- [Instructor] In this video,
you'll see how to enable data residency controls
using AWS control tower guardrails.
With this feature, you can better control data residency,
reduce project delays and match guardrails
to your specific business needs.
To get started, let's navigate to AWS control tower.
Guardrails are pre-packaged rules that automate security
and operational controls across a multi account environment.
We'll search for guardrails pertaining to data residency.
Data residency is a requirement to store and process data
in a particular geographical location.
These guardrails make it possible to quickly
and easily ensure that customer data is not stored
or processed outside of their specific region or regions.
To see an example,
let's enable a guardrail that denies access
to AWS based on the requested AWS region.
This guardrail is not yet enabled
on any organization units or OUs.
Let's briefly review its components.
To enable this particular guardrail,
we need to modify our landing zone settings.
We'll enable the region deny feature
so that access is prohibited across non-government regions.
The five regions listed here are governed by control tower
and will not be denied access
to AWS services and operations.
The update to our landing zone is complete.
Let's review our landing zone settings
to confirm that this guardrail is now enabled.
As you can see, we have five governed regions.
For all the other non governed regions,
this guardrail now denies access.
Next, let's log into a non-governed region
to verify that access is being denied.
To test this experience,
we'll navigate to our Virtual Private Cloud or VPC console,
and try to launch a new VPC.
Since we're in a non-governed region,
we receive a message saying we're unauthorized
to perform this action.
Next we'll navigate to one of our governed regions.
Since this region is governed,
we're able to see and use the various resources
and we have desired, create VPCs.
Let's return to our control tower landing zone settings.
Let's navigate to AWS organizations
to look at the OU that had the guardrail applied.
Let's find the guard rail policy we applied.
Here, we can view the templatized parameters
that restrict AWS region access.
Here are the five regions that were excluded
from this deny guardrail.
As we scroll, we see all the global AWS resources
that are excluded from the denied list.
Next, let's try out two more data residency guardrails.
We're going to apply a detection guardrail,
and a preventive guardrail on a different OU.
Again, we'll filter on data residency guardrails.
We can sort the guardrails by behavior.
Next, we'll select a detection guardrail we want to enable.
This guardrail detects whether Amazon S3 settings
block public access.
We'll enable this guardrail on the data resident OU.
Let's navigate to the OU to confirm
that the S3 access guardrail has been enabled.
Here, we can see the first guardrail we applied
and the one we just enabled.
Next, we'll apply the preventive guardrail.
This guardrail will disable internet access
for new Amazon VPCs.
Please note that this guardrail will not apply
to current or existing VPCs, let's enable it.
Again, we'll select our data resident OU,
enable the guardrail and verify it's enablement.
The guardrail is enabled.
Let's scroll back up
and investigate a non-compliant resource.
Here we can see a reported account
that has S3 public access on and enabled.
To make this resource compliant per the policy
of the detection guardrail,
we'll navigate to S3 and disable public access.
Now our S3 settings are compliant
with the newly applied detection guardrail.
Let's confirm this in control tower.
As you can see, the guard rail is no longer detecting
a non-compliant resource.
Next, let's return to the VPC console
to test the preventive guardrail we applied earlier.
Let's try to create a VPC that has internet access.
The VPC creation process will eventually be interrupted
by an error message,
accompanied by a rollback of the resources used
for the operation.
Here's the full error message telling us
we're not authorized to perform this operation.
If we wanted to, we could still create VPCs
without internet or public access
as our preventive guardrail only controls
for those conditions.
You've just seen how to enable data residency controls
using AWS control tower guardrails.
You can learn more about this topic in the description
and links for this video.
Thanks for watching.
Now it's your turn to try.