Event Driven Operational Governance 

High Level Solution Design

Usecase 

An organization has Multiple accounts , using AWS Organizations , Infra Admins need to monitor certian activities and ensure compliance across all accounts 

In our use case , Admin wants to have the application development teams to have flexibility on management of their application stack components but also want to have a centralised view of   RDS and EC2  to ensure these changes or creation meets organisational compliance criteria 

First Step before we design solution 

We document the overall design intent with tradeoff's and options ,for every resource we want to cover identify desired/Compliant state of resources .  In current use case we consider RDS and EC2 instances that are created by development teams . The resources should follow organizational best practices. 

1. Accepted Good configuration for Production , Staging. example : Apps should use organization created DBParameter groups approved by DB Admins.  Instance size and Families can be higher than test . 

2. Accepted Good configuration for Test ( dev, QA, integration )  example : Instance size acceptable for  test are T4G small to large  

3. Any other organizational or compliance requirements

Examples of  Critical RDS Events to Monitor

• Backup failures

• High availability failover

• Security group changes

• Parameter group modifications

• Encryption status changes

Example Compliance Categories

  Security:

•     Encryption standards

•     Access controls

•     Network isolation

  Operational:

•     Backup policies

•     Performance monitoring

•     Resource tagging

  Financial:

•     Instance sizing

•     Storage optimization

•     Reserved instance coverage

Integration Considerations 

Oraganization currently records config rules which is linked to Security hub , the solution should integrate with existing Config and Security hub dashboards ( this is usually the case with most enterprise usecases )

Understanding the Solution and Design Decisions  

Capture Events across all accounts in organization

Our first requirement to address, is to be able to be know any RDS or Ec2 changes across our Organization ,so the first step is to be able to trap that event .The event  could be  create or update of a resource that may not align with organisational compliance requirements. 

AWS Config is a service that provides a detailed view of the configuration of AWS resources , AWS Config can send notifications when resource configurations change, enabling quick response to potential issues or policy violation.  This is a service we can use to trap change events. 

Most organizations follow Multi VPC aMulti Account pattern , So we need to enable the service in Organization as below .

Multi-account, multi-region data aggregation in AWS Config enables you to aggregate AWS Config data from multiple accounts and AWS Regions into a single account. with this we can query in SQL about resources across out accounts 

example 

• Query to list all EC2 instances with AMI ID ami-12345

• Query for count of resources grouped by their AWS Config rules compliance status

• Query for the compliance status of AWS Conformance packs

• Query to get counts of AWS resources grouped by account ID

So what Observes  for change in every resource in all our accounts ?

This service feature within AWS Config is called config recorder ,for our requirement  we will create a Custom recorder . for more details on other options relating to configuration of recording for details see FAQ section.

Why Custom Recorder : 

1. In custom recorder we  have full control on what recourse types we need to record this enabling only RDS and EC2 and Filter all other events. 

2. Keep costs optimised 

Implementation Effort Ranking (Low to High):

1. RDS Events (Simplest)

2. Config Rules with Lambda

3. Custom Config Recorder (Most Complex)

Cost Efficiency Ranking (Low to High):

1. RDS Events

2. Config Rules

3. Custom Config Recorder

Hybrid Approach to use best tool for the job

Record the task and the approach in tabular format or some data store overview