Governance
Part of Cloud operations governance
Assigning owners to cloud accounts and workloads
Map cloud account and workload owners to decision rights, daily operations, budget contacts and escalation routes.
Assign an owner to every cloud account and workload, and name the team that operates each service. The account owner decides on the administrative boundary; the workload owner decides on the business service. If the budget contact is a different person or team, record it separately.
Map boundaries to services
List each account, subscription or project, its environment and the workloads it supports. Then identify each workload's components and shared dependencies. An account can contain several workloads, and a workload can use several accounts. Check the arrangement before assuming their owners are the same.
For each boundary, record an internal decision owner, an alternate contact and who approves account-level access or changes. For each workload, record its business decision owner, technical operator and incident route. AWS guidance recommends discoverable owners for accounts, workloads and resources, using a register or metadata. AWS billing, operations and security alternate contacts help route provider notices.
Question / Record the person or team that answers it
- Who accepts a change to the service?
- Workload decision owner
- Who investigates a live failure?
- Technical operator and escalation contact
- Who controls account settings and contacts?
- Account owner or delegated administrator
- Who explains its charges?
- Budget owner or finance contact
- Who acts when the usual owner is away?
- Named deputy or maintained team route
One person may fill several roles. Keep the roles separate so each decision can be reassigned when needed.
Make shared and outsourced duties explicit
A shared database or network may have one platform operator and several consuming workload owners. Record who changes the shared component, who approves a disruptive change and who checks affected applications.
If an external provider operates it, name the internal owner who receives incidents, reviews the work and can authorise a replacement. Microsoft guidance describes a shared management model in which responsibilities are divided between platform and workload teams.
A generic inbox is useful only when it has a maintained roster and escalation path. A named employee also needs a continuity route. The record should make both the decision holder and the reachable contact clear.
Check the assignment in use
For an important workload, trace where an account notice, routine change request and incident escalation would go. Check whether each reaches someone with the authority and information to act. Record a result only after the check occurs.
Review assignments when staff move, supplier contracts change, workloads move or accounts are reorganised. Give unknown ownership an investigator and decision date. The register should let an operator answer who decides, who acts and who takes over.
