Here.
And welcome back.
Now in today's we will be discussing about the eatables control Covid.
So nowadays, most of the organizations that you will see they follow might be agone based architecture.
So you have multiple environments for the multiple environments for state security, identity production
and so on.
Now, when you have the amount of eatables, accounts that are increasing, it leads to its own set
of challenges.
In fact, a lot of organizations, they have database accounts that are more than a hundred.
So it comes with its own set of challenges here.
So one of the primary challenger you will see is associated with the identity management, which so
many eatables accounts that are part of the infrastructure.
How will user log in to these accounts?
Will you create a separate username and password for each user in all of these accounts, or you will
have some kind of identity management solution?
So in order to overcome this challenge, what we need is we need identity management like solution.
And single seiner is one of the recommended ways.
So with the help of single Taner, it is basically an authentication method that enables users to securely
authenticate with multiple applications and websites by using just one set of credentials.
So you have a EAW single Sinon feature, and user can make use of this single sign feature to go ahead
and login to any of the database accounts.
Considering that all of them are integrating the database a single time, not the second primary challenge
that you will see is related to the security hardening.
So considering that, let's say that a 100 database accounts in all of these 180 of these accounts,
you will need to ensure that there is a required level of security.
So maybe just for simplicity, you need a database config, you need database organizations and these
service control policies, you need centralized login, you need Cloudbreak guard duty and so on.
So doing that in one account is not a big challenge.
But when you have account data ranging in hundred, then security hardening can be a challenge.
So what can be the solution?
Solution can be security automation.
So what you can do?
You can write cloud formation template that can enable eatables config that can enable cloud prill,
enable guard duty and so on.
And with the help of the cloud formation stack search feature, you can go ahead and create a better
delete stacks across multiple accounts in the region with a single operation.
So you have this template with the help of this or tweet.
You can go ahead and run this template across multiple accounts, and all of your security related features
would be enabled now in larger organization.
You'll also see a challenge related to a centralized console where when you have multiple accounts,
you need to see which account is compliant, which account is not complied, and gets the various security
rules that you sing.
And from there, do you want to see the compliant and non-compliant status of all the accounts in a
centrally WS account?
So you log in to the centrality of this account.
You can quickly identify your key to this account when this compliantly, those account does not complain,
Idylls account is compliant and so on.
So this is also one of the things that is important.
So in order to work on these challenges that we were discussing and even more, you have a service of
eatables control.
So control tower at a high level overview offers a straightforward way to setup and governance and either
this media account environment following the best practice.
So what it does, it basically behind the scenes, it makes use of multiple services like organization,
single sign on cloud formation, stack sake's, config aggregators and various set of other best practices.
And it uses them to go ahead and configure account.
So, for example, you have a diva on it makes sure that this dev account is part of the organization
and is KPIs.
It is associated with the single Sinon solution.
It is associated with the config aggregators and so on.
So tomorrow, let's say you want to create a new account.
What you can do, you can easily create a new account through control tower.
So what will happen?
A new account, let's say, brought into this account gets created.
Now, once this account gets created, it gets integrated with all of the backend services that control
tower is supporting, including organizations, single anun.
It goes X and deploys security related stack with the help of cloud formation stack sets.
It enables config rules and so on.
So that is what control tower does.
So let's do one thing.
Let's have a quick demo to better understand it.
Now, currently, I have just enable the control tower in one of my eatables account.
And within here you see it has performed various operations here, like it has configured a native cloud
directly with preconfigured groups and single sign on access.
It has created multiple eatables accounts for isolation.
It has also.
Created 20 preventive guard rails to enforce and to detect detective guardrails to detect configuration
of violence.
And it has also created organizational units.
Now let's quickly look into what exactly it has done.
Now, if I'll go a bit down earlier under the control accounts, your dad had three accounts that are
part of it.
First is the account where I had created a control tower related setup.
So this is the base account here and this is what it has, organizational unit of root.
Now, along with that, it has created two database accounts.
So the integrity of this account was created from scratch by the control tower.
So that way, the lessons that it created is an audit account.
And the longer they were gone.
Now, generally, in a might Dedalus account based architecture, the logs associated with the service,
you'll not be storing those logs in the individual account itself, the best practice dates that you
need to have a central logging account and all of the logs from all of the other doubleness accounts
need to store it into the centralized logging account.
And this is the reason why when you setup that the control tower, it automatically creates one more
account.
And the account name is log archive.
And the purpose of this log archive account is that the other accounts that are being configured, these
accounts will stored the logs to a centralized log archive account.
So as part of the best practices, it goes ahead and also creates multiple database account based architecture.
So this is one part.
Second important part is related to the guardrails.
Now, in fact, let me quickly show you this.
So Gartrell is nothing but various set of policies that will go on the account.
For example, disallowed deletion of log archive.
You have log archive that is stored.
But what if someone goes ahead and deletes it?
So you have various rules associated with it.
Then you have disallowed changes to encryption configuration of S3 buckets.
Then they take public read access setting for Lowgar to go and so on.
So all of these are security related settings that can be associated with database accounts that that
part of your control tower be setup.
So that is associated with the security hardening that we were discussing.
All of these rules are associated with all of the database accounts that you have created.
The next important thing, as we were discussing, is this thing.
No sign on.
When you have multiple eatables accounts, how will you go ahead and manage the identities?
So you need a single Tynan's solution and control tower goes ahead and it creates a single Sinon and
its associated configuration for you.
So you no longer need to do anything, you know.
In fact, let me quickly show you this.
So if you'll go to users and access within the access type, you see you have a AWG single Zanón, and
it is also giving you a user portal you are in.
So let me quickly show you this.
So N.L., quickly open this in a new that it will ask you for the username and password that is associated
with this thing going on now since I'm already logged in.
Let's do one thing.
Let's copy this link and I'll open it up in a igniter more so that we understand it in a better way.
So let me give the user name
and let me also give the password.
Great.
So we are currently logged in.
And as soon as we logged in, it is showing that there are three Akorn.
So these are the three accounts.
And let's assume that now you want to go ahead and log into one of the accounts.
Let's assume log archive icon.
So now what do will do?
You will open this and you have two options, whether you need a SILEO programmatic access.
If you do this, it will go ahead and give you the access in secret.
Let me show you.
So now it is you see, it is basically giving you this sort of access secret conversation token.
And if you need the management console letters, you can click here.
So you see they logged into the log archive account.
Now, since this Lowgar account was created by the control tower itself, let's quickly look into what
it has done in history.
So within the ether, you see that there are multiple buckets with the name of control tower.
And if you will, quickly look into the permissions associated with the bucket, specifically the bucket
policy, that will give us a better idea.
So here's what it is doing.
It has automatically created a bucket policy according to the best practice.
And within the bucket policy, you have a denied and you have a eatables secure.
Transport is also the logs that will be stored in this bucket will only go through the strips.
The E tip will not be allowed.
Then along with that, it is also allowing the Cloud Grille and the config service to go ahead and perform
various operations like list bucket and put object on this specific bucket.
So the config as well as cloud Preal of other accounts can go ahead and put the files to this base.
S3 bucket, something similar to what we were discussing in this architecture diagram, that the cloud
related config of other icons can automatically send logs to a centralized logging icon and the bucket
policy has also been created.
Great.
So this is what security automation is primarily all about.
It basically makes use of the cloud formations, stacks it to configure various resources.
And also, one more interesting thing I wanted to show you before we conclude is that with the help
of control tower, let's assume that tomorrow you need one more into this account and this database
account.
You can go ahead and deploy to control tower itself.
Now, before we do that, you have the option of account factory.
So what is a factory does is that we can have a set of network configurations that will be applied to
the mutable seconds.
So if we look into the network configuration, Internet accessible subnet is Bucella and the address
range for the account PC 170 231 zero zero 60.
So let's do one thing to make this video interesting.
We'll go ahead and deploy one new account from the control tower.
So let's do one thing.
Let's go back to our applications here and we will sign in to the Andromeda labs are gone from a single
sign on.
Now, when you do that, you have two options.
The database administrator access and the service catalog end user access.
So let's assume that you have a team lead.
So you'll give access of service catalog and user access to all of the team links.
And Themeless will be able to create database accounts if they're required.
So let's assume that you have a team lead of a specific being.
He has logged.
He knows.
I know.
And he has created a management consultant.
So now what he wants, he wants to create a new account.
So that is pretty simple, what he needs to do.
He needs to go to the side of his catalog.
So let's go to the service catalog and within then if we go to products.
Now, the reason why the products are not showing is because our control tower is deployed in the north
was inherited.
And now you see you have a product coalesce eatables control tower, a gun factory.
So you can go ahead and launch a product.
Launch a product basically means in this case, launch idolization.
So let's see.
I'll specify the immense dev w SARS-CoV-2.
So this is as a product name for simplicity.
Now, what it will ask it will ask for account, email account name, SSL user name in last name.
And then he can do a Loynes froglets drydock.
So in the email, I'll specify the email address agone namelessness.
QualiTest payments live under the organizational unit.
There is only one unit available for SSL user email.
I'll also just specify this.
And the username last namelessness QualiTest best and best.
So once that indeed has given all of this information, all he has to do is launch product.
So now it's state service catalog is launching payments, dev idolise account, and the indebted Oblates
account will be created.
These eatables accounts will also have various things like the guardrails that we were discussing.
So we a set of important security policies.
It will also have a VPC whose configuration we had defined as part of the icon factory.
And the new account will also be integrated as part of the head of this organization.
So let's do one thing.
Let's quickly wait for a moment for that account to be created.
Alright, so you guys have been around 15 minutes, and if I will quickly go down towards the end,
all accounts, you should see you have an account of payments div that is included and within the complaint
status it is showing as compliant.
Now, within a single Zanón console, a fairly quickly refresh the page.
This time you should also see one Murugan.
You see eatables, seconds, total effort and you have a payment.
So now let's say I want to log in to payments, Dave.
All I can do, I can click on the management console and we are logged into the payment, never gone.
That's great.
So I hope at a high level, what have you, you understood what the eatables control tower tries to
do.
Basically, just to revise, it goes ahead.
It takes up various L'Abri services like organization, single Zanón stack sets.
It integrates them, and then a new account is deployed.
The account, with the help of the services that are integrated, are managed via the single control
tower management console.
However, behind the scenes, ultimately, you have all of these services that are used not just to
give you an overview from my perspective, the organizations that are quite mature in terms of identity
management, in terms of security, automation and so on.
I have not really seen them using control tower, Don.
They already have various solutions.
For example, data form can be used for security, automation, for single sign on their various good
providers like OCTA that are extensively used way interoperability.
So when you already have the setup, create the control tower does not really give a big advantage.
However, maybe for a newer organization, let's say they do not really have been dead set up and within
just an hour, they want to create a marketplace account based set up that is integrated with organizations
that get integrated with the single Tienen solution, which is best practices and so on.
Control Tower is a great service to start with.
So with this will conclude today's video.