AWS Enterprise Landing Zone

A production-grade, enterprise-scale AWS Landing Zone implementing AWS best practices for multi-account governance, security, and compliance. This solution provisions a fully automated, repeatable AWS environment following the AWS Well-Architected Framework.

Executive Summary

Organizations scaling on AWS face the challenge of maintaining security and governance across dozens or hundreds of accounts. This Landing Zone provides a battle-tested foundation that enforces security guardrails, enables centralized logging, and accelerates account vending — reducing new account provisioning from weeks to hours.

Business Problem Solved

Challenge	Solution
Account sprawl and inconsistent security	AWS Organizations + SCPs enforce baseline controls across all accounts
Manual account creation taking days	Automated account vending via Terraform
No centralized audit trail	CloudTrail + S3 centralized logging with immutable storage
IAM credential sprawl	Permission boundaries + least-privilege IAM roles
Compliance drift over time	AWS Config rules with automated remediation

Architecture Overview

┌─────────────────────────────────────────────────────────────────┐
│                    AWS Organizations Root                        │
│                                                                  │
│  ┌──────────────────┐    ┌──────────────────────────────────┐   │
│  │   Management     │    │         Organizational Units     │   │
│  │    Account       │    │                                  │   │
│  │                  │    │  ┌──────────┐  ┌─────────────┐  │   │
│  │  • Control Tower │    │  │ Security │  │  Workloads  │  │   │
│  │  • Org Master    │    │  │    OU    │  │     OU      │  │   │
│  │  • Billing       │    │  │          │  │             │  │   │
│  └──────────────────┘    │  │ Log Arch │  │  ┌───────┐ │  │   │
│                           │  │ Security │  │  │  Dev  │ │  │   │
│  ┌──────────────────┐    │  │ Tooling  │  │  │  Stg  │ │  │   │
│  │   SCPs Applied   │    │  └──────────┘  │  │  Prod │ │  │   │
│  │  at OU Level     │    │                │  └───────┘ │  │   │
│  │  • Deny regions  │    │  ┌──────────┐  └────────────┘  │   │
│  │  • Require tags  │    │  │Infra/Ops │                   │   │
│  │  • Deny root use │    │  │    OU    │                   │   │
│  │  • Enforce MFA   │    │  └──────────┘                   │   │
│  └──────────────────┘    └──────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

Repository Structure

aws-landing-zone/
├── .github/
│   └── workflows/           # CI/CD pipelines
├── terraform/
│   ├── modules/
│   │   ├── organizations/   # AWS Organizations + OUs
│   │   ├── iam/             # IAM roles, policies, boundaries
│   │   ├── scp/             # Service Control Policies
│   │   └── logging/         # Centralized logging setup
│   └── environments/
│       ├── prod/            # Production configuration
│       └── dev/             # Development configuration
├── docs/
│   ├── architecture/        # Architecture diagrams + decisions
│   └── runbooks/            # Operational runbooks
├── scripts/
│   ├── python/              # boto3 automation scripts
│   └── bash/                # Shell automation scripts
├── CHANGELOG.md
├── SECURITY.md
└── LICENSE

Features

• Multi-Account Structure — Management, Security, Log Archive, and Workload accounts
• Service Control Policies — Guardrails preventing security misconfigurations at scale
• Centralized Logging — CloudTrail, Config, and VPC Flow Logs to immutable S3
• IAM Permission Boundaries — Prevent privilege escalation across all accounts
• Account Vending — Automated new account creation with baseline controls
• Tagging Strategy — Enforced cost allocation and resource tagging
• Region Restriction — Lock workloads to approved AWS regions
• Root Account Protection — SCPs and alerting for root account activity

Prerequisites

Tool	Version	Purpose
Terraform	>= 1.7	Infrastructure provisioning
AWS CLI	>= 2.x	AWS API access
Python	>= 3.11	Automation scripts
Git	>= 2.x	Version control

Quick Start

1. Clone and Configure

git clone https://github.com/Chebis26/aws-landing-zone.git
cd aws-landing-zone

2. Set AWS Credentials

export AWS_PROFILE=management-account
export AWS_DEFAULT_REGION=us-east-1

3. Initialize Terraform

cd terraform/environments/prod
terraform init
terraform plan -out=tfplan

4. Review and Apply

terraform show tfplan
terraform apply tfplan

Security Controls

Control	Implementation	Scope
MFA enforcement	SCP deny without MFA	All accounts
Root account lock	SCP + GuardDuty alert	Management
Region restriction	SCP allowlist	All OUs
CloudTrail	Multi-region, log validation	All accounts
Config Rules	Managed + custom rules	All accounts
GuardDuty	Centralized findings	Security account

Cost Optimization

• AWS Organizations consolidated billing with Reserved Instance sharing
• Centralized S3 lifecycle policies for log data (S3 IA → Glacier)
• Cost allocation tags enforced via SCP
• Estimated baseline cost: ~$50-150/month for foundation accounts

Disaster Recovery

Component	RPO	RTO	Strategy
Terraform state	0	15 min	S3 versioning + DynamoDB lock
CloudTrail logs	0	1 hour	S3 Cross-Region Replication
Config snapshots	1 hour	2 hours	S3 CRR to DR region

Monitoring

• CloudWatch Alarms for root account usage
• GuardDuty findings routed to Security Hub
• EventBridge rules for SCP violation alerts
• Config compliance dashboard

Deployment Guide

See docs/runbooks/deployment.md for the full step-by-step deployment guide.

Architecture Decision Records

See docs/architecture/ for all ADRs covering design decisions.

Contributing

See CONTRIBUTING.md for development guidelines.

License

MIT License — see LICENSE