Cloud Governance, IT Atlas

Overview

Governance in cloud is preventive where possible and detective where not. Policy engines, Azure Policy, AWS SCPs and Config, GCP organisation policies, deny non compliant resource creation, while posture tools flag drift that slipped through.

Landing zones encode the decisions once: naming, tagging, region restrictions, network topology, identity model, logging destinations and baseline security controls.

Security considerations

Deny creation of resources in unapproved regions and prevent disabling of audit logging.
Require encryption and private networking by policy rather than by review.

Related topics

Cloud Computing

On demand delivery of compute, storage, networking and platform services over a network, billed by consumption and managed through APIs.

IT Governance

Establishing direction, decision rights, accountability and oversight so technology serves organisational objectives.

FinOps & Cloud Cost Management

The practice of making cloud spend visible, attributable and optimisable as an engineering responsibility.

Compliance

Demonstrating that controls required by law, regulation, contract or standard are designed and operating effectively.

Infrastructure as Code

Defining infrastructure declaratively in version controlled files so environments are reproducible and changes are reviewable.

Cloud Security

Securing cloud platforms through identity, configuration posture, network controls, workload protection and control plane monitoring.

Shared Responsibility Model

The division of security duties between cloud provider and customer, which shifts with each service model.

Azure Environment Architecture

A landing zone pattern for Azure: management group hierarchy, subscription strategy, hub and spoke networking, policy baseline and centralised logging.