Hi, I'm Matt from AWS and on today's episode of 'This is My Architecture,'
I'm joined by Reinhold from Blackboard, thanks for joining.
Hey, Matt, thank you.
So tell us about Blackboard.
So Blackboard now part of Anthology through recent mergers is an education software provider.
So we sell educational tools to organizations, government agencies around the world.
Great, and you've been using AWS, you've been in the cloud for many years. Is that right?
We have yeah, we started our journey about six, seven years ago,
moving our first application and then have grown ever since in AWS.
Six, seven years in the cloud, you know, is relatively long time.
I Imagine, as you've been moving more applications, your footprint has grown?
Yeah, definitely.
So we reserve about 150 million users in 80 plus countries.
So yeah, our footprint is quite large.
Great, and so in these accounts, I imagine you're adding more accounts as you grow?
We do we use about 120 accounts right now
and have plans to really grow that much larger in terms of numbers.
Great, so 120 Plus accounts,
I'm guessing you need some type of a baseline configuration for these accounts
to kind of keep things secure and keep things operationally efficient?
Yeah, it is really four things that we be provisioned in each account
that did a pretty fundamental for us to stick with our compliance program.
It's single sign on AWS Config,
IAM roles and in CloudTrail roles.
Great.
Let's talk real quick about how you use each of these.
So AWS SSO, so I imagine it's for federation for access to the accounts?
That's correct, we use AWS as a single identity provider
within the AWS service ecosystem.
We have a connected to Okta, which is our identity provider,
and then we're provisioning a single identity in SSO through that.
Okay, yeah, Okta is a great AWS partner.
So using them as your identity provider connected to AWS SSO.
Are you centralizing your identity management?
We are, yeah.
So it's every user gets a single identity, centralized identity within that system.
And then role based access, I'm guessing through-
Yeah, so we used to have users and roles within the accounts.
Since we move to single identity, our IAM roles are tied to that single identity within the account.
So that's how we've really streamlined that setup.
Great, okay, so streamlined, simplified identity management that is ultimately more secure.
And then AWS Config, how are you using that?
So in AWS Config, we really set about rules of compliant internal compliance program,
in we're setting up the recording every account to watch for drift from the rules
and make sure the configuration stays up to date.
Okay, so you have config recorders and config rules to detect drift,
I guess, detective controls, if configuration of AWS services changed, is that right?
That's correct, yeah.
So AWS Config to make sure everything is set up as it should be and shouldn't change.
CloudTrail for centralized log management, I'm guessing?
Yeah, we use CloudTrail for centralized log management
to really understand and monitor what's going on in the accounts.
And where do those logs go?
Are they going into each individual account into a centralized account?
So they used to be in each individual accounts,
But now we switch to a centralized account
to really start aggregating all the logs in a single place
and create some sort of single pane of glass for all that.
Okay, that's great.
So these are your great best practices that we want all of our customers to do.
You know, your scale, you said 120 Plus accounts
that becomes operationally difficult to do at scale.
So I imagine you introduced some automation to help you with that, is that right?
It does, yeah, that's where we really started looking at Control Tower,
leveraging both Service Catalog and Organizations
to ensure that we can automate the setup and not have to do that manually every time.
Okay, so Control Tower is setting up your, what we call landing zone, I guess,
with these baseline services and adding the accounts into an organization?
Great, that's correct, yeah.
And how are you using Organizations? Are using different OUs or how you have it set up?
Yeah, so we're using a different organization units,
mostly later development lifecycle.
So we have the development OUs, production OUs,
and tying our accounts to that.
Great. And then I guess the last piece here is, Control Tower is using Service Catalog
for account creation, is that right?
It's automating all the account creation and provisioning of services inside the accounts, yeah.
Yeah, perfect. So you have Control Tower, kind of running the ship in a multi-account environment,
managed by Organizations, a Service Catalog for account creation,
and then all these best practices of setup with the individual services within the account.
You know, this is really what we want all multi-account environments look like.
It's safe, it's secure, and it's operationally efficient.
So nice work. Yeah, it works very fast, thank you.
Great, thanks for sharing. Yeah.
And thanks for watching, 'This is My Architecture.'