Skip to main content
A.I. Commerce Studio

Cloud and platform

Multi-account AWS landing zone

An organisation with separate accounts, SCPs, central logging and a Transit Gateway as the foundation for teams.

Fictional scenario. An example situation that illustrates the approach. It is not a client project and describes no measured results.

Business problem

A fictional software company runs everything in one AWS account. Costs and permissions are hard to separate.

Assumptions

  • AWS Organisations is available.
  • Single sign-on is used.
  • Infrastructure is code.

Constraints

  • Separate accounts for production and testing.
  • Teams cannot delete logs.
  • An EU region by default.

Reference architecture

Components by stage — an illustration, not a running system and not a certified design.

  1. 01Organisation

    • Organizational units
    • SCPs

  2. 02Identity

    • IAM Identity Center
    • Roles per account

  3. 03Network

    • Transit Gateway
    • Shared VPCs
    • Central egress

  4. 04Security

    • Organisation CloudTrail
    • Security Hub
    • Log archive account
The diagram as a list
StageComponents
OrganisationOrganizational units, SCPs
IdentityIAM Identity Center, Roles per account
NetworkTransit Gateway, Shared VPCs, Central egress
SecurityOrganisation CloudTrail, Security Hub, Log archive account

Interfaces

FromToVia
AccountsTransit GatewayAttachment
AccountsLogsOrganisation CloudTrail
TeamsAccountsRoles through single sign-on

Data flow

  1. An account is created from a template.
  2. SCP limits apply immediately.
  3. Logs go to a separate account.
  4. Traffic goes through central points.
  5. Costs are allocated per account.

Security boundaries

  • SCPs forbid disabling logging.
  • No long-lived keys for people.
  • KMS encryption by default.

Where a person approves

  • SCP exceptions.
  • New production accounts.

Delivery phases

  1. 01 · Design

    OU structure, network, identity.

  2. 02 · Foundation

    Organisation, logging and security as code.

  3. 03 · Migration

    Workloads from the shared account.

  4. 04 · Operation

    Permission and cost reviews.

Limitations

  • Not a certified architecture.
  • Migrating from one account takes time.

Trade-offs

  • Many accounts — isolation vs complexity.
  • Central egress — control vs cost.

Related services

Related assessments

Integration patterns used

Workshops and assessments

← All scenarios

Facing something similar?

We start with an assessment of where you are and propose a realistic first phase.

Book a consultation