Cloud Control

• 1: Overview
• 2: How-to guides
• 2.1: Managing Guardrails
• 2.2: Managing an Organization
• 3: API Reference
• 4: CLI Reference
• 5: Release Note

1 - Overview

Service Overview

Cloud Control service is a managed service that supports building, operating, and managing a multi-account environment easily and securely on the Samsung Cloud Platform.
Cloud Control service automates an organization’s cloud governance (security, compliance, standardization, etc.) and provides consistent centralized account and resource management based on Samsung Cloud Platform best practices.

Features

Cloud Control service provides the following special features.

• Landing Zone Automatic Setup: Samsung Cloud Platform accounts, organizational units (OU), guardrails, logging, etc. are automatically configured. In a standardized environment, new account creation and invitation of existing accounts are possible.
• Centralized Governance and Policy Enforcement: Automatically applies security, compliance, and operational policies (guardrails) across the organization. Provides policy violation detection and monitoring capabilities.
• Multi-Region and Scalability: You can apply the same governance and policies across multiple Samsung Cloud Platform regions.

Provided Features

Cloud Control service provides the following features.

• Automated Landing Zone (Landing Zone) Construction: Security, logging, and account structure based on Samsung Cloud Platform best practices are automatically set.
• Guardrail applied
  • Preventive guardrail : block the creation of policy-violating resources itself
  • Detective Guardrail : Automatically detect policy-violating resources and notify
  • Integration with Samsung Cloud Platform Organization’s ACP, Samsung Cloud Platform Config Inspection, etc.
• Dashboard Provision: You can visually monitor the accounts, OUs, guardrail implementation status, and compliance status of the entire organization.
• Centralized logging and auditing
  • Logging&Audit, Object Storage, Config Inspection through which provide centralized log storage for all accounts and an audit account
• ID and Permission Management Integration: By integrating with Samsung Cloud Platform ID Center, you can manage account-based access control and permission groups.
• Monitoring and Notification (Notification) Feature: Provides real-time alerts for policy violations, Cloud Control setting changes, etc.

Components

Landing Zone(Landing Zone)

Governance, security, network, logging, etc. The basic structure of the standardized Samsung Cloud Platform environment is as follows.

Guardrails(Guardrails)

The guardrails that automatically apply policy violation detection and prevention (detection/prevention type) rules, security and compliance standards are as follows.

Baseline(Baseline)

The essential resources and configuration sets, such as security, logging, and network, automatically deployed per account, are as follows.

Region-specific provision status

Cloud Control service is available in the following environments.

Pre-service

This is a list of services that must be pre-configured before creating the service. For detailed information, please refer to the guide provided for each service and prepare in advance.

2 - How-to guides

The user must first create a landing zone to use the Cloud Control service. If a landing zone is created, you can use the management functions of Cloud Control.

Create Landing Zone

To use Cloud Control in the Samsung Cloud Platform Console, you must first create a landing zone.

To create a landing zone, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.

2. Click the Landing Zone Creation button on the Service Home page. You will be taken to the Landing Zone Creation page.

3. Fee Review and Organizational Unit Configuration area, after setting the configuration items, click the Next button.

   Category	Required	Detailed description
   Home Region	-	Home Region of Cloud Control Cloud Control designates the default region as the Home Region and cannot be changed All regions other than the default region are under Cloud Control’s management
   Basic Organizational Unit	Required	Enter basic organizational unit within landing zone Case-sensitive English letters, enter within 128 characters Basic organizational unit includes shared Accounts (Log Account, Audit Account) Security: Name of the basic organizational unit for shared Account Can be modified after landing zone creation
   Additional Organizational Unit	Required	Enter additional organizational unit within landing zone Case-sensitive English letters, enter within 128 characters Can be added after landing zone creation

   Table. Landing Zone Creation - Fee Review and Organizational Unit Configuration Items

4. Shared Account Configuration After setting the configuration items in the area, click the Next button.

   Category	Required	Detailed description
   Management Account	-	Management Account name is displayed and cannot be edited
   Log Account	Required	Log Account information input Account name: Use Korean, English, numbers, spaces, special characters(+=-_@[](),.) to input within 3 ~ 30 characters Email, Confirm Email: Input within 60 characters according to email address format
   Audit Account	Required	Enter Log Account information Account name: Use Korean, English, numbers, spaces, special characters(+=-_@[](),.) and enter within 3 to 30 characters Email, Confirm Email: Enter within 60 characters following email address format Cannot use the same email as Log Account

   Table. Landing Zone Creation - Shared Account Configuration Items

4. Additional configuration area, after setting the configuration items, click the Next button.

   Category	Required	Detailed description
   Account access configuration	Required	Select method to manage access to the Account Account access via ID Center: Create pre-configured groups and permission sets to configure users who perform specific tasks in the Account Automatically assign users when provisioning an Account with Account Factory or registering an existing Account Self-managed Account access: Manage access to the Account via ID Center or other Account access methods Cloud Control does not create directory groups or permission sets for the landing zone No user creation when provisioning an Account with Account Factory or registering
   Trail configuration	-	Automatic configuration in progress

   Table. Landing Zone Creation - Additional Configuration Items

5. Input Information Check area, after checking the landing zone configuration information and Service Permissions, check the agreement content for permissions and guidelines.

6. Click the Complete button. A popup window notifying the creation of the landing zone will open.

7. After checking the information about creating a landing zone, click the Confirm button. The landing zone creation request is completed.

   • Landing zone creation takes some time, and a notification will be sent when the task is completed.
   • When the landing zone creation is complete, you can check the full menu of Cloud Control and the organization status on the Service Home page.

Check detailed landing zone information

Landing Zone Settings page allows you to view detailed information about the landing zone.

To check the detailed information of the landing zone, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.
2. Service Home on the page click the Landing Zone Settings menu. Navigate to the Landing Zone Settings page.

Delete landing zone

If you fail to create a landing zone or do not use it, you can delete the landing zone.

To delete the landing zone, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.
2. Click the Landing Zone Settings menu on the Service Home page. You will be taken to the Landing Zone Settings page.
3. Landing Zone Settings page, click the Landing Zone Delete button. Landing Zone Delete popup opens.
4. Landing Zone Deletion displayed in the popup window, enter the Cloud Contorl ID into the deletion confirmation area, then click the Confirm button. The landing zone deletion request is completed.
   • While deleting the landing zone, a description about the landing zone deletion process is displayed on the Service Home page.

Managing Organization Units and Accounts

You can check the list of organization units and accounts, and register and manage them in Cloud Control.

To view and manage the organization unit and Account list, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.
2. Service Home page, click the Organization menu. Move to the Organization unit and Account management page.
3. Organization Unit and Account Management Select the view mode located at the top right of the page.

View Hierarchy

Organizational Unit and Account Management page, when you click the View Hierarchy button, you can view and manage organizational units and accounts in a hierarchical structure.

View Account List

Organization Unit and Account Management on the page, when you click the View Account List button, you can view and manage the Account list that constitute Cloud Control.

Organization and Account Detailed Information Check

You can view and edit the detailed information of the organization unit and Account.

To view detailed information, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.
2. Service Home page, click the Organization menu. Move to the Organization unit and Account management page.
3. Organization Unit and Account Management page’s View Hierarchy button, click it.
4. Click the name of the resource whose detailed information you want to view in the hierarchy list. You will be taken to the detailed page of that resource.
   • Root: Root Details go to the page. For more details, please refer to Root Details Info.
   • Organization unit name: Organization unit details navigate to the page. For more details, see Organization unit detailed information.
   • Account name: Account details navigate to the page. For more details, refer to Account detailed information.

Root Detailed Information

Root detail page allows you to view and manage the detailed information of the organization Root and the sub Account list. Root Details page consists of Basic Information, Sub Account tabs.

Basic Information

You can check the basic information about organization Root and the organizational units and account count registered in Cloud Control.

Sub Account

You can view and manage the list of Accounts under Root and the registration status of Cloud Control.

Organization Unit Detailed Information

Organizational Unit Details page allows you to view and manage detailed information of the organizational unit, sub Accounts, and applied preventive guardrails. Organization Unit Details page consists of Basic Information, Sub Account, Preventive Guardrails tabs.

Basic Information

You can view basic and detailed information about the organization unit.

Sub Account

You can view and manage the list of sub-accounts of the organization unit.

Preventive Guardrail

You can view and manage the list of preventive guardrails applied at the organizational unit level.

Account Check detailed information

Account Details page you can view the detailed information of the Account and the list of applied preventive guardrails. Account Detail page consists of Basic Information, Prevention Guardrail tabs.

Basic Information

You can view basic and detailed information about the organization unit.

Prevention Guardrail

You can view the list of preventive guardrails applied to the Account.

Access Portal Check access information

User and Access page you can check the Access Portal connection URL and the password required for connection.

Access Portal to check the connection information, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.
2. Service Home page, click the User and Access menu. Navigate to the User and Access page.
3. User and Access page’s Integrated Access Management area, check the information.

Check user credential information

On the User and Access page, you can check the user credential source type and ID Center ID.

To verify user credential information, follow the steps below.

1. All Services > Management > Cloud Control Please click the menu. Navigate to Cloud Control’s Service Home page.
2. Click the User and Access menu on the Service Home page. You will be taken to the User and Access page.
3. User and Access page’s User Credential Management area, check the information.

Check shared Account

You can view the shared Account information of Cloud Control.

To check the shared Account information, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Go to the Service Home page of Cloud Control.
2. Click the Shared Account menu on the Service Home page. Navigate to the Shared Account page.

• Shared Account page is composed of Management Account, Log Account, Audit Account widgets.
  • Each widget displays the Account name, Account ID, and email information, and clicking the widget name navigates to that Account’s detail page.

2.1 - Managing Guardrails

Policy violation detection and prevention (detection/prevention type) rules, and the guardrails automatically applied to security and compliance standards are as follows.

Prevention Guardrail

You can apply preventive guardrails to block in advance so that policy violations do not occur.

Applying preventive guardrails

It can be applied to preventive guardrails at the organizational level. To apply preventive guardrails at the organizational level, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.

2. Service Home on the page click Guardrail > Preventive Guardrail menu. Preventive Guardrail List navigate to the page.

3. After selecting the prevention guardrail to apply to the organizational unit from the Prevention Guardrail List, click the Apply to Organizational Unit button. You will be taken to the Apply to Organizational Unit page.

   • Multiple preventive guardrails can be selected and applied simultaneously.

4. After selecting the organizational unit to apply the preventive guardrail, click the Complete button.

   Category	Required	Detailed description
   Preventive guardrails to apply	-	List of preventive guardrails to apply at the organizational unit
   Organization Unit Name	Required	Select organization unit to apply preventive guardrails Registered, Registration Failed status organization units only selectable Click on organization unit name, parent organization unit name to view detailed information

   Table. Prevention Guardrail Application Items

5. When a pop-up window that notifies the application of the preventive guardrail opens, click the Confirm button.

Check detailed guardrail information

You can view detailed information about the preventive guardrail, the organizational units applied to the preventive guardrail, and the list of Accounts. To disable the preventive guardrail, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.
2. Service Home on the page click the Guardrail > Preventive Guardrail menu. Navigate to the Preventive Guardrail List page.
3. Prevention Guardrail List Click the prevention guardrail name to view detailed information. Prevention Guardrail Details page
   • Prevention Guardrail Details page consists of Basic Information, Applicable Organization Unit, Account tabs.

Basic Information

You can view basic and detailed information about preventive guardrails.

Applied Organization Unit

You can view the list of organizational units with preventive guardrails applied.

Account

You can check the list of sub Accounts of the organization unit where the preventive guardrail is directly applied.

Disable Guardrail

The preventive guardrail applied to the organizational unit can be disabled. To disable the preventive guardrail, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.

2. Service Home on the page, click the Guardrail > Preventive Guardrail menu. Navigate to the Preventive Guardrail List page.

3. Prevention Guardrail List after selecting the prevention guardrail to remove organization unit application, click the More > Remove Organization Unit Application button. You will be taken to the Remove Organization Unit Application page.

   • Multiple preventive guardrails can be selected simultaneously and disabled.

4. After selecting the organizational unit to remove the preventive guardrail, click the Complete button.

   Category	Required	Detailed description
   Preventive guardrails to apply	-	List of preventive guardrails to deactivate
   Organization Unit Name	Required	Select organization unit to disable preventive guardrail application Registered, Registration Failed status only organization units can be selected Click organization unit name, parent organization unit name to view detailed information

   Table. Prevention Guardrail Deactivation Items

5. When the popup notifying the removal of the preventive guardrail is opened, click the Confirm button.

2.2 - Managing an Organization

The user must first create a landing zone in order to use the Cloud Control service. When a landing zone is created, you can use Cloud Control’s management functions.

Managing organizational units

You can register and manage the organizational units that constitute the Organization in Cloud Control.

Create Organizational Unit

You can create a new organizational unit and register it in Cloud Control.

Create an organizational unit and follow the steps below to register it with Cloud Control.

1. All Services > Management > Cloud Control Click the menu. Go to Cloud Control’s Service Home page.

2. Click the Organization menu on the Service Home page. Navigate to the Organization Unit and Account Management page.

3. Organizational Unit and Account Management page’s top right corner, click the View Hierarchy button.

4. After selecting the location to add an organizational unit in the hierarchy list, click the Create Sub-Organizational Unit button. The Create Organizational Unit popup opens.

   • Root or only one organizational unit can be selected.
   • Root can be used as a basis to create organizational units within 5 levels below.

5. Create Organizational Unit After entering the organizational unit information to add in the popup window, click the Confirm button.

   Category	Required status	Detailed description
   Parent organization unit name	-	Name of the parent organization unit for the organization unit to be created
   Organization Unit Name	Required	Enter the name of the organization unit to be created within 128 characters Organization names distinguish between uppercase and lowercase English letters
   Description	Select	Enter a description of the organizational unit within 1,000 characters

   Table. Organization unit creation items

6. When the popup notifying the creation of an organizational unit opens, click the Confirm button.

   • It may take several tens of minutes depending on the number of Accounts under the organizational unit.
   • When the organization unit creation is completed, it will be delivered as a notification.

Register Organizational Unit

You can register organizational units that are not registered in Cloud Control or that failed to register in Cloud Control.

To register an organizational unit in Cloud Control, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.

2. Click the Organization menu on the Service Home page. Navigate to the Organization Unit and Account Management page.

3. Organizational Unit and Account Management in the top right corner of the page, click the View Hierarchy button.

4. After selecting the organizational unit to register from the hierarchy list, click the More > Register Organizational Unit button. You will be taken to the Register Organizational Unit page.

5. Organization Unit Registration Check the information of the organization unit to be registered on the page.

   Category	Required	Detailed description
   Sub Account	-	List of Accounts included under the sub-unit of the organization unit to be registered Automatically registered in Cloud Control when registering the organization unit
   Guardrails to be applied to the organizational unit	-	List of guardrails inherited from the upper organizational unit and guardrails directly applied to the organizational unit Clicking the guardrail name allows you to view detailed information about that guardrail To remove a guardrail applied to the organizational unit, remove its application from the upper organizational unit

   Table. Organization Unit Registration Items

6. Terms Agreement after checking the content, check the checkbox and click the Complete button.

7. When the popup notifying the registration of the organizational unit opens, click the Confirm button. The organizational unit registration request will be completed.

   • Depending on the number of Accounts under the organization unit, it may take more than tens of minutes.
   • When the organization unit registration is completed, it will be delivered as a notification.

Re-register Organization Unit

You can re-register the organizational unit registered in Cloud Control to Cloud Control.

To re-register an organizational unit in Cloud Control, follow these steps.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.

2. Service Home page, click the Organization menu. Navigate to the Organization Unit and Account Management page.

3. Organization Unit and Account Management page’s top right corner View Hierarchy button click.

4. After selecting the organizational unit to re-register from the hierarchy list, click the More > Re-register Organizational Unit button. You will be taken to the Re-register Organizational Unit page.

5. Organizational Unit Re-registration Check the information of the organizational unit to be re-registered on the page.

   Category	Required status	Detailed description
   Sub Account	-	List of Accounts included under the sub-unit to be re-registered Automatically registered in Cloud Control when registering the organizational unit
   Guardrails to be applied to the organizational unit	-	List of guardrails inherited from the upper organizational unit and guardrails directly applied to the organizational unit Clicking the guardrail name allows you to view detailed information about that guardrail To remove a guardrail applied to the organizational unit, remove its application from the upper organizational unit

   Table. Organization Unit Re-registration Items

6. Terms Agreement after reviewing the content, check the checkbox and click the Complete button.

7. When the popup notifying re-registration of the organization unit opens, click the Confirm button. The organization unit re-registration request will be completed.

   • Depending on the number of Accounts under the organization unit, it may take more than tens of minutes.
   • When the organization unit re-registration is completed, it will be delivered as a notification.

Delete organization unit

You can delete the organization unit.

To delete an organizational unit, follow the steps below.

1. All Services > Management > Cloud Control Please click the menu. Navigate to Cloud Control’s Service Home page.
2. Click the Organization menu on the Service Home page. Navigate to the Organization Unit and Account Management page.
3. Organizational unit and Account management in the top right corner of the page, click the View Hierarchy button.
4. After selecting the organizational unit to delete from the hierarchy list, click the More > Delete Organizational Unit button.
5. When the popup notifying the deletion of the organizational unit opens, click the Confirm button.

Account Management

You can register and manage the list of Accounts that constitute the Organization in Cloud Control.

Account Create

Account factory to create Account and apply Cloud Control directly without separate work.

To create an Account, follow the steps below.

1. All Services > Management > Cloud Control Click the menu. Navigate to Cloud Control’s Service Home page.

2. Click the Account Factory menu on the Service Home page. Navigate to the Account Factory page.

3. Account Factory on the page Account Creation button click the button. Account Creation page will be navigated.

4. Account creation on the page, enter the required information for creating an Account and select the organizational unit, then click the Complete button. A popup notifying the Account creation opens.

   Category	Required	Detailed description
   Account information	Required	Enter the name and email information of the Account Account name: Use Korean, English, numbers, spaces, special characters(+=-_@[](),.) to input within 3 ~ 30 characters Email, Confirm Email: Input within 60 characters according to email address format
   ID Center Information	Required	Enter ID Center user information that can access the Account to be created Username: Enter using English letters, numbers, special characters(+=-_@,.) within 128 characters User Real Name: Enter the user’s actual name (surname and given name) If the Account access configuration uses Self-Managed Account Access, ID Center Information cannot be set
   Organization unit selection	Required	Select the parent organization that will include the Account to be created registered status organization units only can be selected Clicking the organization unit name allows navigation to its detail page

   Table. Landing Zone Creation - Fee Review and Organizational Unit Configuration Items

5. Confirm Click the button. Account creation request is completed.
   • Account creation takes some time, and a notification will be sent when the task is completed.

Account Register

You can register organizational units that are not registered in Cloud Control or failed to register in Cloud Control.

To register an Account, follow the next steps.

1. All Services > Management > Cloud Control Click the menu. Go to Cloud Control’s Service Home page.

2. Click the Organization menu on the Service Home page. Navigate to the Organization Unit and Account Management page.

3. Organization Unit and Account Management page’s top right corner, click the View Account List button.

4. After selecting the Account to register in Cloud Control from the Account list, click the Account registration button. It navigates to the Account registration page.

   Category	Required	Detailed description
   Current organizational unit	-	Organizational unit that the Account belongs to
   Register organization unit	-	Select the organization unit to register the Account Only organization units in registration status can be selected Current organization unit: Register as is in the current organization unit Other organization unit: Directly select another organization unit

   Table. Account registration items

5. Account when the registration notification popup opens Click the Confirm button.

Account Move

You can change the organizational unit of the Account registered in Cloud Control and move it.

To move the Account, follow the steps below.

1. All Services > Management > Cloud Control Please click the menu. Navigate to Cloud Control’s Service Home page.
2. Click the Organization menu on the Service Home page. Navigate to the Organization Unit and Account Management page.
3. Organization Unit and Account Management on the top right of the page, click the View Account List button.
4. Click the Account name to change the organizational unit from the Account list. Account Details page will be navigated.
5. Click the Register button on the Account Details page. You will be taken to the Account Registration page.
6. Register Organization Unit from the list, after selecting the organization unit to move the Account, click the Complete button.
   • Registration status organizational units can only be selected.
7. When the popup notifying Account registration opens, click the Confirm button.

Account Exclude

You can exclude the Account from the Organization.

To exclude Account from Organization, follow the steps below.

1. All Services > Management > Organization Click the menu. Go to the Service Home page of Organization.
2. Click the Organization Configuration menu on the Service Home page. Navigate to the Organization Configuration page.
3. Organization Structure page click the Account List View button.
4. After selecting the Account to exclude from Organization, click the More > Exclude Account button.
5. When a popup that notifies the exclusion of the Account opens, click the Confirm button.
   Notice

   In the following cases, Account cannot be excluded.

   • Account with unregistered payment method
   • If there is credit assigned to the account
   • When the exclusion point is the cost settlement date (the 1st of each month, Asia/Seoul GMT +09:00)

Account Delete

You can delete the Account.

To delete the Account, follow the steps below.

1. All Services > Management > Organization Click the menu. Go to the Service Home page of Organization.
2. Service Home on the page, click the Organizational Structure menu. Navigate to the Organizational Structure page.
3. Organization Setup on the page click the Account List View button.
4. After selecting the Account to delete from the Account list, click the More > Delete Account button. The Delete Account popup window opens.
   • After clicking the Account name of the Account to be deleted, you can also delete by clicking the Delete Account button on the Account Details page.
5. After entering the Account name to delete, click the Confirm button.

3 - API Reference

4 - CLI Reference

5 - Release Note

Cloud Control