Reference Blueprint
Cloud Foundations & Landing Zones
Amazon Web Services

AWS Multi-Account Security & Network Landing Zone

An enterprise AWS organization pattern separating management, security, log archive, network, shared services, and workload accounts with centralized controls and inspected network paths.

Vendor reference blueprint — analysed and tailored during discovery
AWS reference diagram for a multi-account security and network landing zone
Reference diagram © Amazon Web Services. View official source. Presented for capability discussion and tailored to client requirements during discovery.

Blueprint Context

Scaling AWS safely requires deliberate account and organizational-unit boundaries, centralized identity and audit services, governed workload onboarding, shared networking, inspection, logging, and delegated security administration rather than accumulating production workloads in a single account.

What This Demonstrates

A scalable AWS landing-zone model that reduces blast radius, strengthens separation of duties, and gives platform and security teams a governed path for onboarding accounts and workloads.

Blueprint Tailoring Approach

  1. 1Define an AWS Organizations and organizational-unit model that separates management, security, infrastructure, shared services, and workload responsibilities.
  2. 2Centralize audit and security operations through dedicated Log Archive and Security Tooling accounts with organization-wide trails and delegated administration.
  3. 3Use a dedicated Network account for inbound, outbound, and inspection VPCs, centralized routing, DNS, firewall services, and shared network controls.
  4. 4Tailor preventive and detective guardrails, account provisioning, logging, incident response, and workload onboarding to the organization’s risk and operating model.

Role & Scope

Landing-zone assessment, multi-account design, and security-control tailoring

Technology Stack

AWS Organizations
AWS Control Tower
AWS IAM Identity Center
AWS Transit Gateway
AWS Network Firewall
AWS Security Hub
Amazon GuardDuty
AWS CloudTrail
AWS Config
Amazon S3
AWS Systems Manager