Organization planning
A solid organizational plan is the foundation for a successful cloud migration. Before you migrate to the cloud, you must create an organizational plan based on your company's needs. This plan should define your organizational structure, account system, and permission system.
Define your organizational structure
Before you migrate to the cloud, you must define your organizational structure. This helps you build and maintain a culture of cost awareness and organize cost management and optimization activities. Management approaches vary between companies, but there are three common patterns:
Centralized management: A dedicated team centrally manages and operates the cloud environment and resources. This team handles tasks such as financial operations and cost optimization. It also promotes best practices across the company. For example, you can establish a Cloud Computing Center of Excellence (CCOE). The CCOE can be an existing internal team or a new team that is composed of key financial, technical, and organizational stakeholders from across the enterprise.
Distributed management: Different business and technical teams manage their own cloud services and costs. They also handle the technical implementation.
Hybrid management: This pattern combines centralized and distributed management, which allows teams to collaborate on cost optimization. You can measure the performance and delivery capabilities of functional departments against cost optimization targets, such as workload efficiency metrics.
After you determine the organizational structure, you should reflect it in your cloud account system. Financial roles, such as financial administrators, use financial tools for resource management. This approach enables efficient cross-departmental management, fine-grained control of Alibaba Cloud services, and cost-effective resource usage.
Plan your account system
Accounts are more than just containers for resources. They reflect your company's organizational structure. Financial management and cost management both depend on the account structure. A well-planned account system makes cost management more efficient.
Based on your business's financial control requirements, you can use multiple accounts or a single shared account to manage your entire financial lifecycle on Alibaba Cloud. You can also combine various financial control solutions to flexibly plan your financial accounts based on your business scenarios. For example, in a multi-account scenario, you can designate a main financial account to manage other business accounts (financial sub-accounts). Some business units can use the Financial Management solution, while others use the finance trusteeship solution. You can also use a cost center-based cost allocation solution to distribute costs.
Enterprise users can plan their accounts based on the following scenarios:
Scenario 1: Financial control mechanisms cannot be shared or reused: This scenario applies if your company has multiple business units or projects and you want independent financial controls for specific business units. For example, the budget and the instance stop/restart control mechanism for one business unit must be completely isolated from others. In this case, you can create multiple accounts, with one business unit per account. Then, establish a Financial Management relationship between the accounts. Using the extensive batch management tools in the cross-account Financial Management solution, a single main account can efficiently perform batch operations on multiple member accounts to maintain independent control.
Scenario 2: Only financial control mechanisms can be shared or reused: This scenario applies if your company has multiple business units or projects that require IT resource isolation from each other, but you do not need fine-grained financial controls for each business unit. For example, you may want to consolidate all business units, set a single total budget, and manage instance stop/restart controls based on the total available credit. In this case, you can create multiple accounts with one business unit per account and establish a finance trusteeship relationship between them.
Scenario 3: Both financial control mechanisms and IT resources can be shared or reused: This scenario applies if your company has multiple business units or projects, you want consolidated financial controls for all business units, and the IT resources they consume can be shared across business units through IT architecture adjustments. In this case, you must evaluate whether you can accept the shared costs that result from reusing IT resources. If you cannot accept the shared costs, consider the cross-account finance trusteeship solution described in Scenario 2. If you can accept the shared costs, you can create a single account for all business units to share.
If you are an enterprise user with a complex organizational structure, you can plan your multi-account structure in the cloud using landing zone. You can combine this with multi-organization financial control solutions to manage finances and costs across multiple accounts.
Plan your permission system
A good identity and permission plan ensures that only authorized identities can access specific cloud resources under specified conditions. Clearly defining identities and granting appropriate permissions are crucial for financial and cost management. Defining financial roles helps reduce management costs, prevent unauthorized access, and protect your funds and data in the cloud. Follow these recommendations when you plan finance-related identities and permissions:
Plan financial management roles: A personnel identity usually represents an individual in your organization. From a cloud finance perspective, you should plan financial roles such as financial administrator. The financial administrator is responsible for the unified management of cloud finances and costs. This includes configuring account linking, managing funds, handling unified settlement, and performing cost allocation. This role is typically filled by a member of the company's finance or Operations and Maintenance (O&M) team.
Avoid using the root identity: After you register an Alibaba Cloud account, you can log on to the Alibaba Cloud Management Console with your username and password. The account that you use to log on has the root identity. The root identity has all permissions for the account. If the account password is leaked, the risk is extremely high. Except in rare cases, you should always use Resource Access Management (RAM) identities for financial operations to enable fine-grained identity and permission management.
Set permissions based on your organization: You should map the permissions of daily operational identities in your company to the system. This maintains the principle of consistent rights and responsibilities. You should also align system permissions with business management relationships to reduce operational costs. An enterprise administrator can grant permissions to secondary or subordinate administrators. The enterprise administrator's role is purely for management, while the authorized administrators handle business management.
Distinguish between program and personnel identities: You should distinguish between program and personnel identities to simplify permission management and operation tracking. Some companies use programs to pull bills for cost analysis. In this scenario, you should grant only read permissions for bills to the program identity. If program and personnel identities are shared, the permissions associated with the RAM user must cover all use cases. This can lead to permission escalation. A single leak can affect all applications, which increases the risk and makes immediate remediation more difficult.
Use least privilege: The core principle of permission management in the cloud is least privilege. You should grant only the minimum necessary permissions to finance-related identities. For identities that are related to financial management, you can use RAM to grant only the permissions that are related to their financial duties. This prevents unauthorized resource access.
For more information about identity and permission management practices, see the Security and Compliance pillar.