AWS Landing Zone Accelerator (LZA) series, we introduced the LZA and its benefits. Now, we’ll explore configuring OUs and other essential organizational settings, along with the process of creating AWS accounts within your LZA environment.

Prerequisites

Before we begin, ensure you have the following:

Access to the AWS Management account with the necessary permissions to modify the LZA setup.
Permissions to update the LZA configuration, including editing files in the aws-accelerator-config repository.
A brand-new email address for the new AWS account you’ll be creating.
Git access to download and upload LZA configuration files.
AWS Command Line Interface (CLI) installed and configured on your computer.
The required permissions in Microsoft Entra ID to create and manage groups, and connect them to AWS IAM Identity Center for access control.

Important Note: I’m assuming you’ve already set up the LZA in your AWS environment by following the official guide: https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/step-1.-launch-the-stack.html. This means you’ve got the basic LZA structure in place.

AWS Landing Zone Accelerator - Part 1: Introduction & Overview

Sun, 22 Dec 2024 11:41:46 +0000

Migrating to the cloud can feel like a giant leap into the unknown. Where do you even begin? How can you ensure your cloud environment is secure, scalable, and compliant from the get-go? The AWS Landing Zone Accelerator (LZA) is your trusted launchpad for a smooth and successful cloud journey.

What is the LZA?

Think of the LZA as an open-source blueprint provided by AWS for building a well-architected, multi-account AWS environment. It’s more than just a template; it’s a framework encompassing pre-configured security controls, network configurations, and account structures, forming a robust foundation for your cloud deployments. The LZA leverages Infrastructure as Code (IaC) principles, primarily using AWS CloudFormation, to automate the deployment and configuration of these foundational components.

How to Set Up AWS CDK for Python

Wed, 02 Oct 2024 14:07:20 +0100

In this guide, I’ll walk through setting up AWS CDK with Python, including all the required dependencies and steps, and demonstrate how to deploy a simple app that provisions an Amazon S3 bucket.

What is the AWS CDK?

The AWS Cloud Development Kit (CDK) is an open-source software development framework designed to facilitate the creation and management of cloud infrastructure using familiar programming languages. Here are several important features and concepts associated with AWS CDK.:

Configuring Amazon VPC IP Address Manager (IPAM)

Sun, 19 Mar 2023 14:51:59 +0000

In many enterprise environments a common challenge is to how to handle the allocation of IP CIDR blocks be that to Data Centers, Offices, Subnets so as to ensure that resources don’t end up with IP addresses that have already been assigned to resources on the Network. Duplicate IP Addresses on the Network can cause numerous issues and AWS have previously written the following blog that discusses several solutions to this challenge such as the use of NAT Gateways and AWS PrivateLink or a couple of more manual approaches to workaround the issue.

Customising AWS Control Tower with Account Factory Customisations

Fri, 30 Dec 2022 15:54:49 +0000

At AWS re:Invent this year Account Factory Customisations was released. This post will walk you through how to configure and use the new functionality as in my opinion the documentation isn’t particularly clear as to how things work and there were also issues with the implementation steps when I first implemented it.

Use Case

For my specific situation that I’m utilising this for I want to deploy a VPC that leverages the Amazon VPC IP Address Manager (IPAM) for obtaining an IP CIDR Range since I don’t want to have to manually enter one each time and run the risk of overlapping address space. As part of my pre-requisties I’ve already written some automation using CloudFormation to not only setup VPC IPAM for delegated administration in my Organization, but I’ve also set up VPC IPAM so that I have seperate IPAM Pools for different regions and also different environments within those regions. This post won’t go into the details of the automation or the details of the CloudFormation Template that I’ll deploy either but how the Solution ultimately works.

Creating a Multi-Account CI/CD Pipeline with AWS CodePipeline

Tue, 18 Oct 2022 16:44:39 +0100

Whenever I’ve tried to learn a particular service or functionality within AWS, I find the best way is to do the ClickOps approach (i.e. Good Old Point and Click in the Console). Once I’ve figured out how to get it working via that method, I then go through the process of trying to automate it through Infrastructure as Code and in my case thats using AWS CloudFormation.

One particular example of this was getting a bit more familiar with AWS CodePipeline so that I could try to automate the delivery of CloudFormation Templates across multiple AWS Accounts in a similar manner as to how you would deploy solutions in a Software Delivery Lifecycle (SDLC). When I was learning how to do this through the management console, I found out that its not possible to do it all within the console and therefore you have to also leverage the AWS CLI for specific parts.

Customising AWS Control Tower with CfCT

Thu, 22 Sep 2022 06:57:02 +0100

If you missed the previous posts on Deploying a Landing Zone with AWS Control Tower or you’ve not had much experience with the service, I’d recommend going back through and reading those firstly before continuing.

In this post, I’m going to walkthrough how you can start customising Control Tower using the Security Reference Architecture (SRA). The SRA utilises Customisations for Control Tower (CfCT) which deploys a DevOps pipeline that works with CloudFormation templates and Control Tower lifecycle events.

Deploying a Landing Zone with AWS Control Tower - Part 3

Tue, 06 Sep 2022 15:02:04 +0100

Previously in Part 2 of this Walkthrough, I showed you how to create the organisational structure and enable guardrails within Control Tower.

In this post, I’m going to walkthrough some of the remaining post configuration task including configuring IAM Identity Center and provisioning a new AWS Account through Account Factory.

Configuring IAM Identity Center for Single Sign-On

AWS IAM Identity Center (formerly known as AWS SSO) is a service that enables you to have a single point of entry for managing resources within all of your AWS Accounts in an organisation.

Deploying a Landing Zone with AWS Control Tower - Part 2

Mon, 05 Sep 2022 18:39:28 +0100

Previously in Part 1 of this Walkthrough, I touched on what a Landing Zone was and a brief background on them before going through how to launch AWS Control Tower as the foundation of a Multi-Account Architecture.

In this , I’m going to walkthrough through some of the initial post configuration activities with Control Tower including setting up the organisational structure and enabling guardrails.

What has Control Tower deployed?

As part of the setup, Control Tower has utilised a number of other AWS Services including:

Deploying a Landing Zone with AWS Control Tower - Part 1

Sun, 04 Sep 2022 13:43:39 +0100

One of the first starting points for many organisations using Public Cloud is the establishment of a Landing Zone. A Landing Zone is a well-architected, multi-account environment that’s based on security and compliance best practices..

There are several reasons why organisations leverage a multi-account strategy including but not limited to:

Service Quotas: Each AWS Service typically has a number of different quotas; some of these are soft limits that can be increased by requesting an increase in the limit through a support ticket whilst others have hard limits that cannot be increased.
Limiting the Blast Radius: As an AWS Account is a boundary of isolation, potential risks and threats can be contained within an account without affecting others.
Security Controls: Workloads may have different complianye needs based on the Industry or the Geographical location. Whilst there are synergies between the different compliancy frameworks, the Security Controls that are implemented to help achieve the compliance may need to be implemented in a slightly different manner or may not be required at all.
Billing Separation: AWS Accounts are the only real way to separate items at a billing level e.g. Data Transfer costs.

When I first started using AWS in 2016 there was no pre-packaged solution for a Landing Zone; there were several recommendations provided by AWS but in essence it was something that organizations had to build themselves.

Creating a Blog with Hugo and AWS Amplify

Sun, 28 Aug 2022 16:43:50 +0100

This post is a Walkthrough Guide of how I’ve created this Blog using Hugo and AWS Amplify.

I’m not a Developer by trade and therefore when determining on what to use for the Blog Software I had the following high-level requirements:

Simple to Setup & Configure
Easy to Use & Maintain on an ongoing Basis
Cost Effective

After reviewing a number of different options following a few hours of reading on Google, I settled on Hugo. What is Hugo, you may ask? Well in short, it’s a static site generator. It allows you to create files in markdown format and using some magic it converts it into HTML.