AWS Landing Zone Cheat Sheet

Search keywords: AWS landing zone Organizations account OU SCP IAM VPC Transit Gateway Terraform security logging cost

30-second answer

An AWS landing zone is a standardized foundation for operating workloads across AWS accounts and regions. The foundation normally covers account structure, identity and access, governance, networking, security, centralized logging, monitoring and cost controls. The goal is to make workload environments consistent, governed and repeatable.

Mental model

Cloud Landing Zone
├── Organization / Account structure
├── Identity & Access
├── Governance
├── Networking
├── Security
├── Logging / Monitoring
├── Cost management
└── Workloads

AWS Organizations

AWS Organization
├── Management Account
├── Organizational Units
│   ├── Security
│   ├── Infrastructure
│   ├── Workloads
│   └── Sandbox
└── AWS Accounts
    ├── Security
    ├── Log Archive
    ├── Network
    ├── Shared Services
    ├── Dev
    └── Prod

Centralized networking

                 NETWORK / HUB
                       │
              Transit Gateway
             / centralized network
              │      │      │
             VPC    VPC    VPC
             Dev   Prod   Shared

A common centralized design uses Transit Gateway and separate VPCs for workload boundaries.

IAM vs SCP

IAM: controls what an identity can do, subject to the other authorization controls.

SCP: sets the maximum permissions boundary available to accounts/principals within an AWS Organization or OU.

Mental model:

SCP
 ↓
Maximum allowed boundary

IAM
 ↓
What the identity is actually allowed to do

Centralized logging

Account A ─┐
Account B ─┼──→ Central Log Archive
Account C ─┘

Benefits: central audit, security investigation, compliance, incident response and reduced risk of local log tampering/deletion.

Security layers

Identity
   ↓
Preventive controls
   ↓
Network controls
   ↓
Detection
   ↓
Logging
   ↓
Response

Workload → Internet troubleshooting

EC2
 ↓
Security Group
 ↓
Subnet
 ↓
Route Table
 ↓
NAT Gateway / IGW
 ↓
Network Firewall if applicable
 ↓
Internet

VPC → VPC troubleshooting

Source
 ↓
Security Group
 ↓
Route
 ↓
Transit Gateway / peering
 ↓
Destination route
 ↓
Security Group
 ↓
Destination

New-region expansion

Existing modules
      ↓
Region-specific configuration
      ↓
Required resources
      ↓
Deployment

Interview framework

Why → Boundary → Network → Security → Governance → Operations → Automation → Scale → Trade-offs