AWS Foundation Map

Published on December 29, 2023

Start with Organizations, account boundaries, organizational units, service control policies, centralized identity, and billing. Use accounts to contain privileges, quotas, costs, and failures rather than placing every environment in one account.

• Identity: IAM roles, federation, IAM Identity Center, workload roles, and break-glass access.
• Network: VPCs, subnets, route tables, security groups, network ACLs, Transit Gateway, Route 53, and controlled egress.
• Compute: EC2, Auto Scaling, Lambda, ECS, and EKS according to workload ownership and isolation.
• Data: S3, EBS, RDS, DynamoDB, ElastiCache, and managed streaming with explicit consistency and recovery requirements.
• Security and evidence: CloudTrail, Config, GuardDuty, Security Hub, KMS, organization policy, and central log retention.
• Operations and cost: CloudWatch, Systems Manager, Backup, budgets, allocation tags, and unit-cost reporting.

Document region strategy, cross-account access, key ownership, service quotas, backup restoration, and the path for changing foundational policy.