Enabling Multi-Account AWS Governance for Financial Services Operations

Centrum Broking Limited, part of the Centrum Group, is a diversified financial services organization offering investment banking, institutional equities, wealth management, broking, and financial technology solutions.The organization operates multiple digital platforms and enterprise applications across AWS infrastructure supporting different business functions and operational environments.

Business ChallengeAs Centrum Broking’s AWS environment expanded across multiple business platforms and workloads, the organization faced increasing complexity in managing governance, security, access management, and operational visibility across multiple AWS accounts. Manual IAM user creation and account-level access management across more than eight AWS accounts created operational inefficiencies and increased administrative overhead. The lack of centralized monitoring and logging limited overall infrastructure visibility and made audit evidence collection and compliance management time-consuming. Inter-account connectivity and network architecture also lacked scalability and centralized governance.

Goals & ObjectivesThe organization aimed to establish a secure, scalable, and governance-driven AWS multi-account framework capable of simplifying operations, improving visibility, strengthening compliance management, and enhancing overall cloud governance.The objective was also to standardize AWS account onboarding, centralize identity management, improve security monitoring, and simplify operational administration across all business platforms.

Solution ApproachPentagon System & Services designed and implemented a comprehensive AWS multi-account governance framework using AWS Control Tower. A centralized Landing Zone architecture was created to organize Production, UAT, Networking, Shared Services, Audit, and Log Archive accounts using AWS Organizations and AWS Control Tower best practices. To simplify access management, AWS IAM Identity Center (AWS SSO) was implemented, enabling centralized user authentication and role-based access management across all AWS accounts. Comprehensive monitoring and governance capabilities were established using AWS CloudTrail with centralized log archival, Amazon GuardDuty, AWS Security Hub, Amazon CloudWatch, AWS Config, and AWS Lambda for automated compliance monitoring and security governance.

Implementation ApproachTo simplify inter-account communication and network scalability, AWS Transit Gateway was deployed for centralized VPC connectivity across the AWS environment. Security governance was further enhanced using AWS WAF, AWS Backup, AWS Inspector, and infrastructure automation through AWS CloudFormation. The deployment also included operational standardization across Amazon ECS, Amazon EKS, Amazon EC2, Amazon RDS, Amazon ElastiCache, and AWS Direct Connect environments.