Runbook 01 Build Enterprise AWS Security Architecture

Module: 12 – AWS Security Architecture

Enterprise Lab: 01

Estimated Time: 6–8 Hours

Difficulty: ⭐⭐⭐⭐⭐

Estimated Cost: AWS Organizations, AWS Transit Gateway, NAT Gateway, AWS Network Firewall, and other enterprise networking services may incur charges. Review AWS Pricing and monitor AWS Cost Explorer throughout this lab.

🎯 Objective

As a Cloud Security Architect at CloudNova Technologies, your responsibility is to design and implement a secure, scalable, and enterprise-grade AWS security architecture capable of supporting multiple business units, thousands of users, and globally distributed workloads.

By completing this runbook, you will learn how to:

Design an Enterprise AWS Landing Zone
Configure AWS Organizations
Create Organizational Units (OUs)
Build a Multi-Account Architecture
Configure IAM Identity Center
Design Shared Services
Configure Centralized Logging
Configure Security Tooling Account
Configure Log Archive Account
Design Secure Networking
Configure Transit Gateway
Configure AWS Network Firewall
Implement Zero Trust Principles
Configure Security Monitoring
Design Disaster Recovery Architecture
Validate Enterprise Security Architecture

🏢 Business Scenario

CloudNova Technologies has grown rapidly through acquisitions and now operates across multiple countries.

Each business unit currently manages its own AWS account independently, resulting in inconsistent security controls, duplicate IAM identities, fragmented logging, and poor governance.

Executive leadership has approved the implementation of a centralized AWS enterprise architecture that will standardize security, governance, identity management, networking, monitoring, and compliance across the organization.

As the Cloud Security Architect, your responsibility is to design and implement the new enterprise AWS security architecture.

📋 Prerequisites

Complete:

Modules 01–11

Required:

AWS Management Account
Administrator Access
AWS CLI
Visual Studio Code
Terraform (Optional)
AWS Organizations Enabled

🏗 Enterprise Architecture

                    AWS Organization

                           │

        ┌──────────────────┼──────────────────┐

     Security OU        Infrastructure OU     Workloads OU

        │                    │                   │

 ┌──────────────┐      ┌──────────────┐     ┌──────────────┐
 │ Log Archive  │      │ Shared Svcs  │     │ Production   │
 └──────────────┘      └──────────────┘     └──────────────┘

 ┌──────────────┐      ┌──────────────┐     ┌──────────────┐
 │ Security Hub │      │ Networking   │     │ Development  │
 └──────────────┘      └──────────────┘     └──────────────┘

                           │

                    Transit Gateway

                           │

                  Shared Enterprise Network

                           │

             CloudTrail • GuardDuty • Config
             Security Hub • IAM Identity Center

Step 1 — Create AWS Organization

Navigate to:

AWS Console

↓

AWS Organizations

↓

Create Organization

Configure:

All Features Enabled
Management Account
Consolidated Billing

Validate:

Organization Created
All Features Enabled

AWS CLI

aws organizations describe-organization

Step 2 — Create Organizational Units (OUs)

Create:

Security OU

Infrastructure OU

Production OU

Development OU

Sandbox OU

Move member accounts into the correct OU.

Validate:

Accounts organised correctly
Security boundaries established

AWS CLI

aws organizations list-organizational-units-for-parent \
--parent-id ROOT_ID

Step 3 — Configure AWS Accounts

Create enterprise accounts:

Security Account
Log Archive Account
Shared Services Account
Networking Account
Production Account
Development Account
Sandbox Account

Validate:

Accounts created
Billing centralised
Access verified

Step 4 — Configure IAM Identity Center

Navigate to:

IAM Identity Center

Configure:

Identity Source
User Groups
Permission Sets
MFA
Single Sign-On

Create Groups:

Security Team
Cloud Engineers
Developers
Auditors
Administrators

Validate:

Users authenticate successfully
Least privilege applied

Step 5 — Configure Shared Services

Deploy:

DNS Services
Shared IAM Services
Shared CI/CD Services
Patch Management
Central Image Repository

Validate:

Shared services accessible
Network connectivity verified

Step 6 — Configure Enterprise Networking

Deploy:

Transit Gateway
Shared VPC
Inspection VPC
Private Subnets
Public Subnets
Network Firewall
Route Tables

Validate:

Network segmentation working
East-West traffic controlled

Step 7 — Configure Centralized Logging

Enable:

Organization CloudTrail
AWS Config
VPC Flow Logs
CloudWatch Logs

Send logs to:

Log Archive Account

Validate:

Logs received
Cross-account delivery successful

AWS CLI

aws cloudtrail describe-trails

Step 8 — Configure Security Services

Enable organization-wide:

GuardDuty
Security Hub
AWS Config
IAM Access Analyzer
Amazon Inspector
Detective

Aggregate findings into:

Security Account

Validate:

Findings centralised
Member accounts enrolled

Step 9 — Configure Data Protection

Review:

KMS Keys
S3 Encryption
EBS Encryption
RDS Encryption
Secrets Manager

Validate:

Encryption enabled
Key management centralised

Step 10 — Implement Zero Trust Architecture

Configure:

Least Privilege IAM
MFA
Identity Federation
Network Segmentation
Conditional Access
Continuous Monitoring

Validate:

Access restricted
Trust boundaries enforced

Step 11 — Configure Disaster Recovery Architecture

Review:

Backup Strategy
Cross-Region Replication
AWS Backup
Recovery Accounts
Recovery Objectives

Validate:

RPO documented
RTO documented
Recovery procedures tested

Step 12 — Validate Enterprise Architecture

Review:

AWS Organization
OUs
IAM Identity Center
Logging
Monitoring
Security Services
Networking
Backup Strategy
Governance

Verify architecture aligns with:

AWS Well-Architected Framework
AWS Security Reference Architecture
Zero Trust Principles

🧪 Enterprise Challenge

CloudNova Technologies is acquiring two new companies and must integrate them into its AWS environment while maintaining security, governance, and operational consistency.

Requirements:

Onboard 15 AWS accounts
Integrate with existing AWS Organization
Implement centralized identity management
Centralize security monitoring
Separate production and development workloads
Enable centralized logging
Apply Service Control Policies (SCPs)
Maintain compliance with ISO 27001 and PCI DSS
Design for high availability across multiple AWS Regions

As the Cloud Security Architect, you must:

Design the target AWS Organization structure
Define Organizational Units
Design secure networking
Implement Zero Trust principles
Create a governance strategy
Present the final enterprise architecture to executive leadership

📄 Deliverables

Capture screenshots of:

AWS Organization
Organizational Units
IAM Identity Center
Security Hub Dashboard
GuardDuty Dashboard
AWS Config Dashboard
Transit Gateway
Network Firewall
Log Archive Account
Shared Services Architecture

Submit:

Enterprise AWS Security Architecture Diagram
AWS Organizations Design
Multi-Account Strategy
Network Architecture Diagram
Zero Trust Architecture
Governance Model
Executive Architecture Report

🧹 Cleanup

Delete only test resources created for this lab:

Test Accounts (if applicable)
Test Transit Gateway Attachments
Test Networking Resources
Temporary IAM Users
Temporary CloudFormation Stacks
Test EC2 Instances

Retain:

AWS Organization
Organizational Units
Security Services
Architecture Documentation
Network Design
Governance Documentation

Review AWS Cost Explorer and ensure no unnecessary enterprise networking resources remain active.

✅ Runbook Checklist

💡 Lessons Learned

What enterprise architecture decisions improved CloudNova Technologies’ overall security posture?

Why is a multi-account AWS architecture more secure and manageable than a single-account environment?

How do AWS Organizations, IAM Identity Center, Security Hub, GuardDuty, and AWS Config work together to provide centralized governance and security?

Why are Zero Trust principles and Defense in Depth essential when designing enterprise cloud environments?

How would you further enhance this architecture to support global operations, mergers and acquisitions, and future cloud growth?

🚀 Next Enterprise Runbook

Enterprise Runbook 02 — Enterprise AWS Security Architecture Assessment

In the next runbook, you will assess an enterprise AWS security architecture by reviewing AWS Organizations, Landing Zone design, multi-account governance, IAM architecture, network segmentation, centralized logging, security services, Zero Trust implementation, disaster recovery, and compliance controls to produce a comprehensive executive security architecture assessment.