The page has been translated by Gen AI.

Overview

Service Overview

Cloud Control service is a managed service that supports building, operating, and managing a multi‑account environment easily and securely on the Samsung Cloud Platform.
The Cloud Control service automates an organization’s cloud governance (security, compliance, standardization, etc.) and provides consistent, centralized account and resource management based on Samsung Cloud Platform best practices.

Features

The Cloud Control service offers the following advantages.

Landing Zone (Landing Zone) Automatic Provisioning: Automatically configures essential infrastructure such as Samsung Cloud Platform accounts, organizational units (OU), guardrails, logging, etc. * In a standardized environment, you can create new accounts and invite existing accounts.
Centralized Governance and Policy Enforcement: Automatically apply security, compliance, and operational policies (guardrails) across the entire organization. * Provides policy violation detection and monitoring capabilities.
Multi-Region and Scalability: You can apply the same governance and policies across multiple Samsung Cloud Platform regions.

Provided features

The Cloud Control service provides the following features.

Automated Landing Zone (Landing Zone) Setup: Security, logging, and account structures based on Samsung Cloud Platform best practices are automatically configured.
Guardrail applied
- Preventive guardrail: block the creation of resources that violate policy
- Detective Guardrail: Automatically detect and alert on policy‑violating resources
- Integrate with ACP of Samsung Cloud Platform Organization, Samsung Cloud Platform Config Inspection, etc.
Dashboard Provision: You can visually monitor the accounts, OUs, guardrail implementation status, and compliance status of the entire organization.
Centralized logging and auditing
- Provide centralized log storage and audit accounts for all accounts through Logging&Audit, Object Storage, Config Inspection, etc.
ID and Permission Management Integration: By integrating with Samsung Cloud Platform ID Center, you can manage account-specific access control and permission groups.
Monitoring and Notification (Notification) Feature: Provides real-time alerts for policy violations, Cloud Control configuration changes, etc.

Components

Landing Zone (Landing Zone)

The basic architecture of a standardized Samsung Cloud Platform environment, including governance, security, networking, and logging, is as follows.

Category	Detailed description
Admin account	Organization and account structure management, policy (ACP) implementation, automation of new account creation Enterprise-wide highest privileges, governance-focused operation
Log account	Centralized collection and storage of all account logs, log integrity, and long‑term retention Independent account operation, strict access control, and encryption
audit account	Organization-wide security and compliance monitoring and auditing, automated security assessments Application of the principle of least privilege, cross-account role assumption

Guardrails

The guardrails that automatically apply policy violation detection and prevention (detection/prevention type) rules and security/compliance standards are as follows.

Category	Detailed description
Preventive guardrail	Preemptive blocking role to prevent policy violations Implementation: Using Access Control Policy(ACP) to prohibit or limit the scope of actions for specific Samsung Cloud Platform services Example: Prohibit creation of root user access keys Block resource creation in specific regions Block public read/write on S3 buckets Features: Fundamentally prevent the violation act itself, preemptively blocking policy violations
Detection guardrail	Continuously monitor for policy violations or abnormal configurations, and provide alerts when violations occur Implementation: Based on the Samsung Cloud Platform Config Inspection checklist, evaluate resource status and notify via dashboard or alerts when violations are detected Example: Detection of unencrypted S3 buckets CloudTrail disabled detection EBS volume encryption status detection Features: Detect violating resources in real time and deliver them to administrators

Baseline (Baseline)

The essential resources and configuration sets, such as security, logging, and networking, that are automatically deployed per account are as follows.

Category	Detailed description
AuditBaseline	Configure security and audit roles and policies on the central audit account Check the security status and compliance status of all accounts centrally
LogArchiveBaseline	Aggregate the log trail of all accounts into a central bucket Used for log integrity, long-term storage, and audit tracing
IDCenterBaseline	Automatic resource provisioning integrated with ID Center Unified management of users/groups/permissions within the organization

Provision status by region

The Cloud Control service is available in the environments below.

Region	Provision status
Korea West 1 (kr-west1)	Provide
Korea East1 (kr-east1)	Provide
South Korea 1 (kr-south1)	Provide
South Korea South 2 (kr-south2)	Provide
South Korea South 3 (kr-south3)	Provide

Table. Cloud Control regional availability status

Preceding Service

This is a list of services that must be pre‑configured before creating the service. Please refer to the guide provided for each service and prepare in advance.

Service Category	Service	Detailed description
Storage	Object Storage	Object storage that simplifies data storage and retrieval
Management	Logging&Audit	A service that collects and analyzes user activity data
Management	Organization	A service that organizes accounts by organizational units, manages them hierarchically, and controls resource access permissions.
Management	ID Center	A service that enables easy centralized management of access permissions for resources by account

Table. Cloud Control Preliminary Service

Release Note

How-to guides