Lesson 07 — Enterprise Multi-Account Architecture

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 03 – AWS Organizations & Multi-Account Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand enterprise AWS architecture.
Design a secure multi-account environment.
Identify core enterprise AWS accounts.
Understand account responsibilities.
Recommend an AWS architecture for a growing organization.

📚 Lesson Information

Estimated Time: 60 Minutes

Difficulty: Intermediate

Prerequisites: Lesson 06 – AWS Control Tower Overview

Hands-on Lab: No

Assignment: No

💼 Business Value

Enterprise cloud environments are designed for much more than hosting applications.

A well-designed AWS architecture enables:

Secure workloads
Centralized governance
Regulatory compliance
Cost visibility
Disaster recovery
Operational scalability

Rather than deploying everything into a single AWS account, organizations separate responsibilities across dedicated accounts.

This approach improves security while making the environment easier to manage as the business grows.

🏢 In the Company

CloudNova Technologies now supports:

2,000 Employees
40 Development Teams
120 Applications
Multiple Countries
Several Compliance Frameworks

To support this scale, CloudNova has adopted a centralized AWS multi-account architecture.

Every AWS account has a clearly defined purpose.

Security controls are managed centrally while application teams remain responsible for their own workloads.

🌍 CloudNova Enterprise Architecture

CloudNova AWS Organization

Management Account
│
├── Security OU
│   ├── Security Operations
│   ├── Log Archive
│   └── Audit
│
├── Infrastructure OU
│   ├── Networking
│   ├── Shared Services
│   └── CI/CD
│
├── Workloads OU
│   ├── Development
│   ├── Testing
│   ├── Staging
│   └── Production
│
└── Sandbox OU
    ├── Student Labs
    ├── Innovation
    └── Research

🏗 Account Responsibilities

Every account exists for a specific business purpose.

Account	Responsibility
Management	AWS Organizations, governance and billing
Security Operations	Security monitoring and investigations
Audit	Compliance reviews and auditing
Log Archive	Long-term log storage
Networking	Shared networking infrastructure
Shared Services	DNS, Active Directory, certificates and shared tools
CI/CD	Central deployment pipelines
Development	Application development
Testing	Functional and integration testing
Staging	Pre-production validation
Production	Customer-facing workloads
Sandbox	Learning, experimentation and Proof of Concepts

🔐 Why Separate Accounts?

Every account has different security requirements.

For example:

Production

Highest security
Change control
Monitoring
Compliance

Development

Flexible environment
Frequent deployments
Lower business impact

Sandbox

Experimental
Temporary resources
Limited budgets
Restricted services

Separating these environments reduces operational risk and limits the impact of security incidents.

🛡 Security Architecture

CloudNova centralizes security operations.

Security Account

│

├── Security Hub

├── GuardDuty

├── IAM Access Analyzer

├── Amazon Inspector

├── AWS Config

└── CloudTrail Monitoring

The Security Team monitors all production accounts from a dedicated Security Account rather than logging into each account individually.

📊 Logging Architecture

CloudNova protects audit data by storing logs in a dedicated account.

All AWS Accounts

        │

CloudTrail

        │

AWS Config

        │

VPC Flow Logs

        │

Log Archive Account

Keeping logs separate prevents accidental deletion during security incidents.

🌐 Shared Services

Some infrastructure is used across the entire organization.

CloudNova centralizes these services.

Examples include:

Route 53
AWS Certificate Manager
Directory Services
Private DNS
Shared container registries
Shared automation tools

This avoids duplication across every workload account.

🚀 Deployment Flow

CloudNova follows a controlled deployment process.

Developer

↓

Development

↓

Testing

↓

Staging

↓

Production

Applications move through each environment before reaching customers.

This reduces deployment risks and supports controlled releases.

📈 Enterprise Growth

As CloudNova grows, additional accounts can be added without redesigning the organization.

Examples include:

AI Platform
Data Platform
Machine Learning
Analytics
Customer Solutions
Regional Production
Disaster Recovery

Because governance is already established, new accounts automatically follow enterprise standards.

🚫 Common Mistakes

Avoid:

❌ Running applications in the Management Account.

❌ Combining production and development workloads.

❌ Storing security logs in production accounts.

❌ Creating AWS accounts without governance.

❌ Allowing every team unrestricted administrative access.

✅ Enterprise Best Practices

Keep the Management Account for governance only.
Separate security services into dedicated accounts.
Store logs in a dedicated Log Archive account.
Separate workloads by environment.
Use AWS Organizations for centralized governance.
Review account architecture regularly.
Plan the architecture for future business growth.

🧪 Enterprise Mission 01 — Review CloudNova Architecture

Review the CloudNova AWS Organization.

Identify:

Which account manages governance?
Which account stores logs?
Which account manages networking?
Which accounts host applications?

Explain why each account exists.

🧪 Enterprise Mission 02 — Build an Enterprise Architecture

Design an AWS architecture for CloudNova.

Include:

Management
Security
Audit
Log Archive
Networking
Shared Services
Development
Testing
Staging
Production
Sandbox

Keep the design simple, secure and scalable.

🧪 Enterprise Mission 03 — Business Expansion

CloudNova launches a new AI business unit.

Design additional AWS accounts for:

AI Development
AI Testing
AI Production
AI Data Platform

Decide where these accounts belong within the existing Organizational Unit structure.

🧪 Enterprise Mission 04 — Architecture Review

The CIO asks:

“Can this AWS architecture support the company for the next five years?”

Review the architecture and recommend improvements that would support:

Business growth
Security
Operational efficiency
Governance
Compliance

🏢 Enterprise Scenario

CloudNova acquires three international companies.

Each company already operates its own AWS environment.

Management wants to:

Standardize governance.
Centralize security.
Maintain workload isolation.
Simplify billing.
Improve compliance.

Recommend how these environments should be integrated into the existing CloudNova AWS Organization while minimizing operational disruption.

📊 Knowledge Check

Why do enterprises use a multi-account architecture?
Why should workloads not run in the Management Account?
What is the purpose of the Security Account?
Why is a Log Archive Account important?
Which account should host shared enterprise services?
Why are development and production separated?
How does centralized governance improve security?
Which AWS service manages multiple accounts?
Why should enterprise architectures be designed for future growth?
How does a multi-account architecture improve cloud security?

📋 Lesson Completion Checklist

Task	Status
Reviewed CloudNova architecture	☐
Identified account responsibilities	☐
Designed enterprise architecture	☐
Planned business expansion	☐
Completed architecture review	☐

💡 Key Takeaways

After completing this lesson, you should understand:

Enterprise AWS environments use multiple dedicated AWS accounts with clearly defined responsibilities.
Separating governance, security, logging and workloads improves security, scalability and operational efficiency.
Centralized services such as networking, logging and security simplify enterprise management.
A well-designed multi-account architecture supports business growth without requiring major redesigns.
Multi-account architecture is a foundational principle of secure cloud operations in modern enterprises.

🚀 Next Lesson

➡️ Lesson 08 — Enterprise Build Project