Isolate different workloads
Manage isolation at the account level. Establish unified protection rules and isolation boundaries between different environments, such as production, development, and testing, and between workloads. This provides strong isolation for security, billing, and access control. A multi-account architecture prevents security events from spreading across environments and reduces their impact. For example, if a workload is unexpectedly accessed, the isolation mechanism limits the spread of risk. You can also use unified control policies to establish enterprise-wide or specific access control principles to ensure security compliance and cost control. Centralize infrastructure audits to meet compliance and regulatory requirements.
Priority
High
What to avoid
Placing multiple unrelated workloads with different data sensitivity levels in the same account.
Using a chaotic folder structure that makes access control and policy application illogical.
Implementation guide
An Alibaba Cloud account provides a security isolation boundary for workloads or application environments with different sensitivity levels. This boundary lets you control resource access permissions, billing scopes, and security policies. For more information about the design principles and practice patterns of a multi-account architecture, see the Alibaba Cloud Multi-Account Cloud Environment Whitepaper.
Plan the multi-account organization structure based on your business's organization chart. Use folders to categorize and group accounts. This logically divides your enterprise's business or applications based on their purpose and needs. A typical architecture is to create two folders under the root folder: Core and Applications.
Place shared service accounts in the Core folder. Use these accounts for the centralized deployment of shared management services, such as a shared VPC.
Place specific applications in the Applications folder.
Set up a landing zone multi-account architecture. A landing zone is an Alibaba Cloud framework for cloud migration. It guides enterprises in planning and implementing their cloud resource structure, access security, network architecture, and security compliance system. This helps you build a secure, efficient, and manageable cloud environment. You can use the Set up a landing zone feature in Cloud Governance Center to easily set up an enterprise multi-account environment using blueprint templates. For more implementation details, see Enterprise Multi-account Unified Architecture.
Establish guardrails. Implement unified security protection rules in your multi-account environment. In Cloud Governance Center, you can centrally configure guardrails to prevent changes to the resource structure and basic configurations. This also ensures the security of the multi-account environment. Cloud Governance Center provides three types of guardrails: mandatory, recommended, and optional. Mandatory rules are automatically enabled when you set up a landing zone. You must manually evaluate and enable recommended and optional guardrails. Carefully review the recommended guardrails in Cloud Governance Center. Prioritize enabling rules that are directly related to your business compliance. Select optional guardrails as needed to avoid overly restricting business flexibility.
Configure account baselines. You can use the Account Factory feature in Cloud Governance Center to configure account baselines. This ensures that all enterprise accounts have the same security and compliance baseline. You can configure common security settings, such as password strength. Then, you can use the account baselines to create new accounts in batches. This reduces manual operation costs and ensures baseline consistency.