AWS Governance
Multi-Account Strategy That Holds Compliance Scope.
What this hub covers
Multi-account is where compliance scope is either won or quietly lost. The guides below cover Control Tower, landing-zone topology, drift detection, Well-Architected reviews, and CI/CD that does not become an unaudited backdoor into prod. With AWS Audit Manager closed to new customers (effective 30 April 2026), evidence collection consolidates onto AWS Config conformance packs (regulator-aligned control sets, deployable across an Organization) and Security Hub Essentials on its resource-based pricing — the pairing we now recommend for every new engagement.
10 guides in this hub
Each one is written for a production AWS estate: the configuration, the trade-offs and what the auditor asks for. Part of the AWS Security & Compliance hub.
10 AWS Cloud Security Best Practices: An Implementation Guide for 2026
Most AWS security breaches come from misconfiguration, not AWS failures. Here are 10 concrete best practices to harden your AWS environment in 2026.
Read the guideHow to Set Up AWS Control Tower for Multi-Account Governance
AWS Control Tower automates multi-account management: it sets up guardrails, enforces compliance policies, and centralizes billing. This guide covers setup, customization, and production governance patterns.
Read the guideAWS Multi-Account Strategy: Landing Zone Best Practices
A single AWS account is fine for week one. By month six, audit teams, security reviewers, and your CFO will all want their own boundary. How to structure AWS Organizations with Control Tower and a landing zone that doesn't have to be re-architected at scale.
Read the guideContinuous Compliance Automation on AWS (2026): Config Conformance Packs, SSM Auto-Remediation, and Audit Manager — Past Security Hub
Security Hub detects control failures. It is not the compliance pipeline, and treating it as one is why teams still scramble for evidence at audit time. The four jobs are distinct: AWS Config detects drift, conformance packs deploy rules org-wide as immutable bundles, SSM Automation remediates the safe class, and evidence accrues via conformance-pack exports plus Security Hub control status (Audit Manager only if you onboarded before it closed to new customers on 30 April 2026). This post has the tool-per-job matrix, a conformance pack with auto-remediation, and the auto-remediation gotcha to design around.
Read the guideCross-Account Patterns Beyond the Landing Zone (2026): RAM, Delegated Admin, Route 53 Profiles, RCPs, and Declarative Policies
Your landing zone set up the org, OUs, and baseline SCPs. Then most teams stall, duplicating resources per account and wiring brittle cross-account role chains. Since re:Invent 2024 the toolkit changed: RCPs bound what can be done TO a resource (even by external principals), declarative policies enforce EC2/VPC/EBS config state that survives new APIs, and one Route 53 Profile can push DNS to up to 5,000 VPCs. This post has the mechanism-by-job decision matrix and a rollout order that avoids lockouts.
Read the guideAWS CloudTrail Production Setup: Multi-Region Trails, Log File Validation, and CloudTrail Lake
Production CloudTrail: multi-region org trails, log validation, CMK, Lake + Athena. July 2026 checklist. Event History is not enough.
Read the guideAWS Well-Architected Framework & Review Guide: The 6 Pillars Explained
The 6 Well-Architected pillars, with what each costs, what each covers, and how to apply them to a workload before AWS's solutions architects do it for you.
Read the guideAWS Infrastructure Drift Detection: How to Find and Fix Config Drift Before It Breaks Production
Detect AWS config drift with terraform plan + Config. July 2026 runbook: schedule, triage, prevent console writes.
Read the guideAWS Resource Hardening Quick Wins: DMS, OpenSearch, SageMaker, and Lambda Runtimes
Hardening quick wins: private DMS, OpenSearch encryption, SageMaker VPC-only, Lambda runtime EOL. July 2026 checklist.
Read the guideGitHub Actions for AWS: Secure CI/CD Pipeline Patterns That Ship Code Safely
GitHub Actions patterns for AWS workloads in production: OIDC authentication, pinned actions, blue-green deployments, build caching, and the security mistakes that leave your pipeline open to supply chain attacks.
Read the guideServices and neighbouring hubs
The engagements that apply these guides, in navy, and the hubs buyers usually read alongside this one.
AWS Well-Architected Review — Free Assessment
Free AWS Well-Architected Review from FactualMinds. Identify risks, compliance gaps, and optimization opportunities.
Explore the serviceCloud Compliance Services — HIPAA, SOC 2, PCI DSS on AWS
Cloud compliance services — HIPAA, SOC 2, PCI DSS, ISO 27001, GDPR. Expert consulting from FactualMinds.
Explore the serviceCompliance Frameworks
Framework-by-framework guidance — what auditors expect, what AWS provides, and what your team configures.
Open the hubIAM & Access Control
Least-privilege patterns, workforce SSO with identity propagation, customer auth, and fine-grained Cedar-policy authorization.
Open the hubThreat Detection & Response
Continuous monitoring, Security Hub AI inventory, agentless vulnerability scanning, OCSF data lakes, and automated remediation.
Open the hubCommon questions
- What replaces AWS Audit Manager for evidence collection?
- AWS Audit Manager closed to new customers on 30 April 2026 — it remains operational for existing customers but is no longer the recommended starting point. The replacement pattern: AWS Config conformance packs deliver the regulator-aligned control sets (CIS AWS Foundations, NIST 800-53 r5, HIPAA, PCI DSS 4.0, FedRAMP Moderate, K-ISMS, RBI, MAS) deployable Organization-wide; Security Hub Essentials runs the continuous standards checks and emits the normalized findings; CloudTrail Lake (or Security Lake on OCSF 1.1) holds the auditable event store. Evidence is screenshots of Security Hub control status plus exported Config rule compliance state plus CloudTrail Lake queries — the same evidence Audit Manager produced, now without the closed product in the stack.
- Control Tower vs AWS Organizations + Terraform — when does each win?
- Control Tower wins when your account topology fits the AWS reference landing zone (foundational OUs: Security, Sandbox, Workloads with Prod/Non-Prod sub-OUs) and you want opinionated guardrails (preventive SCPs, detective Config rules, AWS-managed log archive and audit accounts) on a click-to-deploy pattern. Organizations + Terraform (or AWS Account Factory for Terraform / ALZ-Terraform) wins when you need account topology Control Tower will not give you cleanly — for example, a strict per-tenant account model for SaaS, regulated topologies that move log archive to a private account, or air-gapped GovCloud designs. The gap has narrowed: Account Factory for Terraform can now provision many landing-zone resources Control Tower used to own. Pick Control Tower if you are starting fresh and at fewer than ~50 accounts; pick Organizations + IaC if your model is already custom or going to >100 accounts.
- How often should we run an AWS Well-Architected Review?
- Annually for every production workload, plus before any significant launch (new region, new framework certification, major architecture change). The Well-Architected Tool now covers six pillars — Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability — and lenses for Serverless, SaaS, ML, IoT, FinServ, Healthcare, GenAI, and others. AWS Partners with the Well-Architected Partner status (FactualMinds is one) can run the review, capture the High-Risk Items (HRIs), and apply for AWS Well-Architected Funding to remediate the top items. Treat the review as a programmatic risk register, not a marketing exercise — every HRI maps to a Jira ticket with a deadline.
Apply this to your environment
Our consulting engagements apply this guidance to your specific environment, regulatory scope and threat model.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}