University of British Columbia Cloud Innovation Centre: Governing an innovation hub using AWS management services

This article discusses how the University of British Columbia Cloud Innovation Centre (CIC) manages an AWS innovation hub using various AWS management services and governance practices.

Specifically, the article covers:

• The high-level technical solution using AWS Control Tower, AWS Organizations, AWS IAM Identity Center, AWS Security Hub, and AWS IAM for account management, identity management, and security
• The use of organizational units (OUs) and service control policies (SCPs) for applying management controls across projects and stakeholders
• Naming conventions and account associations for better visibility and cost analysis
• Managing access and permissions for different stakeholders like students, researchers, and collaborators
• Automating the bulk creation of AWS accounts using AWS CloudFormation, Amazon DynamoDB, AWS Lambda, and AWS Service Catalog
• Cost management using AWS Billing and Cost Management, consolidated billing, cost allocation tags, and billing alerts
• Monitoring and implementing security using AWS Security Hub, Amazon GuardDuty, Amazon Inspector, AWS Config, IAM, Amazon VPC, and security groups
• Balancing innovation and security by providing sandbox accounts for students while restricting access in project accounts