Landing Zone and Mobilize package

AWS will advise and assist Customer with the following activities, in a non-production environment:

• Facilitating workshops with Customer to discuss selected requirements related to organization structure, account structure, operations, security, governance, and compliance.
• Gathering key requirements and advise on AWS general best practices for design and setup of network topology.
• Advising Customer on AWS general best practices for account structure, networking, Infrastructure as Code, access management, security logging and monitoring, infrastructure, incident response, and data security.
• Advising Customer on the AWS Shared Responsibility Model, including the security capabilities framework and enterprise security principles to support a successful cloud transformation.
• Developing an initial minimum-security baseline (MSB) based on Customer’s selected compliance requirements and AWS general best practices (such as identity and access management (IAM), detection/logging and monitoring, infrastructure security, data protection, and incident response).
• Reviewing Customer’s current and planned future state cloud architecture.
• Documenting Customer’s decisions across technology, operations, and security areas.
• Developing referenceable playbooks and runbooks, supported by relevant sample code and architectural diagrams, to automate the implementation of the AWS platform, cloud native capabilities, and deployment processes.

AWS will advise and assist Customer with the following activities, in a non-production environment:

• Designing and implementing a scalable and integrated platform with Customer’s existing ecosystem.
• Securing the platform in accordance with Customer-defined policies and requirements
• Defining AWS Organizations organizational unit structure and AWS account vending machine
• Setting up domain name system (DNS), including setup for name resolution for internet, on-premises, and cloud-hosted DNS zones
• Setting up network with routes defined for internet, inter-account, and cloud to on-premises (and vice versa) routing
• An automated, operational, and secure environment utilizing appropriate AWS Services and the developed MSB
• Providing secure and operational account access integrated with Customer’s existing identity provider solution
• Automating detective and preventative guardrail rules in new accounts that Customer creates
• Deploying resources aligned to Customer specifications identified in the design phase, this includes but is not limited to the following resources:
  • Network infrastructure
  • Detective and preventative security controls
  • Event management mechanisms and guard rails
  • Monitoring
  • Access-based controls
  • Data storage
• Automating infrastructure deployments and integrating with Customer’s overall continuous integration/continuous deployment strategy

AWS will provide the following deliverables to the Customer during the engagement (“Deliverables”):

• Documents:
  • Implementation guide to include instructions to aid in the preparation and deployment of the solution
  • Runbooks to assist in the operational activities of the solution
  • Decision log tracker as developed during these activities
  • Project management framework document
• Source code:
  • Configuration files representative of the documented decisions
  • Proof-of-concept code as developed during these activities

• Advise Customer on AWS best practices regarding use of AWS Services with respect to configuration, change, and event management and operations as code
• Assist Customer in evaluating current enterprise operations model, functions, and organization
• Assist Customer in determining and documenting a future-state operations model, function, and organization
• Assist Customer with performing gap analysis between Customer’s current IT operations and operational readiness state cloud operations
• Assist Customer with developing a license management strategy
• Assist Customer in assessing new operational accountabilities and provide an outline of a responsible, accountable, consulted, and informed (RACI) matrix with recommendations following AWS general best practices
• Assist Customer with the design and build of operational capabilities which may include:
  • Amazon Machine Image (AMI) Management
  • Patch management
  • Tag management
  • Event and incident management
  • Configuration process
  • Change and release process
  • Availability and continuity management
  • Account and user management
• Assist Customer in creating operational processes, based on AWS general best practices, including documentation of the recommended approach and the recommended technical detail for execution of each of the operational capabilities on AWS Services, supported by relevant sample code
• Assist Customer in baselining each respective core operational capability
• Assist Customer in implementing the agreed upon solution for operational readiness, in a non-production environment

Customer will:

• Define key requirements and principles for cloud operational model
• Provide access to existing documentation related to:
  • Current operating model
  • Key IT services management (ITSM) domains

AWS will provide Customer with the following Deliverables

• Documents
  • Operational capabilities and customer operating model
  • AMI management capability discovery and analysis
  • AMI management design
  • Configuration management discovery and analysis
  • Configuration management design
  • Patch management discovery and analysis
  • Patch management design
  • Tag management discovery and analysis
  • Tag management design
  • License management discovery and analysis
  • License management design
  • Change management discovery and analysis
  • Change management design
  • Event and incident management discovery and analysis
  • Event and incident management design
  • Account and user management discovery and analysis
  • Account and user management design
  • Availability and continuity management discovery and analysis
  • Availability and continuity management design