cloud doc review

docs/cloud/aws/index.md

@@ -1,6 +1,4 @@
-# AWS
-
-Amazon Web Services (AWS) Documentation
+# Amazon Web Services
 
 This applies to customers who are using a **Research Computing Cloud Foundations** managed AWS account.
 
@@ -12,36 +10,27 @@ Research Computing Cloud Foundations managed AWS accounts can be provisioned onl
 
 Each managed AWS account is associated with exactly one landing zone. A landing zone is a consistent group of account configuration, networking, and security controls that are applied to all associated accounts.
 
-The Cloud Foundations team currently supports two landing zones, **LCA0** and **LCA1**. The landing zone associated with your AWS account dictates how you should log in and how the account is designed to work. You should reference documentation below that aligns with your landing zone.
-
-### How do I know what landing zone my AWS account is in?
-
-You received a url to log into your AWS account as part of your onboarding.
+Currently we support two landing zones, **LCA0** and **LCA1**.
 
-If you login via [https://aws-classic.colorado.edu/](https://aws-classic.colorado.edu/), you are using **LCA0**.
+* LCA0: This is the original landing zone, intended for public data.
+* LCA1: This is the next-generation landing zone, designed to support a wider range of data classifications. 
 
-If you login via [https://aws.colorado.edu/](https://aws.colorado.edu/), you are using **LCA1**.
+Your landing zone determines how you access your AWS account and which capabilities and controls apply to the account.
 
-### Landing Zone: LCA0
+### How do I know what landing zone my AWS account is in?
 
-LCA0 is the original landing zone, rated only for public data.
+You received an AWS login URL as part of the account onboarding process. The URL indicates which landing zone your account uses:
 
+If you login via [https://aws-classic.colorado.edu/](https://aws-classic.colorado.edu/), you are using **LCA0**.
 ```{toctree}
 :maxdepth: 2
-:caption: LCA0
-
+:hidden:
 lca0/index
-
 ```
 
-### Landing Zone: LCA1
-
-LCA1 is the next generation landing zone that will be rated to support a variety of data classifications.
-
+If you login via [https://aws.colorado.edu/](https://aws.colorado.edu/), you are using **LCA1**.
 ```{toctree}
 :maxdepth: 2
-:caption: LCA1
-
+:hidden:
 lca1/index
-
 ```

docs/cloud/aws/lca0/billing/budget-actions.md

@@ -1,4 +1,4 @@
-# AWS - Budget Actions
+# Budget Actions
 
 You can attach budget actions to an alert for either a cost budget or a usage budget. To configure a budget action on a new budget, first follow the steps for [Creating a cost budget](https://docs.aws.amazon.com/cost-management/latest/userguide/create-cost-budget.html)
 
@@ -12,31 +12,43 @@ You can attach budget actions to an alert for either a cost budget or a usage bu
 
 3.	Click on ‘create budget’, choose Budget setup as ‘Customize(advanced)’ and Budget type as ‘Cost budget’
 
-![](images/1.png)
+```{image} images/1.png
+:alt: AWS Budget creation wizard with Customize advanced selected and Cost budget chosen as the budget type.
+:align: center
+```
+4.	Enter a **Budget name**. Set **Set budget amount** to monthly, set **Budget renewal type** to **Recurring budget**, choose a **Start month**, set **Budgeting method** to **Fixed**, then enter your budgeted amount.
 
-4.	Choose ‘Budget name’ of choice and ‘set budget amount’ to monthly with ‘Budget renewal type’ as ‘Recurring budget’. Choose ‘Start month’ and ‘Budgeting method’ as ‘Fixed’. And finally ‘Enter your budgeted amount’.
+```{image} images/2.png
+:alt: AWS Budget creation wizard budget details, including name, monthly recurring amount, start month, and fixed budgeting method.
+:align: center
+```
+5.	Under **Budget scope**, select the services to include. This example uses **All AWS Services**. Select **Next**.
 
-![](images/2.png)
+```{image} images/3.png
+:alt: AWS Budget creation wizard budget scope step with All AWS Services selected.
+:align: center
+```
 
-5.	Choose ‘Budget scope’ and select the services you would like in scope. For this example we will choose 'All AWS Services' and choose ‘Next’
+To configure a budget action on an existing cost or usage budget, first follow the steps for [editing a budget](https://docs.aws.amazon.com/cost-management/latest/userguide/create-cost-budget.html). Then, after you reach the **Configure alerts** step of creating or editing the budget, use the following procedure.
 
-![](images/3.png)
-
-To configure a budget action on an existing cost or usage budget, first follow the steps for [Editing a budget](https://docs.aws.amazon.com/cost-management/latest/userguide/create-cost-budget.html). Then, after you reach the **Configure alerts** step of creating or editing the budget, use the following procedure.
-
-
-## To configure a budget action
+## Configure a budget action
 
 1.	To configure a budget action on a new alert, choose **Add an alert threshold**. To configure a budget action on an existing alert, skip to step 7.
 
-![](images/4.png)
-
+```{image} images/4.png
+:alt: AWS Budget creation wizard Configure alerts step with an Add an alert threshold button.
+:align: center
+```
 2.	Under Set **alert threshold**, for Threshold, enter the amount that needs to be reached for you to be notified. This can be either an absolute value or a percentage(choose using drop down). For example, say you have a budget of $200. To be notified at $160 (80% of your budget), enter 160 for an absolute budget or 80 for a percentage budget.
 
     Next to the amount, choose **Absolute value** to be notified when your costs exceed the threshold amount. Or, choose **% of budgeted amount** to be notified when your costs exceed the threshold percentage.
 
     Next to the threshold, choose **Actual** to create an alert for actual spend ‘Trigger’. Or, choose **Forecasted** to create an alert for forecasted spend.
-    ![](images/5.png)
+
+    ```{image} images/5.png
+    :alt: AWS Budget creation wizard alert threshold fields for amount, absolute or percentage, and actual or forecasted spend.
+    :align: center
+    ```
 
 3.	(Optional) Under **Notification preferences - Optional**, for **Email recipients**, enter the email addresses that you want the alert to notify. Separate multiple email addresses with commas. A notification can have up to 10 email addresses.
 
@@ -48,7 +60,10 @@ To configure a budget action on an existing cost or usage budget, first follow t
 
 7.	  For **Attach actions - Optional**, choose **Add Action.**
 
-![](images/6.png)
+```{image} images/6.png
+:alt: AWS Budget creation wizard Attach actions step with an Add Action button.
+:align: center
+```
 
 8. For **Select IAM role**, choose an IAM role to allow AWS Budgets to perform an action on your behalf. It is recommended to use ‘Budget-role’ which has a Managed policy: AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSM attached to it. 
 This managed policy is focused on specific actions that AWS Budgets takes on your behalf when completing a specific action. This policy gives permission to control AWS resources. For example, starts and stops Amazon EC2 or Amazon RDS instances by running AWS Systems Manager (SSM) scripts.
@@ -61,18 +76,30 @@ This managed policy is focused on specific actions that AWS Budgets takes on you
 
 12. For **How do you want to be alerted when this action is run, choose Use the same alert settings when you defined this threshold** or **Use different alert settings**. To use different alert settings, complete the **Notification preferences** specific to this action.
 
-![](images/7.png)
+```{image} images/7.png
+:alt: AWS Budget creation wizard action configuration fields for IAM role, action type, instance targets, automatic run, and alert settings.
+:align: center
+```
 
 13.	Choose **Next**.
 
 14.	Review your budget settings, and then choose **Create budget**.
 
-![](images/8.png)
+```{image} images/8.png
+:alt: AWS Budget creation wizard review page summarizing budget details, alerts, and actions before Create budget.
+:align: center
+```
 
 After you create an action, you can view its status from the AWS Budgets page on the **Actions** column. This column shows your configured actions count, actions waiting for your approval (**Requires approval**), and your successfully completed actions.
 
-![](images/9.png)
+```{image} images/9.png
+:alt: AWS Budgets overview table with an Actions column showing configured, pending, and completed action counts.
+:align: center
+```
 
 Once a budget action is taken place, you get alerts based on the chosen notification preference. Below is a snippet of an email notification.
 
-![](images/10.png)
+```{image} images/10.png
+:alt: Example AWS Budgets email notification stating that a budget threshold was exceeded and an action was taken.
+:align: center
+```

docs/cloud/aws/lca0/billing/cost-est.md

@@ -1,16 +1,12 @@
-# AWS - Network Cost Guide
+# Network Cost Guide
 
-## Document Purpose
-
-This document gives some sample cost estimates for select network access methods and provides the URL's to find current pricing. 
-
-## Network access methods 
+There are thre network acess methods available:
 
 1) Internet Gateway - used with public IP
 2) NAT Gateway - used with private IP
 3) CFS Transit Gateway (VPN) - used with private IP address, VPN connects back to CU Boulder
 
-### Internet Gateway
+## Internet Gateway
 
 **Important**
 Always check [AWS documentation](https://aws.amazon.com/ec2/pricing/on-demand/) for current pricing.
@@ -30,7 +26,7 @@ Always check [AWS documentation](https://aws.amazon.com/ec2/pricing/on-demand/)
 
 	Total Network Cost = $36/month
 
-### NAT Gateway
+## NAT Gateway
 
 **Important**
 Always check [AWS documentation](https://aws.amazon.com/vpc/pricing/) for current pricing.
@@ -50,7 +46,7 @@ Always check [AWS documentation](https://aws.amazon.com/vpc/pricing/) for curren
 
 	Total Network Cost = $59.40/month
 
-### CFS Transit Gateway VPN
+## CFS Transit Gateway VPN
 
 **Important**
 Always check [AWS documentation](https://aws.amazon.com/transit-gateway/pricing/) for current pricing.
@@ -68,5 +64,4 @@ Always check [AWS documentation](https://aws.amazon.com/transit-gateway/pricing/
 	2) Upload cost = $0.02 x 500 = $10
 	3) Attachment cost = $0.05 x (24hr x 30day= 720hr) = $36
 
-	Total Network Cost = $48/month
-
+	Total Network Cost = $48/month

docs/cloud/aws/lca0/billing/index.md

@@ -1,29 +1,23 @@
-# AWS - Billing
+# Billing
 
 ```{note}
 The data in AWS Cost Explorer does not directly map to the charges in the invoices you receive. See the links below to learn how to accurately calculate your charges in AWS Cost Explorer and set budget alerts.
 ```
 
 ```{toctree}
 :maxdepth: 1
-:caption: View Billing
-
 viewbilling
 
 ```
 
 ```{toctree}
 :maxdepth: 1
-:caption: Budget Actions
-
 budget-actions
 
 ```
 
 ```{toctree}
 :maxdepth: 1
-:caption: Network Cost Guide
-
 cost-est
 
 ```

docs/cloud/aws/lca0/billing/viewbilling.md

@@ -1,4 +1,4 @@
-# AWS - View Billing Data
+# View Billing Data
 
 ```{note}
 For all billing periods beginning after 6/30/2025, you should refer directly to [AWS Cost Explorer](https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) and your invoices in the [CU Marketplace](https://www.cu.edu/uis/service-catalog/cu-marketplace). CloudCheckr is no longer used for billing information.

docs/cloud/aws/lca0/faq/faq.md

@@ -1,6 +1,4 @@
-# AWS - FAQs
-
-Frequently Asked Questions
+# Frequently Asked Questions
 
 If you are looking for help with specific errors, please visit the [Troubleshooting](../troubleshooting/troubleshooting.md) guide.
 
@@ -24,9 +22,7 @@ The **us-west-2** AWS region has the lowest latency from Colorado's Front Range
 
 ## Can I use the root user?
 **Answer:**
-No.
-The root user is owned by the **Cloud Foundations Service** team.
-You must use your CustomerAdmin role.
+No, the root user is owned by the **Cloud Foundations Service** team. You must use your `CustomerAdmin` role.
 
 
 ## Are MTurk users supported?
@@ -51,5 +47,5 @@ Click on the drop down on the top right corner of the console page to expand you
 **Answer:**
 No. Resources owned by the **Cloud Foundations Service (CFS)** team cannot be altered or removed and they can be identified by name prefix and/or resource tags. Any resources with the prefix `oitcld-` are owned by CFS, in addition to those with the below tag attached.
 ```{image} images/CFSTag.png
-:alt: The CFS tag has the key/value pair of "oit-cld:management:central"/"true"
+:alt: AWS resource tag with key oit-cld:management:central and value true.
 ```

docs/cloud/aws/lca0/getting-started/aws-console-access.md

@@ -27,13 +27,13 @@ You can access your AWS Account from anywhere with internet access.  You do not
 1. Launch the [AWS Management Console (SSO URL)](https://aws-classic.colorado.edu).
 2. Provide your university login credentials (like your [CU IdentiKey](https://oit.colorado.edu/services/identity-access-management/identikey) for CU Boulder) when directed to Microsoft Entra.
     ```{image} images/aws-console-access/login.png
-        :alt: CU SSO login page
+        :alt: CU single sign-on login page for accessing the AWS Management Console.
     ```
 3. Choose a method for authentication.  We recommend you select "Send Me a Push".  **NOTE:** You may not see the MFA step if you've recently authenticated and have an active session.
 4. Accept the MFA request on your device.
 5. You will be presented with a list of account names and numbers to which you have access. Click on the name of the desired account to expand the roles allocated to you.  Select the Account and Role you wish to log in to.
     ```{image} images/aws-console-access/select-role.png
-        :alt: AWS SSO account and role selection page
+        :alt: AWS access portal listing accounts and roles that can be selected after sign-in.
     ```
 6. You will be logged in to the AWS Management Console.  Always be sure to verify you have the AWS Region you are working with selected after logging in.
 Once logged in, you have a 4 hour session.  When your session expires, return to the access portal to refresh your credentials.

docs/cloud/aws/lca0/getting-started/customer-permission-boundary.md

@@ -1,11 +1,11 @@
 # Admin Account Permission Exclusions
 
-Customers who wish to create new AWS Users or Roles are prevented from doing so unless they use the "Customer_Admin_PermissionBoundary" Permission Boundary.
+Customers who wish to create new AWS Users or Roles are prevented from doing so unless they use the `Customer_Admin_PermissionBoundary` Permission Boundary.
 See below for more information.  In addition, there are Explicit Denials that apply to all AWS Users and Roles.  This is also described below.
 
 
 ```{important}
-Note that when using some AWS wizards to create services, the wizard will try to create a Role.
+When using some AWS wizards to create services, the wizard will try to create a Role.
 Due to the limitations discussed below, the wizard will fail.
 When encountering this situation, you must manually create the Role with the proper permissions, and attach the permission boundary discussed below.
 Then, in the wizard, you need to pick the Role you created.
@@ -18,7 +18,9 @@ This Role will generally be used to set up new IAM Roles and to deploy basic inf
 Please consider the principal of least privilege when managing your accounts.
 
 In order to ensure that this role is not breaking components deployed as part of the CU Boulder standard AWS Account Baseline there are certain restrictions on what this role can perform.
-Outside of these restrictions, the Customer Admin role will have full administrative privileges.
+Outside of these restrictions, the `Customer Admin` role will have full administrative privileges.
+
+## Actions Explicitly Denied
 
 All Users, including Customer Administrators, automatically have Explicit Denial of the following actions:
 * Changes to OIT Cloud Admin Roles, Users, Policies, and Groups
@@ -32,16 +34,21 @@ All Users, including Customer Administrators, automatically have Explicit Denial
 ## Permission Boundary (limits permissions of new users or roles created by Customer Admin)
 
 Creation of new Users and Roles by a Customer Admin Role is only allowed if the Permission Boundary is attached at the creation of the User or Role.
-Permission Boundary is a policy created by **Research Computing Cloud Team** in your account named "Customer_Admin_PermissionBoundary".
+Permission Boundary is a policy created by us in your account named `Customer_Admin_PermissionBoundary`.
 
-New Users and Roles have the same restrictions as above, plus:
-* New Users/Roles are Explicitly Denied the ability to Create/Update any additional AWS Roles/Users
+New users and roles created with this permissions boundary are subject to the same explicit restrictions listed above. They are also explicitly denied the ability to to Create/Update any other AWS Roles/Users
 
 ## Attaching Permission Boundary
 
-When creating new AWS Roles or Users, you must set the Permission Boundary.
+You must attach the Customer_Admin_PermissionBoundary permissions boundary when creating a new IAM user or role.
+
+During the Create role or Create user wizard:
 
-On Step 2 of the 'Create role' or 'Create user' wizard, search for and add the "Customer_Admin_PermissionBoundary" Policy to the 'Set permissions boundary' section.
+1. On Step 2, expand Set permissions boundary.
+2. Select Use a permissions boundary to control the maximum role permissions.
+3. Search for `Customer_Admin_PermissionBoundary`.
+4. Select `Customer_Admin_PermissionBoundary`.
+5. Select Next: Tags to continue.
 
-![](images/customer-permission-boundary/permission-boundary.jpeg)
+![AWS Create role wizard Set permissions boundary section, with Use a permissions boundary selected, Customer_Admin_PermissionBoundary chosen, and Next: Tags highlighted.](images/customer-permission-boundary/permission-boundary.jpeg)
 

docs/cloud/aws/lca0/getting-started/customer-support.md

@@ -1,4 +1,4 @@
-# AWS Support
+# AWS Support Plan
 
 All new AWS accounts are configured with Basic Support. AWS offers higher support tiers at pay-by-the-month pricing.
 
@@ -16,5 +16,5 @@ For more information about OIT Support, visit the website: [https://oit.colorado
 
 **Support Levels and Costs**
 
-For more information about AWS Support Plans and Pricing, please see the AWS documentation here: [https://aws.amazon.com/premiumsupport/pricing/?nc=sn&loc=3](https://aws.amazon.com/premiumsupport/pricing/?nc=sn&loc=3)
+For more information about AWS Support Plans and Pricing, please see the AWS documentation here: [https://aws.amazon.com/premiumsupport/pricing/](https://aws.amazon.com/premiumsupport/pricing/?nc=sn&loc=3)
 

docs/cloud/aws/lca0/getting-started/index.md

@@ -1,8 +1,7 @@
-# AWS - Getting Started
+# Getting Started
 
 ```{toctree}
 :maxdepth: 2
-:caption: Getting Started Documentation
 
 aws-console-access
 aws-cli-access