---
title: "CTP Topic 10 AWS Landing Zone (LZ) Data Collection, Tagging Related Security"
type: cloud-learning
source-type: video
category: "DevOps & SRE/10_OpenText-Series"
tags:
  - uncategorized
date-added: 2026-04-14
video-source: "nas:///volume2/work/Public Cloud Learning Sessions/CTP _ Topic 10_ AWS  Landing Zone (LZ) Data Collection, Tagging _ Related Security.mp4"
audio-source: ""
status: summarized (Gemini 摘要)
---

# CTP Topic 10 AWS Landing Zone (LZ) Data Collection, Tagging Related Security

**Source:** NAS `/volume2/work/Public Cloud Learning Sessions/CTP _ Topic 10_ AWS  Landing Zone (LZ) Data Collection, Tagging _ Related Security.mp4`

**Type:** VIDEO | **Category:** 10_OpenText-Series

**Status:** 🟡 Awaiting Whisper transcription → Summary

---

## 摘要

> ## AWS Landing Zones: Data Collection, Tagging, and Security

The session focuses on AWS landing zones, specifically data collection, tagging, and related security measures, including a demo. The primary goal is to explain tagging, its purpose, and how it's changing security practices.

A high-level review of deploying a new landing zone covers OUs, SCPs (security control policies), and resource tagging. The discussion highlights how firewalls interact with tagged resources and the advantages over traditional firewall rules. Pradeep demonstrates the firewall and its policy sets, along with an EC2 deployment example to illustrate policy enforcement.

*We ask a lot of questions so that we can then turn around and make sure we're putting the appropriate posture in the cloud and that we're protecting the resources appropriately.* A new strategy using layers of OUs to examine tags ensures correct tagging and necessary security controls. For instance, an ADM user cannot alter their tag to ITOM. SCPs are deny policies that grant resource access based on tag matching. When collecting machine information, the focus is on understanding what's being moved to the cloud and applying appropriate tags.

An example tag base includes machine names, owners (preferably PDLs), types (e.g., R&D), business units, products, environments (e.g., production), server roles, accounts, and app IDs. A layered approach is used in the firewall policies, starting with geo-blocking and progressing through type, BU, product, environment, and role checks. *Inter product is not allowed. Inter product is communications allowed.* The introduction of inline layers checks account numbers, streamlining rule management and automation. Tagging enables dynamic cloud environments without constant firewall adjustments, as policies are tag-based rather than IP-based.

The demo shows a Checkpoint firewall setup in the Frankfurt landing zone, reviewing tags and policy configurations. It demonstrates deploying an EC2 instance with tags and the errors that occur when tags are missing or incorrect. SCPs control which tags can be used in specific accounts. The ordered layer requires traffic to pass through each layer sequentially, while the inline layer uses a parent-child rule structure based on account numbers.


---

## 关键概念

-

---

## 行动项

-

---

## 相关视频

> 配对视频笔记链接（生成后填入）

---

*最后更新: 2026-04-14*
