Document your AWS landing zone design
Created by Michael Daehnert (AWS), Florian Langer (AWS), and Michael Lodemann (AWS)
Environment: Production | Technologies: Management & governance; Infrastructure; Security, identity, compliance | AWS services: AWS Control Tower |
Summary
A landing zone is a well-architected, multi-account environment that's based on security and compliance best practices. It is the enterprise-wide container that holds all of your organizational units (OUs), AWS accounts, users, and other resources. A landing zone can scale to fit the needs of an enterprise of any size. AWS has two options for creating your landing zone: a service-based landing zone using AWS Control Tower or a customized landing zone that you build. Each option requires a different level of AWS knowledge.
AWS created AWS Control Tower to help you save time by automating the setup of a landing zone. AWS Control Tower is managed by AWS and uses best practices and guidelines to help you create your foundational environment. AWS Control Tower uses integrated services, such as AWS Service Catalog and AWS Organizations, to provision accounts in your landing zone and manage access to those accounts.
AWS landing zone projects vary in requirements, implementation details, and operational action items. There are customization aspects that need to be handled with every landing zone implementation. This includes (but is not limited to) how access management is handled, which technology stack is used, and what the monitoring requirements are for operational excellence. This pattern provides a template that helps you document your landing zone project. By using the template, you can document your project more quickly and help your development and operations teams understand your landing zone.
Prerequisites and limitations
Limitations
This pattern does not describe what a landing zone is or how to implement one. For more information about these topics, see the Related resources section.
Epics
| Task | Description | Skills required |
|---|---|---|
Identify key stakeholders. | Identify key service and team managers that are linked to your landing zone. | Project manager |
Customize the template. | Download the template in the Attachments section, and then update the template as follows:
| Project manager |
Complete the template. | In meetings with the stakeholders or by using a write-and-review process, complete the template as follows:
| Project manager |
Share the design document. | When your landing zone design documentation is complete, save it in a shared repository or central location where all stakeholders can access it. We recommend that you use standard document control processes to record and approve revisions to the design document. | Project manager |
Related resources
Customizations for AWS Control Tower
(AWS Solutions Library) Setting up a secure and scalable multi-account AWS environment (AWS Prescriptive Guidance)
Attachments
To access additional content that is associated with this document, unzip the following file: attachment.zip
