AWS guidance documentation change
Summary
Updated the architecture flow for Cloud Intelligence Dashboards: changed from CUR2 delivery to Management Account with S3 replication to Data Collection Account, to direct delivery to Data Collection Account. Removed S3 replication step and renumbered remaining steps.
Security assessment
This change describes an architectural simplification by removing an intermediate S3 replication step. While this could have security implications (reducing data movement complexity), there is no concrete evidence in the diff that this addresses a specific security vulnerability or incident. The security controls (IAM, IAM Identity Center, Row Level Security) remain unchanged and are still documented.
Diff
diff --git a/guidance/latest/cloud-intelligence-dashboards/cudos-cid-kpi.md b/guidance/latest/cloud-intelligence-dashboards/cudos-cid-kpi.md index 2f2ef466e..dde350c3a 100644 --- a//guidance/latest/cloud-intelligence-dashboards/cudos-cid-kpi.md +++ b//guidance/latest/cloud-intelligence-dashboards/cudos-cid-kpi.md @@ -21 +21 @@ All these dashboards are based on the AWS Cost & Usage Report (CUR) that contain - 1. [AWS Data Exports](https://aws.amazon.com/aws-cost-management/aws-data-exports/) delivers daily the Cost & Usage Report (CUR2) to an [Amazon S3 Bucket](https://aws.amazon.com/s3/) in the Management Account. + 1. [AWS Data Exports](https://aws.amazon.com/aws-cost-management/aws-data-exports/) delivers daily the Cost & Usage Report (CUR2) directly to an [Amazon S3 Bucket](https://aws.amazon.com/s3/) in the Data Collection Account. @@ -23 +23 @@ All these dashboards are based on the AWS Cost & Usage Report (CUR) that contain - 2. [Amazon S3](https://aws.amazon.com/s3/) replication rule copies Export data to a dedicated Data Collection Account S3 bucket automatically. + 2. [Amazon Athena](https://aws.amazon.com/athena/) allows querying data directly from the S3 bucket using an [AWS Glue](https://aws.amazon.com/glue/) table schema definition. @@ -25 +25 @@ All these dashboards are based on the AWS Cost & Usage Report (CUR) that contain - 3. [Amazon Athena](https://aws.amazon.com/athena/) allows querying data directly from the S3 bucket using an [AWS Glue](https://aws.amazon.com/glue/) table schema definition. + 3. [Amazon Quick Sight](https://aws.amazon.com/quicksight/) creates datasets from [Amazon Athena](https://aws.amazon.com/athena/), refreshes daily and caches in [SPICE](https://docs.aws.amazon.com/quicksight/latest/user/spice.html)(Super-fast, Parallel, In-memory Calculation Engine) for [Amazon Quick Sight](https://aws.amazon.com/quicksight/) @@ -27,3 +27 @@ All these dashboards are based on the AWS Cost & Usage Report (CUR) that contain - 4. [Amazon Quick Sight](https://aws.amazon.com/quicksight/) creates datasets from [Amazon Athena](https://aws.amazon.com/athena/), refreshes daily and caches in [SPICE](https://docs.aws.amazon.com/quicksight/latest/user/spice.html)(Super-fast, Parallel, In-memory Calculation Engine) for [Amazon Quick Sight](https://aws.amazon.com/quicksight/) - - 5. User Teams (Executives, FinOps, Engineers) can access Cloud Intelligence Dashboards in [Amazon Quick Sight](https://aws.amazon.com/quicksight/). Access is secured through [AWS IAM](https://aws.amazon.com/iam/), IIC ([AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/), formerly SSO), and optional [Row Level Security](https://catalog.workshops.aws/awscid/en-US/customizations/row-level-security). + 4. User Teams (Executives, FinOps, Engineers) can access Cloud Intelligence Dashboards in [Amazon Quick Sight](https://aws.amazon.com/quicksight/). Access is secured through [AWS IAM](https://aws.amazon.com/iam/), IIC ([AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/), formerly SSO), and optional [Row Level Security](https://catalog.workshops.aws/awscid/en-US/customizations/row-level-security).