Skip to content

Commit 94e09c5

Browse files
authored
Updates to orgs page from Ian's review (#48)
* Updates to orgs page from Ian's review * Includes change from ER's copy review
1 parent 651975a commit 94e09c5

File tree

2 files changed

+82
-41
lines changed

2 files changed

+82
-41
lines changed

snooty.toml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,8 @@ oidc = ":abbr:`OIDC (OpenID Connect)`"
114114
Old-Backup = "Legacy Backup"
115115
old-backup = "legacy backup"
116116
Online-Archive = "Online Archive"
117+
PHI = ":abbr:`PHI (Protected Health Information)`"
118+
PII = ":abbr:`PII (Personally Identifiable Information)`"
117119
PIT-Restore = "Continuous Cloud Backup"
118120
pit-restore = "continuous cloud backup"
119121
pkce = ":abbr:`PKCE (Proof Key of Code Exchange)`"

source/hierarchy.txt

Lines changed: 80 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,11 @@ of your {+service+} enterprise estate:
2121
authorization boundary.
2222
- {+Clusters+} are your cloud databases in {+service+}.
2323

24-
Use the foundational guidance on this page to plan the hierarchy and
25-
size for your organizations, projects, and {+clusters+}. This guidance
26-
helps you optimize your security and performance from the start while
27-
aligning with your enterprise's billing and access needs.
24+
Use the foundational guidance on this page to design the layout of your
25+
organizations, projects, and {+clusters+} based on your company's
26+
hierarchy and expected number of {+clusters+} and projects. This
27+
guidance helps you optimize your security and performance from the
28+
start while aligning with your enterprise's billing and access needs.
2829

2930
{+service+} Features and Recommendations for Hierarchy
3031
------------------------------------------------------
@@ -47,10 +48,18 @@ security settings and governance for your {+service+} enterprise estate:
4748
organization(s). The MongoDB account team must enable the paying organization when you establish the |service| subscription. A paying organization lets you set up :atlas:`cross-organization billing <billing/#std-label-cross-org-billing>` to share a
4849
billing subscription across multiple organizations.
4950

51+
A paying organization is common for large enterprises with many
52+
{+BU+}\s or departments that operate independently but where the
53+
contract or bill is owned by a central authority.
54+
5055
* - Organization
51-
- Invoicing aggregates and generates at the organization level.
52-
Line items go to cluster level and below. An organization often
53-
maps to a {+BU+} or application.
56+
- An organization can contain many projects under it and provides
57+
a container to apply shared integration and security settings.
58+
An organization often maps to a {+BU+} or department within a
59+
company. The built-in {+service+} Cost Explorer aggregates cloud
60+
spend at the organization level and breaks out line items at the
61+
{+cluster+} level below it. You can customize further
62+
by leveraging the billing API.
5463

5564
* - Project
5665
- Security configuration for the data plane (including database
@@ -106,20 +115,33 @@ projects and {+clusters+}:
106115
end users.
107116

108117
For your dev and test environments, you can develop {+service+}
109-
{+clusters+} locally with the {+atlas-cli+}. To learn more, see
118+
{+clusters+} locally with the {+atlas-cli+}. This can enable developers
119+
to work locally from their machine and cut down on costs for
120+
development and test environments. To learn more, see
110121
:atlascli:`Create a Local {+service+} Deployment
111122
<atlas-cli-deploy-local>`.
112123

113124
Org and Project Hierarchies
114125
````````````````````````````
115126

127+
Generally, we recommend a paying organization that is managed
128+
centrally, and one organization for each {+BU+} or department that is
129+
linked to the paying org. Then, create a project with one {+cluster+}
130+
each for your lower (dev/test) and upper environments. To learn more,
131+
see the following information for :ref:`<project-hierarchy-1>`.
132+
133+
If you will easily hit the 250 project limit per organization, we
134+
recommend creating one organization per environment, such as one each
135+
for lower and upper environments, or one each for dev, test, staging,
136+
and prod. This has an added benefit of additional isolation.
137+
116138
.. _project-hierarchy-1:
117139

118-
Recommended Hierarchy 1: Fewer Atlas Organizations
119-
##################################################
140+
Recommended Hierarchy
141+
#####################
120142

121-
Consider the following hierarchy for an example enterprise.
122-
This hierarchy, which creates fewer |service| organizations, might be useful if you have common teams and permissions across the {+BU+}, and less than the raiseable limit of 250 projects per organization.
143+
Consider the following hierarchy, which creates fewer |service| organizations, if you have common teams and permissions across the
144+
{+BU+} and less than the raiseable limit of 250 projects per organization.
123145

124146
.. figure:: /includes/images/paying-org-hierarchy.png
125147
:alt: An image showing a paying organization with other organizations nested beneath it.
@@ -128,14 +150,18 @@ This hierarchy, which creates fewer |service| organizations, might be useful if
128150

129151
.. _project-hierarchy-2:
130152

131-
Recommended Hierarchy 2: More Atlas Organizations
132-
#################################################
153+
Recommended Hierarchy 2: Decentralized Business Units/Departments
154+
#################################################################
133155

134-
Consider the following hierarchy for a different enterprise.
135-
This hierarchy creates a relatively large number of |service|
136-
organizations: one per application or scrum team. This hierarchy might
137-
be useful if each of your teams is fairly independent, they don't share people or permissions within a {+BU+}, or they want to buy credits themselves through the cloud provider marketplace. There is
138-
no paying organization in this hierarchy.
156+
Consider the following hierarchy if your organization is highly
157+
decentralized without a centralized function to serve as the contract
158+
and billing owner. In this hierarchy, each {+BU+},
159+
department, or team has their own {+service+} organization. This
160+
hierarchy is useful if each of your teams is fairly independent, they
161+
don't share people or permissions within the company, or they want to
162+
buy credits themselves through the cloud provider marketplace or
163+
directly with their own contract. There is no paying organization in
164+
this hierarchy.
139165

140166
.. figure:: /includes/images/no-paying-org-hierarchy.png
141167
:alt: An image showing multiple organizations without a paying organization above them.
@@ -147,31 +173,30 @@ no paying organization in this hierarchy.
147173
{+Cluster+} Hierarchy
148174
`````````````````````
149175

150-
To allow fine-grained access control, we recommend one deployment
151-
per |service| project as shown in the following diagram:
176+
To maintain isolation between environments, we recommend one
177+
{+cluster+} deployment per {+service+} project, corresponding to each
178+
application as shown in the following diagram:
152179

153180
.. figure:: /includes/images/deployment-hierarchy.png
154181
:alt: An image showing one deployment per project in each organization.
155182
:align: center
156183
:lightbox:
157184

158-
Grouping multiple deployments in one project by team as shown in the following diagram simplifies
159-
administration when the same team is responsible for all stages of
160-
development, acceptance testing, and production. However, this
161-
increases the risk of human error, since DevOps members also have
162-
access to production {+clusters+}.
185+
Grouping multiple {+clusters+} and therefore applications into one
186+
project by environment as shown in the following diagram simplifies
187+
administration when the same team is responsible for multiple
188+
applications across environments. This eases the setup cost for
189+
features such as private endpoints and customer-managed keys, since all {+clusters+} in the same project share this configuration. However,
190+
this {+cluster+} hierarchy may violate the least-privilege rule.
163191

164-
.. figure:: /includes/images/alt-deployment-hierarchy-1.png
165-
:alt: An image showing deployments grouped by environment.
166-
:align: center
167-
:lightbox:
192+
You should use this hierarchy only if both of the following are true:
168193

169-
Grouping multiple deployments in one project by environment as shown in the following diagram simplifies
170-
administration when a separate team is responsible for each stage of
171-
development, acceptance testing, and production. It allows Dev and UAT
172-
hosts to support multiple nodes when testing shard-level operations like adding shards, and testing new zone rules. However, there is a
173-
risk of human error because the same DevOps teams can access multiple
174-
sub-organizations' databases.
194+
- Every team member with access to the project is working on all other
195+
applications and {+clusters+} in the
196+
project.
197+
- You are creating {+clusters+} for lower environments. Production
198+
{+clusters+} should still follow the rule of single
199+
{+cluster+}, single project to ensure isolation.
175200

176201
.. figure:: /includes/images/alt-deployment-by-environment.png
177202
:alt: An image showing deployments grouped by environment.
@@ -182,14 +207,16 @@ sub-organizations' databases.
182207
```````````````````
183208

184209
We recommend that you tag {+clusters+} with the following details to
185-
enable easy data parsing for reports:
210+
enable easy parsing for reporting and integrations:
186211

187-
- {+BU+}
212+
- {+BU+} or Department
188213
- Team name
189214
- Application name
190215
- Environment
191216
- Version
192217
- Email contact
218+
- Criticality (indicates the tier of data stored on the {+cluster+},
219+
including any sensitive classifications such as {+PII+} or {+PHI+})
193220

194221
To learn more about parsing billing data using tags, see
195222
:ref:`arch-center-billing-data`.
@@ -218,6 +245,17 @@ characteristics, and growth expectations.
218245
applications, high-memory workloads, and high-CPU workloads, contact
219246
|mdb-support| for customized guidance.
220247

248+
You can estimate
249+
the {+cluster+} resources required by using your organization's approximate data size and workload:
250+
251+
- **Total Storage Required**: 50% of the
252+
total raw data size
253+
- **Total RAM Required**: 10% of the total raw data size
254+
- **Total CPU Cores Required**: expected peak read/write database
255+
operations per second ÷ 4000
256+
- **Total Storage IOPS Required**: expected peak database writes per
257+
second (min IOPS = 5%, max IOPS = 95%)
258+
221259
.. list-table::
222260
:header-rows: 1
223261
:widths: 10 10 20 20 10 10 10 20
@@ -232,7 +270,7 @@ characteristics, and growth expectations.
232270
- Recommended For
233271

234272
* - Small
235-
- ``M10``
273+
- ``M10`` [1]_
236274
- 10 GB to 128 GB
237275
- 8 GB to 128 GB
238276
- 2
@@ -267,6 +305,8 @@ characteristics, and growth expectations.
267305
- 3000
268306
- Prod
269307

308+
.. [1] ``M10`` is a shared CPU tier. For highly-regulated industries or sensitive data, your minimum and smallest starting tier should be ``M30``.
309+
270310
To learn more about {+cluster+} tiers and the regions that support
271311
them, see the {+service+} documentation for each cloud provider:
272312

@@ -278,8 +318,7 @@ Examples
278318
--------
279319

280320
The following examples create organizations, projects, and {+clusters+}
281-
using |service| using
282-
|service| :ref:`tools for automation <arch-center-automation>`.
321+
using |service| :ref:`tools for automation <arch-center-automation>`.
283322

284323
These examples also apply other recommended configurations, including:
285324

0 commit comments

Comments
 (0)