AWS Managed Services (AMS) offers two network architectures:
Multi-account landing zone (MALZ): provides common services - such as access, end point security, networking - from shared accounts for workloads that are deployed in separate member accounts.
Single-account landing zone (SALZ): provides self contained accounts where common services such as access, end point security, networking are deployed in the same account as the workload. It is recommended for workloads that require a high level of isolation as it incurs higher AWS costs.
