AWS Landing Zone is designed to help businesses build and govern secure, scalable, multi-account AWS environments. AWS Control Tower is AWS’s managed service for setting up and governing a landing zone, helping organizations standardize account provisioning, identity, security, networking, logging, and governance.
AWS Landing Zone Overview
A landing zone is a well-designed, multi-account, scalable, and secure AWS infrastructure. This is a starting point for your organization to swiftly build and deploy workloads and apps while remaining confident in your security and infrastructure environment.
Creating a landing zone requires technical and commercial decisions in account structure, networking, security, and access control that are in line with your organization’s long-term growth and business objectives.
AWS Control Tower helps automate the setup and governance of a multi-account AWS environment by configuring core accounts, organizational units, controls, identity, logging, and other foundational resources.
How AWS Landing Zone Works
Running an operation with many accounts caused problems for most medium and large businesses, so Amazon developed AWS, which aimed to speed up the process while also providing a secure and functioning environment.
However, before you can use the landing page option, you must first construct a reliable base environment with AWS. The traditional method of creating multiple accounts takes a lot of time because it involves all procedures, such as security, logging, and service configuration. In other words, AWS will automatically ensure that each account fulfills the baseline requirements.
Once the accounts are set up, the Landing Zone solution provides clients with an easy way to create and manage numerous account setups in compliance with industry best practices. In other words, it organizes all baseline AWS setups and creates a basic multi-account structure.
The solution then manages each account equally, saving you a significant amount of time and money. Not only that, but you may scale your business much faster without having to register additional accounts.
Learn AWS Concepts and Build Scalable Cloud Solutions
AWS Certification Course
AWS Landing Zone Benefits
The Landing Zone system offers a few important advantages that enable customers to easily manage several accounts. Here’s a brief breakdown of all the advantages you can expect:
- AWS Control Tower Account Factory helps provision new AWS accounts using standardized configurations. AVM IAM Identity Center provides centralized access to AWS accounts and applications, allowing you to grant rights and impose limitations to enforce policies and compliance.
- Landing Zones provide visibility into resource consumption across the enterprise, making it simple to assure baseline security and monitor and control IT budgets.
- Landing Zone is ideal for enterprises with diverse IT roles since it allows you to regulate resource access and restrict actions for various activities such as security, development, network and database administration, DevOps, and so on.
- Landing Zone codifies AWS best practices like CloudTrail and VPC, as well as DevOps principles like infrastructure-as-code via CloudFormation templates and continuous delivery via CodePipeline.
AWS Landing Zone Architecture
AWS Landing Zone solutions typically contain four accounts: AWS Organization, which deploys the landing zone and handles configuration and access; shared services account, which hosts directory services; logging account, which is typically stored in S3; and security account, which is used for audit and compliance purposes.
AWS Organization Account
AWS Landing Zone is set up in an AWS Organizations account.
This account is used to handle the configuration and access to AWS Landing Zone managed accounts.
The AWS Organizations account allows you to create and manage member accounts financially.
It includes the Amazon Simple Storage Service (Amazon S3) bucket and pipeline settings, account configuration StackSets, AWS Organizations Service Control Policies (SCPs), and AWS IAM Identity Center configuration.
Get 100% Hike!
Master Most in Demand Skills Now!
Shared Services Account
A Shared Services account can host centralized services that are used across multiple AWS accounts, such as directory services, DNS, networking, shared tools, and other shared infrastructure.
Organizations can use AWS IAM Identity Center to provide centralized access to AWS accounts and applications. The specific services and configuration of a Shared Services account depend on the organization’s architecture and requirements.
Check out the AWS SSO blog to understand the concept better.
Log Archive Account
The Log Archive account includes a central Amazon S3 bucket for keeping copies of all AWS CloudTrail and AWS Config log files in a log archive account.
Security Account
The Security account provides controlled cross-account access for security and compliance activities, including audit and administrative operations when required.
The goal of these positions is for a company’s security and compliance team to use them to audit or undertake emergency security operations in the event of an incident.
AWS Landing Zone Security Baseline
It contains a basic security baseline that may be used to build and deploy a customized account security baseline for your organization. The following settings are included by default in the initial security baseline:
AWS CloudTrail
Each account has one CloudTrail trail that is configured to transmit logs to a centrally managed Amazon Simple Storage Service (Amazon S3) bucket in the log archive account and to AWS CloudWatch Logs in the local account for local activities.
Cross-Account Access
Cross-account access allows the security account to configure audit and emergency security administration access to AWS Landing Zone accounts.
AWS Config
AWS Config is enabled, and account configuration log files are saved in the log archive account’s centrally controlled Amazon S3 bucket.
Amazon Virtual Private Cloud (VPC)
An Amazon VPC is used to set up an account’s initial network. This includes eliminating the default VPC in all regions, deploying the AVM-specified network type, and network peering with the Shared Services VPC when applicable.
AWS Config Rules
AWS Config rules evaluate configurations for compliance with security requirements, such as encryption settings, IAM password policies, root-user MFA, Amazon S3 public access, and overly permissive security group rules.
AWS Landing Zone Notifications
Amazon CloudWatch alarms and events are set up to notify you when a root account login, console sign-in failure, or API authentication failure occurs within an account.
AWS Identity and Access Management
An IAM password policy is configured using AWS Identity and Access Management.
Amazon GuardDuty
Amazon GuardDuty is set up in the member account to allow you to monitor and handle GuardDuty findings.
AWS Landing Zone Setup
AWS Control Tower creates and governs a Landing Zone by configuring AWS Organizations, IAM Identity Center, organizational unit, accounts, controls, and other foundational resources.
Master Account
You can set up AWS Control Tower from the management account, which allows you to:
- A Security Organizational Unit (OU) for foundational security accounts, along with workload OUs that you can organize according to your environment and governance requirements.
- Controls help establish and enforce governance requirements across your AWS environment.
- You can provision new AWS accounts through AWS Service Catalog and assign these accounts to your preferred organizational units.
Shared Accounts
Examples of centralized accounts include the Log Archive account and Audit account. Additional shared-service accounts can be created based on your organization’s requirements.
Shared-service accounts can host centralized resources such as identity services, DNS, networking, security tools, and other services used across multiple AWS accounts.
A Cross Account IAM Role can be used to provide controlled access across AWS accounts.
Logging Account
The Log Archive account provides centralized storage for logs collected from multiple AWS accounts.
What sort of logs are we looking for, though? Depending on your configuration, centralized logging can include AWS CloudTrail, AWS Config, VPC, security, application, and other supported logs.
Centralized logging helps security and operations teams monitor activity, investigate incidents, and support compliance requirements.
Free Course to Launch Your AWS Career
Unlock AWS Expertise – No Cost Involved
Audit Account
The Audit account provides controlled access for security and compliance teams to perform auditing and other approved administrative activities. Reports, real-time notifications, and a cross-account role have all been configured for this account. You have to verify the permissions that users, groups, and applications have.
Functional Account
Your application’s requirements, architecture, and deployment model determine how many AWS accounts you need.
A large-scale software development project necessitates the use of various environments, each of which is distinct.
For application environments, you may use separate accounts for: Development, Quality Assurance or Testing, Pre-Production, and Production. By using the service catalog in the master account, you can easily scale by adding more AWS accounts.
- Dev: Developers can start deploying things in this environment, as well as experimenting, learning, and creating new things. Developers can test any new features or bugs here and deploy their work. They can start constructing and rolling out the code to more accounts once it has been deemed stable.
- Pre-Prod: This environment is used for final testing and validation before deployment to production. Quality Assurance (QA) may be performed in a separate testing environment or within the pre-production environment, depending on the organization’s setup.
- Prod: The production environment is the most restrictive. It’s the location where users can access the production applications. Access to the production account should follow least-privilege principles, with administrative access tightly controlled and privileged operations audited. We must check that the appropriate connectivity is present, that our logs are being sent to the correct logging account, and that they may be subject to stronger security regulations and policies.
- DevOps: Thanks to this account, the DevOps team can efficiently distribute apps across numerous AWS accounts (in this case, dev, pre-prod, and prod). Regardless of how your DevOps process is structured or the tools you employ, it is crucial for security reasons that these tools be isolated from other environments. Continuous delivery and integration are among the services hosted here.
Baseline Requirements
Building a set of requirements in each AWS account is the first step in building a landing zone based on these account-level demands.
You have the idea of accounts, and every account operates separately from the others. Therefore, the minimum requirements that you seek ought to include the following:
- For the root user, enable MFA and keep root-user access tightly restricted.
- Avoid unnecessary long-term credentials and prefer IAM roles or temporary credentials through AWS IAM Identity Center where appropriate.
- Do not create root-user access keys unless there is a specific AWS requirement that cannot be met otherwise
- Enable AWS CloudTrail to record account activity, including supported API events and other events relevant to security and auditing.
- Define role-based access according to business and operational requirements, following the principle of least privilege. Consider the roles required by the business.
Conclusion
The Landing Zone solution enables customers with large businesses to automate the setup and governance of AWS accounts and organizational units using controls that align with their requirements. You must choose how you will construct the Landing Zone based on your specific requirements and use case. Start your journey to becoming an AWS-certified professional with our interactive and industry-focused AWS DevOps Certification Course!
Frequently Asked Questions
Q1. What is the difference between AWS Landing Zone and AWS Control Tower?
An AWS landing zone is the setup of your AWS environment, including accounts, security, and governance rules. AWS Control Tower is an AWS service that helps you set up and manage this environment across multiple accounts.
Q2. Is AWS Control Tower free to use?
There is no separate charge for AWS Control Tower. However, you may still have costs for the AWS services used with your landing zone, such as AWS CloudTrail and other services you configure.
Q3. Can I use AWS Control Tower with existing AWS accounts?
Yes. You can enroll existing AWS accounts in AWS Control Tower, as long as they meet the required setup and configuration requirements.
Q4. Can AWS Control Tower manage multiple AWS accounts?
Yes. AWS Control Tower lets you manage multiple AWS accounts from a central environment. You can use controls and policies to apply consistent rules across accounts and organizational units (OUs).
Q5. When should a business use an AWS landing zone?
An AWS landing zone makes sense when a business has several AWS accounts and wants to manage security, access, and governance consistently. It is also useful when different teams or workloads need separate AWS accounts.