AMS Single-account landing zone (SALZ) onboarding

Create a new AWS account that AMS configures as the networking account to host the firewall. Create the new account within your AWS organization, if you have one. AMS will follow the procedure of creating a normal AMS account, so all the information required must be gathered (for example CIDR, EPS licenses, and users). Note: A CIDR allocation of /24 is good.

Specify whether or not you want to remove the Internet gateways (IGWs) from the egress traffic accounts.

Determine your approved domains. AMS enables destination filtering by maintaining an approved domain list; the list can be modified later.

Confirm the instance size you want to use based on your expected throughput. By default, the instance is created in a m4.xlarge instance where we have found that the firewall throughput is 350Mbps. AMS can increase the size to a c4.8xLarge instance where the expected throughput is 1.25 Gbps.

Set up networking between AMS and your private network. This involves several tasks:

1. Allocate IP space

2. Establish private network connectivity to AWS

3. Set up your firewall

4. Set up access management

5. Schedule backups

Provide access to the created account to AMS.

Validate that the AMS service is operating properly.