Landing Zone Guardrails For Multi-Account AWS

1. Situation

A company has five AWS accounts today and expects one hundred. Product teams need production, development, and sandbox environments. Security needs audit evidence. Finance needs ownership. Platform engineering wants every new account to begin with the same baseline.

If every account is assembled manually, growth produces one hundred different answers to basic questions:

• Who can sign in?
• Which Regions and services are allowed?
• Where do CloudTrail API-activity records and AWS Config resource-configuration history go?
• Which security services are enabled?
• Who owns the account and its cost?

A landing zone is the governed multi-account foundation that answers those questions before workloads arrive.

2. Naive Design

Tap to exploreOpen diagram

Teams create root-email conventions, IAM users, VPCs, logs, and security settings independently. New accounts are fast initially but expensive to audit and repair.

A second mistake is attaching a strict service control policy (SCP)—a policy that caps permissions in affected member accounts—to the organization's top-level root as the first experiment. Because child OUs and accounts inherit policy from the root, one error can affect nearly every workload.

A third mistake is running applications and daily security administration from the Organizations management account. That account has special organization authority and should have a deliberately small operational surface.

3. What Breaks

1. In the hand-built starting design above, a new sandbox account is created outside the standard process.
2. CloudTrail activity logging and GuardDuty threat detection are not enrolled.
3. A developer creates resources in an unsupported Region.
4. Security discovers the account only after an incident.
5. An emergency SCP blocks the Region but also blocks a service role needed by production.

The missing system is not another checklist. It is a repeatable account lifecycle with ownership, inherited policy, evidence, and exception handling.

4. AWS Architecture

Step 1: make accounts the boundary

Separate workloads, environments, and security functions where differences in blast radius, ownership, quotas, or policy justify it.

Tap to exploreOpen diagram

An OU groups accounts for administration and inherited policy. It is not a network boundary, and resources do not live directly inside an OU.

Design OUs by shared control requirements rather than reproducing every line of the company org chart.

Step 2: orchestrate the foundation with Control Tower

AWS Control Tower provides a managed landing-zone experience built with services including Organizations, IAM Identity Center, CloudTrail, and Config.

Tap to exploreOpen diagram

Control Tower does not replace those underlying services. It orchestrates a supported baseline and exposes governance state. It can also report supported forms of drift, where managed accounts, OUs, policies, or landing-zone resources no longer match the expected governance configuration. Existing organizations can require deliberate enrollment and compatibility work; do not assume enabling it silently fixes every existing account.

Step 3: vend accounts through Account Factory

request -> owner and purpose -> correct OU -> standardized account -> workload team

Account Factory provides a repeatable account-provisioning template. The process should capture account email, business owner, technical owner, environment, cost center, intended Regions, and network pattern.

The account owner receives a prepared boundary rather than inventing identity and logging. Moving an account into a governed OU can immediately apply inherited controls, so evaluate existing resources first.

Step 4: centralize workforce access

Use IAM Identity Center groups and permission sets for workforce access across accounts.

Tap to exploreOpen diagram

Permission sets define access that IAM Identity Center provisions into selected accounts. SCPs still cap what those roles can do. Prefer short-lived federated sessions over creating long-lived IAM users separately in every account.

Step 5: layer three control behaviors

Control Tower preventive controls can use Organizations policies such as SCPs and other supported policy mechanisms. Detective controls commonly use AWS Config rules. Proactive controls use CloudFormation hooks for supported resources.

No one behavior replaces the others. Prevention is strongest but can block legitimate operations. Detection supports visibility and remediation. Proactive checks apply to their supported provisioning path and resource types.

Step 6: understand SCPs precisely

effective permission = allowed by IAM/resource policy AND not blocked by organization boundaries

SCPs limit the maximum permissions for affected member accounts. They do not grant an action. They also do not affect users and roles in the management account.

Test a new SCP in a small test OU. Check service-linked roles—AWS-created IAM roles that services use to act in an account—along with deployment automation, incident access, and required Regions before expanding scope. Keep a rollback method outside the policy path being tested.

Step 7: separate evidence and security operations

Use dedicated accounts for central logs and security operations.

Tap to exploreOpen diagram

Workload administrators should not control the only copy of their audit history. A delegated administrator is a member account authorized to manage a supported AWS service for the organization. Use one where appropriate so daily security operations do not require the management account.

Completed landing zone

Tap to exploreOpen diagram

5. Request Or Data Flow

1. A team requests an account with owner, environment, and cost metadata.
2. Platform engineering chooses the OU whose controls match the workload.
3. Account Factory provisions or enrolls the account with the landing-zone baseline.
4. IAM Identity Center assigns approved groups and permission sets.
5. Preventive controls restrict prohibited actions; proactive controls inspect supported templates; detective controls report drift or noncompliance.
6. Logs and security signals flow to central accounts.
7. The product team deploys inside the boundary and requests a documented exception when the boundary does not fit.

6. Security Controls

• protect the management account with minimal access and no ordinary workloads;
• use delegated administrators where supported;
• centralize CloudTrail, Config, and security evidence;
• require short-lived workforce access and MFA through the identity system;
• test SCPs and controls before broad inheritance;
• document exceptions with owner and expiry; and
• maintain audited break-glass access, an emergency identity path that remains usable during identity-system failure.

Guardrails reduce possible actions. They do not replace secure workload IAM, networking, encryption, patching, or application design.

7. Resilience Controls

Monitor account enrollment, failed provisioning, control violations, Control Tower drift, disabled security services, missing log delivery, unowned accounts, and exception expiry.

Keep account vending reproducible. Preserve a quarantine or suspended OU for accounts leaving normal operation, with carefully designed access and evidence retention.

Test recovery from a bad policy. A governance platform that can lock every operator out without a recovery procedure creates a new organizational failure mode.

8. Performance Controls

Good governance reduces delivery time because identity, evidence, and baseline controls are ready. Poor governance creates ticket queues and policies too broad for managed services to operate.

Measure account-provisioning time, exception lead time, failed deployments caused by controls, control-evaluation delay, and drift-remediation time. Tighten controls using observed access and staged rollout rather than guessing from service names.

9. Cost Controls

Account separation improves ownership, but every baseline can add Config items, logs, security-service coverage, network endpoints, NAT gateways, and support overhead.

Define lighter but still safe sandbox baselines where appropriate. Centralize shared services only when the security, routing, availability, and chargeback model is clear. Attach budgets and cost metadata during account creation rather than after the first surprise bill.

10. Exam Variants

11. Common Traps

• Do not treat an OU as a VPC or resource container.
• Do not say an SCP grants access.
• Do not expect SCPs to restrict the management account.
• Do not attach untested policies at the organization root.
• Do not confuse preventive, detective, and proactive timing.
• Do not assume enrolling an existing account is impact-free.
• Do not let workload accounts own their only audit evidence.
• Do not create workforce IAM users separately in every account without a specific need.
• Do not describe a landing zone as a one-time setup; it has drift, exceptions, and lifecycle operations.

Final Mental Model: One-Minute Review

Tap to exploreOpen diagram

Organizations defines the account map; Control Tower operationalizes the baseline; controls constrain behavior; central identity and evidence make the environment governable.

12. Related Topics

Review AWS Account Model, AWS Organizations, Service Control Policies, AWS Control Tower, AWS IAM Identity Center, and Secure Cross-Account CloudTrail Logging.

Official references: What is AWS Control Tower?, Control behaviors, and Service control policies.