Runbook 02 Enterprise AWS Security Architecture Assessment

Module: 12 – AWS Security Architecture

Enterprise Lab: 02

Estimated Time: 5–6 Hours

Difficulty: ⭐⭐⭐⭐⭐

Estimated Cost: Free Tier (No additional AWS charges)

🎯 Objective

As a Cloud Security Architect at CloudNova Technologies, you have been assigned to perform a comprehensive security architecture assessment of the organization’s AWS environment.

Your objective is to evaluate whether the AWS architecture follows enterprise security best practices, AWS Well-Architected Framework recommendations, AWS Security Reference Architecture (SRA), Zero Trust principles, and organizational governance requirements.

By completing this runbook, you will learn how to:

Review AWS Organizations
Review Landing Zone Architecture
Review Organizational Units (OUs)
Review Multi-Account Strategy
Review IAM Identity Center
Review Identity & Access Architecture
Review Enterprise Network Architecture
Review Shared Services Architecture
Review Security Tooling Architecture
Review Centralized Logging
Review Security Monitoring
Review Data Protection Architecture
Review Disaster Recovery Architecture
Review Compliance Controls
Identify Architectural Risks
Develop an Enterprise Security Improvement Roadmap
Produce an Executive AWS Security Architecture Assessment Report

🏢 Business Scenario

CloudNova Technologies has completed the implementation of its enterprise AWS Landing Zone and Security Architecture.

Before onboarding additional business units into the platform, executive leadership has requested an independent architecture review to ensure the environment is secure, scalable, resilient, and compliant with enterprise security standards.

As the Cloud Security Architect, you must validate that the architecture supports business growth while maintaining strong governance, security, and operational excellence.

📋 Prerequisites

Complete:

Enterprise Runbook 01 — Build Enterprise AWS Security Architecture

Required:

AWS Organization
Administrator Access
AWS CLI
Visual Studio Code

🏗 Existing Enterprise Architecture

                     AWS Organization

                            │

        ┌───────────────────┼───────────────────┐

      Security OU      Infrastructure OU     Workloads OU

        │                     │                    │

  Security Account      Shared Services      Production

  Log Archive           Networking           Development

  Audit                 CI/CD                Sandbox

                            │

                    Transit Gateway

                            │

          Inspection VPC / Shared Services VPC

                            │

        CloudTrail • GuardDuty • Security Hub

      AWS Config • Inspector • IAM Identity Center

Your objective is to determine whether the architecture aligns with enterprise cloud security best practices.

Step 1 — Review AWS Organizations

Navigate to:

AWS Console

↓

AWS Organizations

Review:

Organization Structure
Organizational Units
Member Accounts
SCP Assignments
Delegated Administrators

Questions:

Are accounts organised correctly?
Are SCPs protecting critical accounts?
Is governance consistent?

AWS CLI

aws organizations describe-organization

Step 2 — Review Landing Zone Design

Review:

Landing Zone Architecture
Core Accounts
Identity Integration
Shared Services
Security Services
Logging Strategy

Questions:

Does the Landing Zone follow AWS best practices?
Are foundational services deployed correctly?

Step 3 — Review Multi-Account Architecture

Review:

Production Accounts
Development Accounts
Security Accounts
Networking Accounts
Sandbox Accounts

Questions:

Is workload isolation implemented?
Are production environments separated?

AWS CLI

aws organizations list-accounts

Step 4 — Review IAM Identity Center

Review:

Identity Source
Permission Sets
MFA
User Groups
SSO Configuration

Questions:

Is centralized identity management implemented?
Are least-privilege permissions enforced?

AWS CLI

aws sso-admin list-instances

Step 5 — Review Network Architecture

Review:

Transit Gateway
Shared VPC
Inspection VPC
Route Tables
Security Groups
Network ACLs
AWS Network Firewall

Questions:

Is network segmentation effective?
Are production workloads isolated?
Is east-west traffic inspected?

Step 6 — Review Shared Services Architecture

Review:

Shared DNS
Shared CI/CD
Patch Management
Artifact Repository
Central IAM Services

Questions:

Are shared services protected?
Are access controls implemented?

Step 7 — Review Centralized Logging

Review:

Organization CloudTrail
AWS Config
CloudWatch Logs
VPC Flow Logs
Log Archive Account

Questions:

Are all accounts logging centrally?
Are logs immutable?
Are retention policies configured?

AWS CLI

aws cloudtrail describe-trails

Step 8 — Review Security Services

Review:

Security Hub
GuardDuty
Detective
Inspector
IAM Access Analyzer
AWS Config

Questions:

Are all member accounts enrolled?
Are findings centralized?
Are security alerts investigated?

Step 9 — Review Data Protection Architecture

Review:

AWS KMS
S3 Encryption
EBS Encryption
RDS Encryption
Secrets Manager

Questions:

Is encryption enabled by default?
Are customer-managed KMS keys used?
Are secrets managed securely?

Step 10 — Review Disaster Recovery Architecture

Review:

AWS Backup
Backup Vaults
Cross-Region Replication
Recovery Accounts
Business Continuity Plans
RPO/RTO

Questions:

Is disaster recovery documented?
Have recovery tests been completed?
Are recovery objectives achievable?

Step 11 — Review Compliance Controls

Review alignment with:

AWS Well-Architected Framework
AWS Security Reference Architecture (SRA)
CIS AWS Foundations Benchmark
ISO 27001
PCI DSS

Questions:

Are compliance controls implemented?
Are security baselines documented?

Step 12 — Review Zero Trust Implementation

Review:

MFA Enforcement
Identity Federation
Least Privilege
Network Segmentation
Conditional Access
Continuous Monitoring

Questions:

Is implicit trust eliminated?
Are identities continuously verified?

Step 13 — Identify Architectural Findings

Document assessment findings.

Finding	Risk	Severity	Recommendation
No SCP protecting Production OU	High	Critical	Implement restrictive Service Control Policies
CloudTrail not enabled organization-wide	High	Critical	Enable Organization Trail
Security Hub not enabled for all accounts	Medium	High	Enable Security Hub across the Organization
IAM users still in use	Medium	High	Migrate users to IAM Identity Center
Public subnets used for sensitive workloads	High	Critical	Move workloads to private subnets
Central log archive missing retention policy	Medium	Medium	Configure lifecycle and retention policies
No documented Disaster Recovery architecture	High	High	Develop and test enterprise DR strategy

Step 14 — Develop Remediation Plan

Immediate (Within 24 Hours)

Enable Organization CloudTrail
Protect Production OU using SCPs
Enable Security Hub across all accounts
Remove unnecessary IAM users
Encrypt unprotected resources

Short-Term (30 Days)

Review Landing Zone configuration
Improve network segmentation
Implement Zero Trust enhancements
Strengthen centralized logging
Complete disaster recovery documentation

Long-Term (90 Days)

Automate compliance monitoring
Implement Policy-as-Code
Expand Security Hub automation
Perform quarterly architecture reviews
Align architecture with evolving AWS best practices

Step 15 — Validation

Verify:

AWS Organization reviewed
Landing Zone reviewed
Multi-Account Architecture reviewed
IAM Identity Center reviewed
Network Architecture reviewed
Shared Services reviewed
Centralized Logging reviewed
Security Services reviewed
Data Protection reviewed
Disaster Recovery reviewed
Compliance Controls reviewed
Zero Trust validated
Risks documented
Remediation roadmap completed

🧪 Enterprise Challenge

CloudNova Technologies has acquired three international companies and must integrate 30 AWS accounts into its existing enterprise environment.

The architecture review identifies:

Multiple standalone AWS accounts outside the Organization
No Service Control Policies protecting production accounts
Inconsistent IAM configurations
Security Hub disabled in several accounts
Missing centralized logging
Public-facing workloads deployed without inspection
No documented Landing Zone governance
Disaster Recovery implemented only for production workloads

As the Cloud Security Architect, you must:

Assess the enterprise AWS architecture
Evaluate governance and account structure
Review network segmentation and Zero Trust implementation
Validate centralized security services
Identify architectural risks
Recommend improvements
Produce an executive architecture assessment for the Enterprise Architecture Review Board

📄 Deliverables

Capture screenshots of:

AWS Organization
Organizational Units
IAM Identity Center
Security Hub Dashboard
GuardDuty Dashboard
AWS Config Dashboard
Transit Gateway
Network Firewall
CloudTrail Organization Trail
Log Archive Account
Shared Services Architecture

Submit:

Enterprise AWS Security Architecture Assessment Report
Multi-Account Governance Review
Network Architecture Review
Security Architecture Risk Register
Enterprise Improvement Roadmap
Executive Summary

🧹 Cleanup

This is an assessment runbook.

Do NOT delete:

AWS Organization
Organizational Units
Security Services
Shared Services
Transit Gateway
Network Firewall
Log Archive
IAM Identity Center
Architecture Documentation

Delete only:

Temporary assessment resources
Test EC2 instances
Experimental networking resources
Temporary CloudFormation stacks
Test IAM users created during validation

✅ Runbook Checklist

💡 Lessons Learned

What architectural weaknesses were identified during the assessment?

Why is AWS Organizations the foundation of enterprise governance in AWS?

How do AWS Organizations, Landing Zone, IAM Identity Center, Security Hub, GuardDuty, AWS Config, and CloudTrail work together to provide centralized security and governance?

Why are Zero Trust, Defense in Depth, and a multi-account strategy essential for securing enterprise cloud environments?

How would you enhance CloudNova Technologies’ AWS Security Architecture to support future business growth, global expansion, and emerging security threats?

🎉 Congratulations!

You have successfully completed the AWS Cloud Security Engineer Learning Path.

Throughout this journey, you have designed, implemented, secured, assessed, and documented enterprise-grade AWS environments following industry best practices and real-world security operations.

You now possess practical experience across:

AWS Identity & Access Management
Multi-Account Governance
Network Security
Compute Security
Data Protection & Encryption
Security Monitoring & Threat Detection
Vulnerability & Compliance Management
Backup & Disaster Recovery
DevSecOps & Infrastructure as Code Security
Enterprise AWS Security Architecture

These are the core capabilities expected of Cloud Security Engineers, Cloud Security Architects, DevSecOps Engineers, and Enterprise Security Consultants working in modern cloud environments.

Continue expanding your expertise through hands-on practice, architecture reviews, continuous learning, and real-world cloud security projects.