Service control policies and their blast radius - SkilBrill

Skip to content

Home
Courses
About
Contact
Blog
- Freshers

Search for:

Home - Lessons - AWS Advanced Architecture - M1 — Organisational Design and Account Strategy - Service control policies and their blast radius

AWS Advanced Architecture Service control policies and their blast radius

AWS Advanced Architecture

0% Completed

M1 — Organisational Design and Account Strategy

Organizations, OUs and where the hierarchy should stop

Account-per-environment versus account-per-business-unit

The shared services, security and deployment account pattern

Naming, tagging and classification standards that survive

Service control policies and their blast radius

Designing for divestiture, acquisition and re-org

M2 — Landing Zones and Control Tower

Control Tower, guardrails and account vending

Mandatory, strongly recommended and elective guardrails

Account factory workflows and change control

Migrating an existing estate into a landing zone

Config drift on the foundation itself

What to build yourself instead of buying from Control Tower

M3 — Multi-Account Networking at Scale

Transit Gateway as the hub and its route table design

Sharing networks across accounts with RAM

Centralised egress and its cost and inspection implications

DNS strategy across accounts and regions

Segmentation by OU rather than by convention

Cross-account security group reference and its limits

M4 — Migration Strategy and Execution

The six strategies and when each is a rational choice

Discovery and dependency mapping before committing a wave

Migration factory: replatform, refactor and the refactor trap

Data migration: Snowball, DMS and replication risk

Cutting over without a rollback plan you have not tested

Post-migration rationalisation and decommissioning

M5 — Resilience at Enterprise Scale

Multi-region strategy: active-passive versus active-active

Failover that has been rehearsed rather than assumed

Blast radius: designing so one failure stays contained

Backup and recovery policy at estate level

Chaos and game-day practice on real infrastructure

Sizing the resilience spend against the business impact

M6 — Governance, Compliance and Guardrails

Policy as code and what it can actually enforce

Audit evidence collection across many accounts

ISO 27001 and DPDP obligations mapped to AWS controls

Centralised logging and its retention decisions

Landing zone conformance reporting

Making exceptions visible and time-limited

M7 — Cost Management Across Accounts

Consolidated billing, volume discounts and their traps

Reserved instances and savings plans spread across accounts

Showback and chargeback models that teams accept

Detecting waste across an estate rather than an account

Architecture decisions that cost most at scale

Building a FinOps operating rhythm into the programme

M8 — Capstone: A Migration and Governance Blueprint

Design the OU and account structure for a named organisation

Build the landing zone with a guardrail set

Design multi-account networking and egress

Sequence migration waves with dependencies and rollback

Map the governance controls to a named framework

Cost the whole programme and defend it to a steering committee

Announcements Course Info

Global Trusted Software Training Partner Since 2022

SkilBrill Training Institute delivers industry-focused technology education that bridges the gap between academic learning and real-world demands. Our structured programs combine foundational theory with practical application, ensuring every graduate is confident and job-ready from day one.

Learn More About Us

© 2026 SkilBrill Training Institute. All Rights Reserved. Privacy Policy Terms Refunds Outcomes

📞 Enroll Now

Start Your Journey

Fill in your details and our team will get back to you within 24 hours

Please enable JavaScript in your browser to complete this form.

Full Name *

Email *

Course Interested In *

Mode of Course *