AWS wellarchitected high security documentation change
Summary
Expanded implementation guidance for RACI matrices with detailed data management processes, added AWS service integrations, and restructured content into sections
Security assessment
Added specific security controls including IAM least-privilege roles, SCPs for data residency, Control Tower guardrails against unauthorized data transfers, and Config rules for compliance auditing. These directly implement security best practices for data protection.
Diff
diff --git a/wellarchitected/latest/video-streaming-advertising-lens/advops01-bp02.md b/wellarchitected/latest/video-streaming-advertising-lens/advops01-bp02.md index 304853d55..ad2f098de 100644 --- a//wellarchitected/latest/video-streaming-advertising-lens/advops01-bp02.md +++ b//wellarchitected/latest/video-streaming-advertising-lens/advops01-bp02.md @@ -5 +5 @@ -Implementation guidance +Implementation guidanceResourcesKey AWS services @@ -7 +7 @@ Implementation guidance -# ADVOPS01-BP02 Create RACI (responsible, accountable, consulted, and informed) matrices that clearly define the roles and responsibilities for each key advertising process like infrastructure monitoring +# ADVOPS01-BP02 Create RACI matrices that define the roles and responsibilities for each key advertising process like infrastructure monitoring @@ -13 +13 @@ When designing advertising workloads, define roles and set clear expectations fo -By creating comprehensive RACI matrices, organizations can establish accountability, decision-making authority, and communication requirements for each step of the ad-serving workflow. This level of clarity helps prevent confusion, gaps, or overlaps in responsibilities. This clarity also verifies that all stakeholders understand their roles and how they contribute to the overall success of the advertising operations. +By creating comprehensive RACI matrices, organizations can establish accountability, decision-making authority, and communication requirements for each step of the ad-serving workflow. This level of clarity assists in blocking confusion, gaps, or overlaps in responsibilities. This clarity also verifies that stakeholders understand their roles and how they contribute to the overall success of the advertising operations. @@ -15 +15 @@ By creating comprehensive RACI matrices, organizations can establish accountabil -### Resources +For data management specifically, implement the following approach: @@ -17 +17,87 @@ By creating comprehensive RACI matrices, organizations can establish accountabil - * [_Create a RACI or RASCI matrix for a cloud operating model_](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/create-a-raci-or-rasci-matrix-for-a-cloud-operating-model.html) + 1. Establish data classification and handling processes: + + * Classify advertising data based on criticality and latency requirements (real-time bidding data, campaign configuration data, historical analytics data) + + * Define data retention policies for each classification (for example, bid data retained for 30 days, campaign data for one year) + + * Implement data lineage tracking using AWS Glue Data Catalog to document data origins, transformations, and dependencies across the advertising pipeline + + 2. Structure teams around data criticality: + + * **Real-time data operations team:** Responsible for sub-100ms data like bidding, user profiles, and fraud detection + + * **Campaign data management team:** Handles near real-time data for configurations, targeting, and budgets + + * **Analytics and reporting team:** Manages batch processing for historical data and business intelligence + + 3. Define data ownership with specific domains: + + * Assign data stewards for specific advertising domains such as: + + * Bid management domain (bid requests, responses, auction data) + + * User profile domain (demographic data, behavioral signals, privacy preferences) + + * Campaign domain (creative assets, targeting parameters, budget configurations) + + * Analytics domain (performance metrics, attribution data, reporting datasets) + + * Document domain-specific quality standards and governance responsibilities in the RACI matrix + + 4. Implement data governance using AWS services: + + * Use AWS Organizations with service control policies (SCPs) to enforce data residency requirements for different Regions + + * Configure IAM roles with least-privilege permissions aligned to team responsibilities (for example, real-time team with write access to bidding data, read-only for analytics) + + * Deploy AWS Control Tower guardrails to help block unauthorized cross-account or cross-Region data transfers + + * Implement AWS Config rules to continuously audit compliance with data governance policies + + 5. Establish data management processes: + + * Data cataloging: Use AWS AWS Glue Data Catalog to maintain a comprehensive inventory of advertising datasets with metadata, ownership, and classification + + * Quality monitoring: Implement automated data quality checks using AWS Glue DataBrew to validate incoming data against defined schemas and business rules + + * Workflow automation: Create AWS Step Functions workflows for data handoffs between teams, with validation checkpoints and approval gates for critical data transitions + + + + +## Resources + + * AWS Organizations for team boundaries: Implement multi-account strategies with SCPs to enforce separation of duties between data teams as described in [AWS Organizations Best Practices](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices.html) + + * Data governance implementation: Follow the framework in [AWS Data Governance Whitepaper](https://docs.aws.amazon.com/whitepapers/latest/data-governance-aws/) to establish controls specific to advertising data domains + + * Team collaboration on data assets: Use [Amazon DataZone](https://docs.aws.amazon.com/datazone/latest/userguide/) to create a data marketplace where teams can discover, share, and collaborate on advertising datasets + + * Automated operational procedures: Implement [AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-best-practices.html) runbooks for standardized data operations tasks across teams + + * Compliance monitoring: Deploy [AWS Config rules](https://docs.aws.amazon.com/config/latest/developerguide/best-practices.html) to continuously validate that data handling practices meet organizational and regulatory requirements + + * [Create a RACI or RASCI matrix for a cloud operating model](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/create-a-raci-or-rasci-matrix-for-a-cloud-operating-model.html) + + + + +## Key AWS services + + * AWS Organizations + + * AWS IAM + + * AWS Control Tower + + * AWS AWS Glue Data Catalog + + * AWS Glue DataBrew + + * Amazon DataZone + + * AWS Systems Manager + + * AWS Config + + * AWS Step Functions