Identity Lifecycle
Human and service identities need distinct lifecycle decisions. Track ownership, reconcile inventories, and verify removal or transfer at enforcement points.
-
-
Resource Hierarchy
Resource position affects inherited controls, but billing, quota, and isolation scopes differ. Review each relationship before reorganizing the hierarchy.
-
Accounts, Guardrails, and the Landing Zone
A cloud foundation establishes access, policy, ownership, and connectivity. Plan the boundaries early and verify inherited controls as requirements change.
-
Service Control Policy
SCPs limit covered AWS principals without granting access. Resource-policy grants and principal identity determine which restrictions apply.
-
Cloud Accounts, Identity, and Landing Zones
A new service team needs somewhere safe to run code. This guide builds the account hierarchy, identity model, permission layers, and baselines that let a platform team hand out that place, then shows how to audit it.