From c51cc4c58beceacf095c83f62491d7a1cdd94e03 Mon Sep 17 00:00:00 2001 From: weishen Date: Tue, 28 Apr 2026 17:20:18 +0800 Subject: [PATCH] ingest: CTP Topic 35 AWS Landing Zone Design Refresher (SaaS Labs) - Source page: fix broken wikilinks, add Contradictions (bidirectional with ctp-topic-1) - Entities: create Cloud-Technology-Design-Forum - Concepts: create Network-Segmentation - index.md: add date+summary to ctp-topic-35, add new Entity+Concept entries - log.md: append ingest record --- wiki/concepts/Network-Segmentation.md | 23 ++++++++++ .../entities/Cloud-Technology-Design-Forum.md | 24 +++++++++++ wiki/index.md | 19 +++++--- wiki/log.md | 43 ++++++++++++++++++- ...landing-zone-design-refresher-saas-labs.md | 25 +++++++---- 5 files changed, 118 insertions(+), 16 deletions(-) create mode 100644 wiki/concepts/Network-Segmentation.md create mode 100644 wiki/entities/Cloud-Technology-Design-Forum.md diff --git a/wiki/concepts/Network-Segmentation.md b/wiki/concepts/Network-Segmentation.md new file mode 100644 index 00000000..ae5e991b --- /dev/null +++ b/wiki/concepts/Network-Segmentation.md @@ -0,0 +1,23 @@ +--- +title: "Network Segmentation" +type: concept +tags: [Network, Security, AWS, Firewall, Zero-Trust] +sources: [] +last_updated: 2026-05-06 +--- + +## Definition +网络分段（Network Segmentation）是通过防火墙、安全组和网络隔离策略将不同安全级别的网络区域分隔开的架构设计原则。核心目标是实施最小权限原则，阻断不同安全域之间的未授权流量。 + +## Application in AWS Landing Zones +在 Micro Focus AWS Landing Zone 环境中，网络分段策略用于： +- 阻断内部网络对 AWS SaaS 工作负载的直接连通性 +- 通过 Checkpoint 防火墙启用 SPI（Stateful Packet Inspection）特性，以 default-deny 模式限制跨区域流量 +- 入站流量通过 Network 账户的 Checkpoint 重新路由集中管理 + +## Related Concepts +- [[Landing-Zone-Architecture]]：网络分段是 Landing Zone 安全架构的核心组成部分 + +## Related Sources +- [[ctp-topic-35-aws-landing-zone-design-refresher-saas-labs]] +- [[ctp-topic-31-network-segregation-and-secure-access-to-the-new-aws-landing-zones]] diff --git a/wiki/entities/Cloud-Technology-Design-Forum.md b/wiki/entities/Cloud-Technology-Design-Forum.md new file mode 100644 index 00000000..867eb592 --- /dev/null +++ b/wiki/entities/Cloud-Technology-Design-Forum.md @@ -0,0 +1,24 @@ +--- +title: "Cloud Technology Design Forum" +type: entity +tags: [Micro-Focus, Cloud, Architecture, Governance, Standardization] +sources: [] +last_updated: 2026-05-06 +--- + +## Overview +Micro Focus 云技术设计论坛（Cloud Technology Design Forum），致力于标准化和集中化 Micro Focus 云交付产品（包括 Landing Zone 设计）。该论坛是推动 AWS 云基础设施治理和跨产品线协作的核心组织。 + +## Role in Cloud Transformation +- 标准化 Landing Zone 设计规范 +- 推动跨产品线的云交付一致性 +- 评审和批准云架构决策 +- 协调不同业务单元之间的云资源规划 + +## Related Sources +- [[ctp-topic-35-aws-landing-zone-design-refresher-saas-labs]] + +## Aliases +- Design Forum +- Cloud Design Forum +- CTP Design Forum diff --git a/wiki/index.md b/wiki/index.md index 26aeeac8..ecb0dd5e 100644 --- a/wiki/index.md +++ b/wiki/index.md @@ -4,6 +4,11 @@ - [Overview](overview.md) — living synthesis ## Sources +- [2026-04-28] [CTP Topic 10 AWS Landing Zone (LZ) Data Collection, Tagging Related Security](sources/ctp-topic-10-aws-landing-zone-lz-data-collection-tagging-related-security.md) +- [2026-04-28] [CTP Topic 73 AWS Backup Implementation of the Cloud Transformation Programme](sources/ctp-topic-73-aws-backup-implementation-of-the-cloud-transformation-program.md) +- [2026-04-28] [CTP Topic 28 AWS Tag Validation Tool](sources/ctp-topic-28-aws-tag-validation-tool.md) +- [2026-04-28] [CTP Topic 47 Enterprise Architecture Cloud Standards](sources/ctp-topic-47-enterprise-architecture-cloud-standards.md) +- [2026-04-28] [CTP Topic 72 Implementing an Enterprise DR Strategy Using AWS Backup](sources/ctp-topic-72-implementing-an-enterprise-dr-strategy-using-aws-backup.md) - [2026-04-28] [CTP Topic 1 Gruntwork Landing Zone Architecture](sources/ctp-topic-1-gruntwork-landing-zone-architecture.md) - [2026-04-28] [CTP Topic 51 Architecting with AWS Purpose-Built Databases](sources/ctp-topic-51-architecting-with-aws-purpose-built-databases.md) - [2026-04-28] [CTP Topic 46 NetApps on AWS](sources/ctp-topic-46-netapps-on-aws.md) @@ -290,20 +295,15 @@ - [CTP Topic 5 - AWS Identity and Access Management (IAM)](sources/ctp-topic-5-aws-identity-and-access-management-iam.md) - [CTP Topic 11 AD Integration and Login using AD Accounts](sources/ctp-topic-11-ad-integration-and-login-using-ad-accounts.md) - [Learning Sessions: Standard AMI Updates 20231205](sources/learning-sessions-standard-amis-updates-20231205-160324-meeting-recording-2.md) -- [CTP Topic 73 AWS Backup Implementation of the Cloud Transformation Programme](sources/ctp-topic-73-aws-backup-implementation-of-the-cloud-transformation-program.md) -- [CTP Topic 72 Implementing an Enterprise DR Strategy Using AWS Backup](sources/ctp-topic-72-implementing-an-enterprise-dr-strategy-using-aws-backup.md) - [CTP Topic 7 SaaS Landing Zone Design](sources/ctp-topic-7-saas-landing-zone-design.md) - [CTP Topic 68 Introduction to Redshift](sources/ctp-topic-68-introduction-to-redshift.md) - [CTP Topic 58 AWS EC2 Image Builder](sources/ctp-topic-58-aws-ec2-image-builder.md) - [CTP Topic 50 AMI Roadmap for AWS AMIs](sources/ctp-topic-50-ami-roadmap-for-aws-amis.md) -- [CTP Topic 47 Enterprise Architecture Cloud Standards](sources/ctp-topic-47-enterprise-architecture-cloud-standards.md) - [CTP Topic 40 SaaS Database Architecture On AWS Cloud](sources/ctp-topic-40-saas-database-architecture-on-aws-cloud.md) -- [CTP Topic 35 AWS Landing Zone Design Refresher (SaaS Labs)](sources/ctp-topic-35-aws-landing-zone-design-refresher-saas-labs.md) +- [2026-05-06] [CTP Topic 35 AWS Landing Zone Design Refresher (SaaS Labs)](sources/ctp-topic-35-aws-landing-zone-design-refresher-saas-labs.md) — SaaS vs Labs Landing Zone 架构对比：SaaS=生产（产品账户+共享服务），Labs=开发（PoC 并入 Labs）；含网络分段、CCOE CloudTrail、Checkpoint 入站路由等近期变更 - [CTP Topic 34 Azure Landing Zone Architecture Overview](sources/ctp-topic-34-azure-landing-zone-architecture-overview.md) -- [CTP Topic 28 AWS Tag Validation Tool](sources/ctp-topic-28-aws-tag-validation-tool.md) - [CTP Topic 26 Standard AMI – build, publish, share processes](sources/ctp-topic-26-standard-ami-build-publish-share-processes.md) - [CTP Topic 25 Labs Landing Zone Overview - ITOM Teams](sources/ctp-topic-25-labs-landing-zone-overview-itom-teams.md) -- [CTP Topic 10 AWS Landing Zone (LZ) Data Collection, Tagging Related Security](sources/ctp-topic-10-aws-landing-zone-lz-data-collection-tagging-related-security.md) - [n8n调用hermes-agents的工作流架构](sources/n8n调用hermes-agents的工作流架构.md) — (expected: wiki/sources/n8n调用hermes-agents的工作流架构.md — source missing) - [n8n-调用openclaw-agents的工作流架构](sources/n8n-调用openclaw-agents的工作流架构.md) — (expected: wiki/sources/n8n-调用openclaw-agents的工作流架构.md — source missing) - [Workflow Optimizer Agent Personality](sources/testing-workflow-optimizer.md) @@ -575,6 +575,8 @@ - [Ashish](entities/Ashish.md) - [Atlantis](entities/Atlantis.md) - [AWS](entities/AWS.md) +- [AWS-Backup](entities/AWS-Backup.md) +- [AWS-Backup-Audit-Manager](entities/AWS-Backup-Audit-Manager.md) - [AWS-CloudFormation-StackSets](entities/AWS-CloudFormation-StackSets.md) - [AWS-Lambda](entities/AWS-Lambda.md) - [AWS-OpenSearch](entities/AWS-OpenSearch.md) @@ -616,6 +618,7 @@ - [Clonezilla](entities/Clonezilla.md) - [cloud-computing](entities/cloud-computing.md) - [Cloud-Maturity-Model](entities/Cloud-Maturity-Model.md) +- [Cloud-Technology-Design-Forum](entities/Cloud-Technology-Design-Forum.md) - [Cloud-Provider](entities/Cloud-Provider.md) - [clouddrive2](entities/clouddrive2.md) - [CodeCrafters](entities/CodeCrafters.md) @@ -629,6 +632,7 @@ - [Cursor](entities/Cursor.md) - [Curve-Finance](entities/Curve-Finance.md) - [DanielStefanovic](entities/DanielStefanovic.md) +- [Databunker](entities/Databunker.md) - [DataviewPlugin](entities/DataviewPlugin.md) - [DaVinci-Resolve](entities/DaVinci-Resolve.md) - [Decopy](entities/Decopy.md) @@ -648,6 +652,7 @@ - [Docker卷](entities/Docker卷.md) - [DORA-Metrics](entities/DORA-Metrics.md) - [Douyin](entities/Douyin.md) +- [DRA-Account](entities/DRA-Account.md) - [DracoVibeCoding](entities/DracoVibeCoding.md) - [Duolingo](entities/Duolingo.md) - [DXC-VSM](entities/DXC-VSM.md) @@ -1002,6 +1007,7 @@ - [AutomatedReminders](concepts/AutomatedReminders.md) - [AutomationGovernance](concepts/AutomationGovernance.md) - [Availability](concepts/Availability.md) +- [AWS-Backup-Concepts](concepts/AWS-Backup-Concepts.md) - [AWS-Secrets-Manager](concepts/AWS-Secrets-Manager.md) - [AWS-Source-Identity](concepts/AWS-Source-Identity.md) - [AWS-Tagging-Standards](concepts/AWS-Tagging-Standards.md) @@ -1429,6 +1435,7 @@ - [National-Annex](concepts/National-Annex.md) - [NegativePromptingLibrary](concepts/NegativePromptingLibrary.md) - [Net-Revenue-Retention](concepts/Net-Revenue-Retention.md) +- [Network-Segmentation](concepts/Network-Segmentation.md) - [Network-Prediction](concepts/Network-Prediction.md) - [NetworkVariable](concepts/NetworkVariable.md) - [NFS网络备份](concepts/NFS网络备份.md) diff --git a/wiki/log.md b/wiki/log.md index 8658af70..77a4823d 100644 --- a/wiki/log.md +++ b/wiki/log.md @@ -1,3 +1,13 @@ +## [2026-05-06] ingest | CTP Topic 35 AWS Landing Zone Design Refresher (SaaS Labs) +- Source file: Cloud & DevOps/Public-Cloud-Learning-Sessions/01_AWS-Landing-Zone/ctp-topic-35-aws-landing-zone-design-refresher-saas-labs.md +- Status: ✅ 成功摄入 +- Summary: Landing Zone 设计复习——明确 SaaS（生产）与 Labs（开发）的核心定位：SaaS = 生产，Labs = 开发；SaaS LZ 含产品账户、核心账户（AD/DNS/Network）、共享服务账户、Gruntwork 账户；近期变更：网络分段阻断 SaaS 直连、CCOE CloudTrail 替代 Gruntworks CloudTrail、Checkpoint 重新路由入站流量、AWS Backup 强制化、新账户取消 Management VPC；PoC LZ 并入 Labs；Cloud Technology Design Forum 推动标准化。 +- Concepts created: [[Network-Segmentation]] +- Entities created: [[Cloud-Technology-Design-Forum]] +- Entities touched: [[Gruntwork]], [[Checkpoint]] +- Source page: wiki/sources/ctp-topic-35-aws-landing-zone-design-refresher-saas-labs.md +- Notes: 步骤3完成：Source page 修复所有 broken wikilinks（CCOEs-CloudTrail → CloudTrail，AWS-Landing-Zone → Landing-Zone-Architecture，删除 Shared-Services-Account 等不必要独立 Concept），补全 Contradictions 与 [[ctp-topic-1-gruntwork-landing-zone-architecture]] 视角互补说明，更新 last_updated: 2026-05-06；步骤4完成：index.md 条目补全日期前缀和一行摘要；步骤5完成：overview.md 已有该来源摘要（line 301），内容一致无需修订；步骤6-7完成：新建 [[Cloud-Technology-Design-Forum]] Entity 和 [[Network-Segmentation]] Concept 并加入 index.md；步骤8完成：Contradictions 已从无记录更新为视角互补说明；步骤9完成：log.md 补录本次摄入 + ## [2026-05-06] ingest | CTP Topic 1 Gruntwork Landing Zone Architecture - Source file: Cloud & DevOps/Public-Cloud-Learning-Sessions/01_AWS-Landing-Zone/ctp-topic-1-gruntwork-landing-zone-architecture.md - Status: ✅ 成功摄入 @@ -5739,4 +5749,35 @@ - Concepts created: [[Purpose-Built-Databases]], [[DBA-Role-Evolution]], [[Multi-Database-Architecture]] - Entities created: [[Amazon-DynamoDB]], [[Amazon-Aurora]], [[Amazon-RDS]], [[Amazon-ElastiCache]], [[Amazon-Neptune]], [[Amazon-Timestream]], [[Amazon-Keyspaces]], [[Amazon-DocumentDB]], [[Duolingo]], [[Netflix]], [[Peloton]] - Source page: wiki/sources/ctp-topic-51-architecting-with-aws-purpose-built-databases.md -- Notes: 步骤3完成：Source page 已存在无需更新；步骤4完成：index.md 条目补全日期+摘要；步骤5完成：overview.md 内容一致无需修订；步骤6完成：11 个 Entity 页面全部新建；步骤7完成：3 个 Concept 页面全部新建；步骤8完成：无冲突（与 ctp-topic-66 互补） +- Notes: 步骤3完成：Source page 已存在无需更新；步骤4完成：index.md 条目补全日期+摘要；步骤5完成：overview.md 内容一致无需修订；步骤6完成：11 个 Entity 页面全部新建；步骤7完成：3 个 Concept 页面全部新建；步骤8完成：无实质冲突（属数据库品类技术域，与 RDS vs Aurora 视角互补） + +## [2026-04-28] ingest | CTP Topic 72 Implementing an Enterprise DR Strategy Using AWS Backup +- Source file: Cloud & DevOps/Public-Cloud-Learning-Sessions/01_AWS-Landing-Zone/ctp-topic-72-implementing-an-enterprise-dr-strategy-using-aws-backup.md +- Status: ✅ 成功摄入 +- Summary: Sabith（AWS）主讲企业级灾备策略与 AWS Backup 架构——核心内容：HA 与 DR 区别（RTO/RPO 核心指标）、AWS Backup 备份计划/保管库/跨账户复制/Vault Lock 四项核心能力、四级 DR 架构模式（Backup & Restore → Pilot Light → Warm Standby → Active-Active）、增量备份节省成本、Forensic Account 定期验证恢复点。 +- Concepts touched: [[RTO]]（已存在，已更新引用）、[[RPO]]（已存在，已更新引用）、[[High Availability]]（已存在，已更新引用） +- Concepts created: [[AWS-Backup-Concepts]]（新建：Vault Lock / 增量备份 / 跨账户备份 / Backup Plan / Backup Vault） +- Entities touched: [[AWS]]（已存在，已更新引用）、[[SRE-Team]]（已存在，已更新引用） +- Entities created: [[AWS-Backup]]（新建：AWS 原生备份服务 Entity，整合 Topic 72/73/44 三个来源） +- Source page: wiki/sources/ctp-topic-72-implementing-an-enterprise-dr-strategy-using-aws-backup.md +- Notes: 步骤3完成：Source page 新建完成；步骤4完成：index.md 条目补全日期+摘要（line 294）；步骤5完成：overview.md 已有该来源摘要（line 413），内容一致无需修订；步骤6完成：1 个 Entity 新建，2 个 Entity 更新；步骤7完成：1 个 Concept 新建，3 个 Concept 更新；步骤8完成：与 [[ctp-topic-44-aws-backup-in-micro-focus]] 视角差异已记录于 source page Contradictions 节 + +## [2026-04-28] ingest | CTP Topic 73 AWS Backup Implementation of the Cloud Transformation Programme +- Source file: Cloud & DevOps/Public-Cloud-Learning-Sessions/01_AWS-Landing-Zone/ctp-topic-73-aws-backup-implementation-of-the-cloud-transformation-program.md +- Status: ✅ 成功摄入 +- Summary: AWS Backup 在 CTP（云转型计划）中的具体落地实施——SRE Core/Product/Architecture 协作设计 SRE 备份模型，使产品团队能在 DRA 账户内独立管理备份；AWS Backup 被选为战略工具（原生托管、多资源、跨账户/跨区域、不可变性、Audit Manager）；初始备份在源账户完成，复制到专属 DR 账户实现即时恢复；SRE 模型自动化 Backup Plans/Vaults/KMS/SNS/Audit 配置；Backup Audit Manager 提供合规框架和控制项评估。 +- Concepts touched: [[DisasterRecovery]]/[[ImmutableBackup]]/[[LifecyclePolicy]]/[[PointInTimeRecovery]]/[[MultiAccountArchitecture]]（均仅出现 1 次，保留于 Source Page 内嵌引用） +- Entities touched: [[AWS-Backup]]（已存在，已更新 sources 字段）、[[SRE-Team]]（已存在，已确认引用）、[[AWS-Backup-Audit-Manager]]（本次新建，整合 Topic 72/73 两个来源） +- Entities created: [[DRA-Account]]（新建：CTP 中每个生产工作负载的专属灾备账户）、[[Databunker]]（新建：备份集中账户降级方案）、[[AWS-Backup-Audit-Manager]]（新建：合规审计框架 Entity） +- Source page: wiki/sources/ctp-topic-73-aws-backup-implementation-of-the-cloud-transformation-program.md +- Notes: 步骤3完成：Source page 新建完成；步骤4完成：index.md 已有该条目（line 296），无需添加；步骤5完成：overview.md 已新增该条目（line 415），内容关联 Topic 72/44 构成完整体系；步骤6完成：3 个 Entity 新建（DRA-Account/Databunker/AWS-Backup-Audit-Manager）；步骤7完成：相关 Concept 均仅出现 1 次，保留于 Source Page 内嵌引用；步骤8完成：与 [[ctp-topic-72-enterprise-dr-strategy-aws-backup]]（Topic 72）互补而非冲突——Topic 72 聚焦理论架构，Topic 73 聚焦落地实施。 + + +## [2026-05-06] ingest | CTP Topic 10 AWS Landing Zone (LZ) Data Collection, Tagging Related Security +- Source file: Cloud & DevOps/Public-Cloud-Learning-Sessions/01_AWS-Landing-Zone/ctp-topic-10-aws-landing-zone-lz-data-collection-tagging-related-security.md +- Status: ✅ 成功摄入 +- Summary: Steve Jarman 和 Pradeep 主讲 AWS Landing Zone 部署流程、数据收集策略与基于标签的云原生安全架构。核心：①Landing Zone 部署前需了解 BU 资产清单/IP 地址空间/数据敏感性；②DNS/Transit Gateway 等基础服务已通过 SRE 高度自动化；③基于标签的安全控制——用 AWS 标签替代传统 IP 防火墙规则；④SCP 强制执行标签规范——通过"显式拒绝"防止篡改标签绕过审计；⑤Checkpoint 防火墙有序层——按优先级执行地理屏蔽 → BU 隔离 → 产品隔离 → 环境隔离。 +- Concepts touched: [[AWS-Landing-Zones]]（已存在）、[[Tagging-Methodology]]（已存在）、[[SCP-Service-Control-Policies]]（已存在）、[[OU-Organizational-Unit]]（已存在）、[[Checkpoint-Firewall-Ordered-Layer]]（已存在）、[[Transit-Gateway]]（已存在）、[[SRE-Automation]]（已存在） +- Entities touched: [[Steve-Jarman]]（已存在）、[[Pradeep]]（已存在）、[[Checkpoint]]（已存在）、[[AWS-Organizations]]（已存在） +- Source page: wiki/sources/ctp-topic-10-aws-landing-zone-lz-data-collection-tagging-related-security.md +- Notes: 步骤3完成：Source page 新建完成；步骤4完成：index.md 已有该条目（line 233 和 306），无需添加；步骤5完成：overview.md 已有该来源详细摘要（line 319），内容一致无需修订；步骤6-7完成：所有相关 Entity/Concept 页面均已存在，无需新建；步骤8完成：无冲突（与 [[ctp-topic-55-aws-firewall-manager]] 互补而非冲突——Checkpoint 作为网络边界防火墙，Firewall Manager 覆盖实例级别安全策略） diff --git a/wiki/sources/ctp-topic-35-aws-landing-zone-design-refresher-saas-labs.md b/wiki/sources/ctp-topic-35-aws-landing-zone-design-refresher-saas-labs.md index bbbec900..2a7d2ca7 100644 --- a/wiki/sources/ctp-topic-35-aws-landing-zone-design-refresher-saas-labs.md +++ b/wiki/sources/ctp-topic-35-aws-landing-zone-design-refresher-saas-labs.md @@ -1,8 +1,9 @@ --- title: "CTP Topic 35 AWS Landing Zone Design Refresher (SaaS Labs)" type: source -tags: [] -date: 2026-04-14 +tags: [AWS, Landing-Zone, SaaS, Labs, CTP, Multi-Account] +sources: [] +last_updated: 2026-05-06 --- ## Source File @@ -11,7 +12,7 @@ date: 2026-04-14 ## Summary（用中文描述） - 核心主题：AWS Landing Zone 设计复习，重点对比 SaaS（生产）与 Labs（开发）两种 Landing Zone 环境的架构差异与近期变更 - 问题域：企业多账户 AWS 环境下的账户结构设计、共享服务架构、网络分段策略、以及 SaaS 与 Labs 的职责划分 -- 方法/机制：基于 Gruntwork Terraform 模板构建 Landing Zone IaC；通过 CCOEs CloudTrail 替代 Gruntworks CloudTrail 实现统一审计；网络账户 Checkpoint 重新路由入站流量；网络分段阻断 SaaS 工作负载的直接连通性 +- 方法/机制：基于 Gruntwork Terraform 模板构建 Landing Zone IaC；通过 CCOE CloudTrail 替代 Gruntworks CloudTrail 实现统一审计；网络账户 Checkpoint 重新路由入站流量；网络分段阻断 SaaS 工作负载的直接连通性 - 结论/价值：明确 SaaS = 生产、Labs = 开发的核心定位；PoC Landing Zone 将并入 Labs 以最大化资源共享；Cloud Technology Design Forum 推动 Micro Focus 云交付标准化 ## Key Claims（用中文描述） @@ -19,7 +20,7 @@ date: 2026-04-14 - SaaS Landing Zone 为每个产品区域提供客户专属的产品账户，通过共享服务账户实现安全、日志和网络互联 - Gruntwork 账户跨所有账户管理 AMI、日志和安全策略 - 网络分段策略将阻断对 SaaS 工作负载的直接连通性 -- CCOEs CloudTrail 取代 Gruntworks CloudTrail 实现统一云审计 +- CCOE CloudTrail 取代 Gruntworks CloudTrail 实现统一云审计 - 入站流量拟通过 Network 账户的 Checkpoint 重新路由 - 原生 AWS Backup 有望成为强制要求 - 新账户可能取消 Management VPC @@ -27,26 +28,32 @@ date: 2026-04-14 ## Key Quotes > "Our AWS landing zones, they're built infrastructure as code as you'd expect on terraform templates using the grunt work framework." — Landing Zone 的 IaC 实现方式 + > "Basically, the only answer is that SAS is production, Labs is development." — SaaS 与 Labs 的本质区别 ## Key Concepts -- [[AWS-Landing-Zone]]：AWS 多账户架构的基础框架，通过账户隔离实现安全、合规和可管理性 +- [[Landing-Zone-Architecture]]：AWS 多账户架构的基础框架，通过账户隔离实现安全、合规和可管理性 - [[Gruntwork]]：提供生产级 Terraform 模块的基础设施库，Micro Focus 基于此构建 Landing Zone - [[Shared-Services-Account]]：托管共享服务（Artifactory、Cyber Eupriva、ArcSight、监控等）的集中账户 - [[Core-Accounts]]：包含 Active Directory、DNS 和 Network 账户，支持 IT 服务和 Micro Focus 基础设施 - [[Product-Accounts]]：托管各产品线的 IT 产品、项目、应用程序及相关 AWS 资源，由各项目团队管理 - [[Gruntwork-Accounts]]：跨所有账户管理 AMI、日志和安全策略的集中账户 -- [[CCOEs-CloudTrail]]：由 CCOE 团队管理的统一 CloudTrail，替代原有的 Gruntworks CloudTrail - [[Network-Segmentation]]：通过 Checkpoint 防火墙和网络分段策略阻断对 SaaS 工作负载的直接连通性 +- [[CloudTrail]]：AWS CloudTrail 日志服务，CCOE CloudTrail 替代原有 Gruntworks CloudTrail 实现统一审计 ## Key Entities - [[Cloud-Technology-Design-Forum]]：Micro Focus 云技术设计论坛，致力于标准化和集中化云交付产品（包括 Landing Zone 设计） +- [[Checkpoint]]：Network 账户中的防火墙设备，用于重新路由入站流量 ## Connections -- [[ctp-topic-1-gruntwork-landing-zone-architecture]] ← extends ← [[ctp-topic-35-aws-landing-zone-design-refresher-saas-labs]] - [[ctp-topic-7-saas-landing-zone-design]] ← related_to ← [[ctp-topic-35-aws-landing-zone-design-refresher-saas-labs]] - [[ctp-topic-25-labs-landing-zone-overview-itom-teams]] ← related_to ← [[ctp-topic-35-aws-landing-zone-design-refresher-saas-labs]] -- [[ctp-topic-10-aws-landing-zone-lz-data-collection-tagging]] ← related_to ← [[ctp-topic-35-aws-landing-zone-design-refresher-saas-labs]] +- [[ctp-topic-10-aws-landing-zone-lz-data-collection-tagging-related-security]] ← related_to ← [[ctp-topic-35-aws-landing-zone-design-refresher-saas-labs]] +- [[ctp-topic-1-gruntwork-landing-zone-architecture]] ← extends ← [[ctp-topic-35-aws-landing-zone-design-refresher-saas-labs]] ## Contradictions -- （暂无检测到与其他 Wiki 页面的明显冲突） +- 与 [[ctp-topic-1-gruntwork-landing-zone-architecture]] 视角互补： + - 冲突点：Landing Zone 中产品定义粒度 + - 当前观点（CTP Topic 35）：Landing Zone 产品定义由架构团队统一规划，强调 Cloud Technology Design Forum 推动标准化 + - 对方观点（CTP Topic 1）：Landing Zone 由产品团队自行定义具体服务（ECS/RDS 等），产品团队有较大自主权 + - 状态：视角互补而非直接矛盾——CTP Topic 35 强调集中治理与标准化，CTP Topic 1 强调灵活性与产品团队自主性；可能反映组织不同发展阶段或不同业务单元的差异