Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Security > Control Tower 1 > Flashcards

Control Tower 1 Flashcards

1
Q

Control Tower

Control Tower basic value prop?

A

Set up and govern multi-account environment following best practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Control Tower

Four basic parts of Control Tower set up?

A

Landing Zone, Controls, Account Factory, Dashboard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Control Tower

Why have multiple accounts?

A

Highest level of isolation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Control Tower

Major AWS services orchestrated by Control Tower?

A

Organizations, IAM (SCPs), IAM Identity Center, Service Catalog, Config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Control Tower

How much does Control Tower cost?

A

Nothing (but services it configures have charges)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Control Tower

Example of security bad thing without Control Tower?

A

No central place to control identity and access across all accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Control Tower

Example of cost bad thing without Control Tower?

A

Untagged resources aren’t costed correctly to workloads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Control Tower

Example of operational excellence bad thing without Control Tower?

A

No off-account, central place with comprehensive logging and auditing across accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Control Tower

Example of management bad thing without Control Tower?

A

No central place to monitor and understand metrics across all accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Control Tower

What is a Landing Zone?

A

Multi-account environment based on security and compliance best practice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Control Tower

What is IN a Landing Zone?

A

OUs, accounts, users, anything you want to be subject to compliance regulation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Control Tower

AWS service that does LZs?

A

ControlTower, Landing Zone Accelerator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Control Tower

How does Control Tower create all these resources in all the accounts?

A

Mostly just CloudFormation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Control Tower Accounts

What is the top-level account and what does it do?

A

Management account – root of Org, roll-up billing goes here, owns the LZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Control Tower Accounts

How does the Management account manage accounts?

A

Assumes the AWS ControlTowerExecution in each account, assumes it. Role created by Control Tower.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Control Tower Accounts

Can you add existing accounts to Control Tower?

A

Yes, it’s called Enrollment.

17
Q

Control Tower Accounts

What accounts does Control Tower create?

A

Audit account and Log Archive account

18
Q

Control Tower Accounts

What is in the Audit account?

A

Whatever your apps want to stream for 3rd party systems to audit all accounts under Control Tower

19
Q

Control Tower Accounts

Examples of systems that might stream to the Audit account?

A

SNS alert messages and CloudWatch logs

20
Q

Control Tower Accounts

What is in the Log Archive account?

A

AWS Config logs, CloudTrail logs, other stuff

21
Q

Control Tower Accounts

Where do the Audit and Log Archive accounts live in Organizations?

A

They get their own OU named “Security”

22
Q

Control Tower Accounts

Two ways to create accounts via Control Tower?

A

Account Factory console, Service Catalog console, special Lambda function in Mgmt acct

23
Q

Control Tower Accounts

CT workflow when creating a new account?

A

Call Organizations CreateAccount > apply blueprints and controls (CF)

24
Q

Control Tower Accounts

What is Account Factory?

A

Console thing that’s part of Service Catalog…creates accounts.

25
Q

Control Tower Accounts

Does Account Factory have an automated way to invoke?

A

No, console / human only

26
Q

Control Tower Accounts

Major things provisioned in a new account?

A

CF stacks, turns on CloudTrail, create IAM Roles, SNS+Lambda notification forwarder

27
Q

Control Tower Accounts

What do you click on to unenroll an account?

A

Service Catalog > “Terminate” (it unenrolls it, doesn’t close it)

28
Q

Control Tower Accounts

What happens if you unenroll an account from your LZ?

A

Moved out of its OU into the Root area of Organizations, removes all the stuff it provisioned in the account.

29
Q

Control Tower Accounts

How do you login to an unenrolled account?

A

Identity Center still has admin access

30
Q

Account Factory

Who can run Account Factory?

A

Admins and anyone with permissions

31
Q

Account Factory

Are guardrails applied to new accounts via Account Factory?

A

Yes

32
Q

Account Factory

Can new accounts via Account Factory have standard networking setups?

A

Yes

AWS Security (83 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions