Executive Summary

Zero&One started with the vision that cloud computing would change the world and Amazon Web Services would power that change. With that belief, we assembled a team of passionate technologists that were big believers in this new mindset and honed our skills.

Today, as a homegrown AWS Premier Tier Services Partners in the MENA region, we stay true to this belief as we forge forward, tapping into promising opportunities in technology for to help our customers achieve their goals. Zero&One delivers technology services focused on cloud adoption and transformation, data engineering and science, artificial intelligence, serverless application development, application modernization, and the Internet of Things. Through our partnership with Amazon Web Services, we enable our customers to achieve extraordinary things and shape how the world innovates. Zero&One operates multiple AWS accounts for internal use, including POCs, development, and production projects, each with its own billing and access management, leading to operational complexity. Managing access control at the network level becomes challenging, as deploying separate OpenVPN servers for each account is inefficient and difficult to maintain.

Why Amazon Web Services?

As a homegrown AWS Premier Consulting Partner in the MENA region, Zero&One features a team of highly skilled, AWS-certified engineers, architects, and developers, bringing extensive expertise and a wealth of industry-recognized certifications.

The Challenge

Optimizing Account Distribution, Budgeting, and Network Access

Zero&One internal accounts are spread across multiple organizations— Redington01, SPP02, and SPP03—without a structured allocation strategy. This fragmented setup requires urgent attention to establish a more organized and efficient distribution plan.

Additionally, Customer Proof of Concept (POC) accounts are being created arbitrarily across various organizations, lacking proper budget allocation and financial oversight. This disorganization makes it challenging to track and monitor account usage effectively.

Furthermore, network access is managed in a decentralized manner, leading to the creation of multiple client VPNs for each employee, further complicating access control and management.

Partner Solution

Streamlining AWS Account Management, Security, and Cost Control

We have integrated AWS IAM Identity Center with our O365 Entra to manage user access across all accounts. A network account is used to control network access to all accounts, with Transit Gateway routing traffic between them. An OpenVPN server is set up in the network account, providing access to all other accounts. Multiple Organizational Units (OUs) have been created for our workload, including internal projects, customer POCs, sandbox environments, and company accounts (which need a better name). Security Hub and AWS Config have been enabled to enhance security and compliance. We enforce tagging to help the finance team generate cost center reports, and a backup and disaster recovery (DR) plan is in place to ensure data resilience.

Use Case

Zero&One implemented AWS Control Tower with a dedicated transit account to streamline governance across multiple AWS accounts. By utilizing AWS Control Tower's centralized management, they established standardized account configurations and automated account provisioning. The solution integrated AWS Config for continuous monitoring and compliance checks, ensuring resources adhered to best practices. Security Hub was enabled to provide a comprehensive view of the security posture, aggregating findings from various security services to identify and address vulnerabilities. Additionally, AWS Single Sign-On (SSO) integration with O365 Entra was deployed to simplify access management, enabling secure and seamless user authentication across accounts. This cohesive setup allowed Zero&One to maintain consistent governance, enhance security monitoring, and improve operational efficiency across all their AWS resources.

Solution Architecture

Outcome

The implemented solution provided centralized compliance enforcement while maintaining the flexibility needed for efficient project management and scalability. Zero&One successfully managed their accounts and resources with enhanced security, operational flexibility, and scalability, effectively addressing initial concerns about chaotic account distribution and access levels.