Skip to content
LinuxUnity
Back to projects
DevOps · Lab

AWS Multi-account Landing Zone

A multi-account AWS model with guardrails, centralized logging, and controlled account provisioning.

Placeholder content
AWS OrganizationsControl TowerIAMCloudTrailTerraform
Role
Cloud Platform Engineer
Timeline
February 2026
Type
Lab
Status
In progress
Infrastructure
AWS Organizations · Control Tower · IAM
Repository
Not published

Problem

Separate AWS workloads, apply guardrails, and preserve centralized audit evidence across multiple accounts.

Sample content for layout validation. Replace it with verified implementation evidence before presenting this as a completed case study.

Constraints

  • Real account IDs must not be exposed
  • Organization changes require review
  • Recovery must be rehearsed before completion

Success criteria

  • Account provisioning has an audit trail
  • Every guardrail has a test case
  • Workload accounts cannot delete central logs

Architecture

The architecture separates clear responsibilities so each component can be tested, operated, and changed independently.

AWS Organizations

Manages account hierarchy and policy boundaries.

Workload accounts

Separate environments and blast radius.

Log archive

Provides a restricted destination for centralized audit logs.

Implementation

The work is organized into phases with explicit tools and verifiable outputs.

  1. Design

    Design the hierarchy

    Define organizational units, account boundaries, and ownership.

    Tools: AWS Organizations · Output: Organization model
  2. Provision

    Model the baseline

    Prepare account and shared-service configuration.

    Tools: Terraform · Control Tower · Output: Baseline draft
  3. Build

    Standardize account provisioning

    Describe account creation and bootstrap controls.

    Tools: Account Factory · Output: Provisioning workflow
  4. Secure

    Apply guardrails

    Define SCPs, break-glass access, and reviews.

    Tools: SCP · IAM Identity Center · Output: Guardrail matrix
  5. Observe

    Centralize audit trails

    Design CloudTrail and Config aggregation.

    Tools: CloudTrail · AWS Config · Output: Audit logging design
  6. Optimize

    Review governance

    Define exception and account lifecycle processes.

    Tools: AWS Organizations · Output: Governance backlog

Security

These items describe concrete controls or work that still requires verification.

  • Each SCP requires a matching test case.
  • Break-glass access and log retention still require validation.

Observability

  • Organization trails and Config aggregation are part of the planned architecture.

Results

  • The organization model and guardrail matrix remain drafts.
  • No evidence from a live AWS Organization is published.

Challenges and lessons learned

Challenge

Overly broad guardrails can block legitimate operations.

Approach

Pair every control with a test, owner, and exception path.

Lesson

Governance requires both preventive controls and an auditable exception process.