Every client and customer cares deeply about security. Regardless of the domain, industry or specific application, when a workload is moved to or created in AWS, security and data protection are always important components of the architectural design. To meet these critical security requirements, organizations use AWS Control Tower and Landing Zones, which enable a secure and compliant foundation for your AWS environment.

Setting up an AWS Control Tower and Landing Zone

Setting up a Control Tower and Landing Zone for your enterprise applications can help mitigate many security risks and provide a consolidated and comprehensive view of your AWS landscape. AWS Control Tower and Landing Zone thoroughly propagate the concept of “define once and use across”. This enables you to set up a well-architected, multi-account environment in hours instead of weeks or months, utilizing best practice blueprints tailored to the organization’s needs.

As a security best practice, it is always recommended to have a multi-account approach, where accounts can be categorized based on application/environment/business-unit etc. This approach enhances security through segregation and isolation of workloads and data. This will also significantly reduce the surface attack area when there is a security compromise.

As your organization and customer needs grow, you will have a bunch of accounts to handle – that is when the Control Tower and Landing Zone comes to the rescue as it provides centralized control and policy management across the accounts.

Figure 1 here depicts how you can have all AWS accounts under AWS Organizations and tap on Control Tower features to enforce security and governance.

Setting up a Landing Zone is always one of the best approaches for customer applications running on multiple AWS accounts, if you want to ensure strict traffic inspection, central security logging, and cost savings.

Building a Landing Zone with AWS Control Tower: Core concepts

Here are the core concepts at play while establishing a robust AWS Control Tower and Landing Zone foundational implementation.

Organizational Units: When it comes to planning Organizational Units (OUs), there is no one-size-fits-all approach. It should be based on the best way you can categorize your workloads.

For example, an enterprise company with numerous applications, business units and multiple environments (e.g. Dev/UAT/Prod) can be structured as shown below.

Service Control Policies/Guardrails: Service Control Policies (SCPs) are effectively a policy-driven preventive guardrail. AWS SCPs/guardrails provide organizations with robust tools for optimizing and centrally managing governance, security & compliance enforcement, permission management and operational efficiency. These features make them critical components of a well-architected multi-account strategy in AWS. We recommend you enable all the required guardrails as per industry standards. To get started with AWS Best Practice guardrails, you can refer to the official AWS guidance documentation found here.

You could also create a Test OU within which you can enable and test the effect of guardrails without impacting any production workloads. This is prudent when teams may be unaware of how an SCP guardrail may impact your team’s day to day activities.

Networking for Landing Zone: This is the most important part which often consumes a lot of time for planning. We recommend that organizations should plan for three different types of traffic flow:

• Ingress traffic: The Landing Zone should have a highly available firewall for ingress traffic inspection. Organizations can choose from a number of firewall appliances in the market today, including native AWS Network Firewall.
• Egress traffic: Plan for a central NAT gateway to manage all the egress traffic originating from workload VPCs from all AWS accounts and ensure it is being inspected using the firewall. This saves cost when all your workload VPCs use a central NAT gateway instead of individual NAT gateways for VPCs and enhances security through comprehensive monitoring with a holistic view.
• Inter-VPC traffic: Also referred to as East-West traffic, this is internal traffic between the VPCs within the AWS accounts. Best practice is to have inter-VPC traffic inspected using a firewall to detect internal threats, prevent data exfiltration etc. However, you can choose to ignore inspection for some VPCs – for example, those which require high throughput and require less latency.

We recommend you further define any other flows for your workloads and analyse its effects including latency, costs when it traverses transit gateway, or other cost incurring components.

Figure 3 here shows one of the ways you can design your architecture to achieve the above-mentioned traffic inspection and flows. It uses hub and spoke architecture using AWS transit gateway.

To read more about hub and spoke architecture refer to this AWS article here.

Logging and monitoring: Logs can be considered as a critical asset in any infrastructure. There are a number of different kinds like VPC flow logs, firewall logs, DNS logs, transit gateway attachment logs, application logs, and more. AWS Control Tower offers you a way to centrally store these logs in a separate “Log Archive” account. While AWS Control Tower has the capability to implement centralized storage, the responsibility of log ingestion implementation is allocated to the organization. The logs can be further ingested to other Security Information and Event Management (SIEM) platforms for analytics.

Putting things in motion

By continuously monitoring workload performance and analysing customer feedback, organizations can effectively adjust resources and processes to align with evolving customer needs, ensuring enhanced service delivery and operational efficiency.

AWS offers native service called AWS CloudWatch, to get you started with Logging and Monitoring – refer to this official AWS documentation. This should help you understand what AWS services’ logs can be centralized, among other important notes.

To sum up, using the AWS Control Tower service will unveil a holistic view of security and governance across all AWS accounts within the organization. Setting up a Landing Zone makes it easier to have total control on all of the traffic entering and exiting your AWS accounts. This will significantly reduce the surface attack area and can efficiently create a scalable architecture and ensure security best practices.

For additional Design Consultation and Cloud Engineering support, Cloud Kinetics currently offers a refined AWS Secure Landing Zone (SLZ) implementation, available here via AWS Marketplace. You can also get in touch with us directly here.

The post AWS Control Tower and Landing Zone: Architecture & Best Practices appeared first on Cloud Kinetics.

“We are thrilled to recognize Intel’s Partner Award winners across APJ and India,” said Trevor Vickers, Vice President and General Manager of Intel’s Global Partners and Support. “Our partners have achieved the highest standards in growth, innovation, and market acceleration. Congratulations to Cloud Kinetics for your remarkable achievements. We value your collaborative partnership and look forward to continued innovation and success.”

“We are proud to honor the exceptional collaboration between Intel and Cloud Kinetics in driving innovation and excellence in technology. APJ continues to be a leading growth region, and we value the collaboration with our partners in offering the best solutions and experiences to our customers. Thank you,” said Hans Chuang, Vice President & General Manager of Sales, Marketing and Communications Group – Asia Pacific and Japan.

Cloud Kinetics was awarded for continually applying their expertise in ways that help Intel’s products outshine competitors and win customers. Cloud Kinetics has also made significant contributions to revenue and increasing the number of channel partners reached on behalf of Intel.

To qualify as a winner in this category, organizations must be a member of the Intel Partner Alliance; demonstrate year over year (YoY) growth, as well as an increase in overall partner revenue, number of partners adopted, and/or is well-positioned to increase their expected YoY growth.

The post Cloud Kinetics Wins Outstanding Growth – Managed Services Award From Intel Corporation appeared first on Cloud Kinetics.

For industries like manufacturing, transportation, and logistics, embracing modern cloud- and AI-driven solutions is key to staying ahead of the curve. The right technology can not only empower you to adapt swiftly to market changes but also unlock opportunities for growth and innovation.

We had the pleasure of hosting industry leaders and a select group of CXO peers for an intimate roundtable discussion on the transformative benefits of cloud- and AI-powered business strategies.

Takeaways from the event:

• Gaining real-time visibility into your entire supply chain for better decision-making
• Streamlining and automate logistics workflows to achieve maximum efficiency
• Eliminating capacity guesswork and optimize resource utilization
• Leveraging data-driven insights to boost profitability and drive growth

The post Modernize Your IT Stack With Cloud & AI: CXO Roundtable appeared first on Cloud Kinetics.

We gathered industry professionals on 24 May at Shangri La Singapore for an exclusive roundtable discussion on how enterprises in the Manufacturing, Transport and Logistics sectors can unlock real-time visibility, minimize disruptions and streamline operations with a cloud-smart, AI-driven supply chain strategy.

Topics covered:

• Getting real-time visibility into your operations: Make smarter decisions by gaining insights into operations, including proactive monitoring and management of supply chain disruptions
• Eliminating capacity guesswork: Optimize and integrate ERP systems to enhance inventory planning and forecasting accuracy
• Unlocking innovation & agility: Streamline and automate logistics workflows for greater efficiency, speed, transparency
• Harnessing AI-powered insights: Integrate disparate data from various sources and utilize AI/ML to identify areas for process improvement in real-time

With Cloud Kinetics, you get the insights and strategies you need from our industry experts to become smarter, faster, leaner, and more responsive in your daily operations. Contact our team of cloud experts if you have any questions on these strategies or need a no-obligation discussion for your organization.

The post CXO Roundtable Dinner: Modernize Your IT Stack With <br>Cloud & AI Powered Strategies appeared first on Cloud Kinetics.

As part of their optimization journey, Sieu Viet wanted to review their cloud infrastructure on AWS to take stock of existing capabilities and to identify next steps aligned with their business goals. In addition, a planned CRM system change was lined up as the company headed into its next phase of growth.

“Our partnership with Cloud Kinetics has been invaluable as we navigate our cloud journey and scale our digital infrastructure. Their expertise and focus on continuous optimization perfectly complement our business goals, making them a trusted partner in our transformation strategy.” Dat Vo, Head of Tech, Sieu Viet

The post Recruitment Giant Gets Future Ready With AWS Well-Architected & Freshsales CRM appeared first on Cloud Kinetics.

Las Vegas, November 2023 – Cloud Kinetics has been honoured with the 2023 Geo and Global AWS Partner Award, recognizing leaders around the globe playing a key role helping customers drive innovation and build solutions on Amazon Web Services (AWS).

Announced during a Partner Awards Gala at AWS re:Invent 2023 in Las Vegas, the Geo and Global AWS Partner Awards recognize a wide range of AWS Partners, whose business models have embraced specialization, innovation, and cooperation over the past year. Geo and Global AWS Partner Awards recognize partners whose business models continue to evolve and thrive on AWS as they work with customers.

As a Premier Consulting Partner of AWS, Cloud Kinetics has spearheaded over 200 successful AWS cloud migrations and has consistently demonstrated deep expertise in delivering cutting-edge AWS technologies to help clients solve complex business challenges. With speciality certifications spanning Infrastructure Automation, Applications Modernization, Data & Analytics, DevOps and Storage, Cloud Kinetics sets itself apart as one of the few managed services partners in the region to hold key competencies across a broad spectrum of cloud services – going beyond cloud migration to empower enterprises to unlock additional value and efficiency through robust automation and data operations. Cloud Kinetics leverages specialist in-house expertise and strong and scalable operations in over 8 countries across Asia, as well as Australia and the United States to unlock digital transformation for its customers.

“We are honoured to receive the distinguished AWS Innovation Partner of the Year – APJ award. At Cloud Kinetics, we believe in pushing the boundaries of what is possible in the cloud, to enable businesses to not only stay at the forefront of today’s economy but to also anticipate and address future challenges with confidence,” said Saleh M “Haji” Munshi, Group CEO of Cloud Kinetics. “Our longstanding relationship with AWS underscores our shared commitment to excellence, innovation and customer success, and we look forward to expanding our collaborations to ensure our customers derive greater value from the latest advancements AWS has to offer.”

For the second year in a row, Geo and Global AWS Partner Awards included a self-nomination process across several award categories, which are awarded at both the geo and global level. All AWS Partners were invited to participate and submit a nomination. Award submissions were reviewed by a third-party, Canalys, and selected with special emphasis placed on customer success use cases presented in the nomination form.

In addition, there were a number of data-driven award categories, which comprised a unique set of metrics that helped measure AWS Partners’ performance within the past year. Canalys audited the datasets used to ensure that all measurements and calculations were objective and correct in nature.

The AWS Partner Network (APN) is a global program focused on helping companies build successful AWS-based businesses or solutions by providing business, technical, marketing, and go-to-market support. The APN includes independent software vendors (ISVs) and systems integrators (SIs) around the world, with AWS Partner participation growing significantly during the past 12 months.

A panel of AWS experts selected the winners based on strict criteria with third-party audit conducted by Canalys. Cloud Kinetics is excited to announce it has received the AWS Innovation Partner of the Year – APJ award recognizing organizations that deliver innovative consulting, professional, managed, and value-added resale services. Winners have demonstrated proof in delivering outstanding customer experience via an integrated lifecycle of services, from initial assessments, architecting, developing and deployment of cloud environments to ongoing migration and management of cloud infrastructure and applications.

The award comes to Cloud Kinetics on the heels of other industry accolades including the HashiCorp Focus Partner of the Year and the Channel Asia Cloud Tech Innovation Award, won for the third consecutive time.

The post Cloud Kinetics Wins AWS Innovation Partner – APJ Award For Driving Customer Innovation appeared first on Cloud Kinetics.

Highlights

We had robust discussions and insights from the experts who attended on:

• Unlocking Cloud Potential: Uncovering manifold cloud benefits beyond cost savings
• Architecting Cloud-Smart Strategy: Designing a well-defined modernization-led migration roadmap to drive unmatched agility and innovation
• Supercharging Cloud Operational Excellence: Optimizing efficiency, performance, and cost-effectiveness with cloud management tools

Interested in driving your own cloud transformation? Connect with our cloud experts for a no-obligation discussion here. We look forward to helping you power your migration journey and transform into a modern business!

The post From Cloud-First to Cloud-Smart: With Cloud Kinetics x AWS x Intel appeared first on Cloud Kinetics.

The post Building A Robust <br>Disaster Recovery Plan For Microfinance Platform Amartha appeared first on Cloud Kinetics.

We were thrilled to see the fantastic turnout, engaging discussions and thought-provoking questions that emerged during the session.

Panelists

Key takeaways from the webinar

🔑 Alignment Matters: The collaboration between finance and engineering teams is critical in managing cloud costs effectively. When these teams work hand-in-hand, it drives better financial visibility and accountability.

📊 Data-Driven Decisions: Leveraging data and analytics is essential to making informed decisions about cloud spend. We discussed the importance of tracking and analyzing usage patterns to optimize costs.

💡 Cloud Optimization Strategies: We explored various strategies and best practices for optimizing cloud costs, including rightsizing, reserved instances, and spot instances.

🤝 Effective Communication: Establishing clear communication channels and a common understanding of cloud cost management goals is crucial for success. Bridging the gap between these two teams can lead to cost savings and improved efficiency.

Our heartfelt thanks to our guest speakers and everyone who participated in the webinar. Your active engagement and insightful questions made this event a resounding success!

Finops 101 webinar: Catch the action here

Get in touch with us for a complimentary 30-minute connect with Aubrey Bent to help support your FinOps journey.

The post FinOps 101: Build Partnership Between Finance & Engineering Teams On Cloud Cost Optimization appeared first on Cloud Kinetics.