Rekhiv Soft Ltd

Architecture and landing zones

A multi-account AWS setup built with AWS Control Tower, so every new project starts with guardrails, networking, logging and single sign-on already in place.

Book an introductory call See the Landing Zone Quick Start
AWS landing zone in the London region An AWS Organization with its home Region in London. At the top, the management account runs AWS Control Tower, AWS Organizations, IAM Identity Center, Account Factory and consolidated billing, and holds no workloads. Below it are four organisational units. The Security OU holds the Log Archive account, which stores all CloudTrail logs in write-once storage, and the Audit account, which gives the security team access to Security Hub and GuardDuty. The Infrastructure OU holds a network account with Transit Gateway, shared VPCs and DNS, and a shared services account for build pipelines and central backups. The Workloads OU holds production and non-production accounts. The Sandbox OU holds one sandbox account per developer for short-lived experiments, with budget alerts and no route to production. Preventive, detective and proactive controls apply across the organisational units. AWS Organization: home Region eu-west-2 (London) Management account AWS Control Tower IAM Identity Center Consolidated billing AWS Organizations Account Factory No workloads run here Security OU Log Archive account All CloudTrail logs Write-once storage Audit account Security Hub, GuardDuty Security team access Infrastructure OU Network account Transit Gateway Shared VPCs and DNS Shared services Build pipelines Central backups Workloads OU Production account Live applications Strictest controls Non-production Staging and testing Mirrors production Sandbox OU Sandbox accounts One per developer Short-lived experiments Budget alerts No route to production Controls Preventive (SCPs) Detective (Config rules) Proactive (deploy checks)
An AWS landing zone in the London region

Every account sits in an organisational unit (OU) with its own controls. Logs from all accounts go to a write-once Log Archive account, the Audit account gives your security team one place to investigate, and people sign in once through IAM Identity Center.

What's included

A landing zone is the foundation every other AWS account sits on. Getting it right early saves rework when you add teams, products or auditors.

  • Account and organisational unit (OU) structure, with a naming plan
  • Service control policies and other preventive controls
  • Network design: VPCs, IP ranges, subnets and connectivity
  • Single sign-on through IAM Identity Center, with role-based access
  • An organisation-wide CloudTrail trail stored in the Log Archive account
  • Everything defined as code, so it can be rebuilt or extended

Typical tools

AWS Control Tower, AWS Organizations, IAM Identity Center, Terraform or CloudFormation

How it works

  1. Design

    A workshop to agree your OUs, accounts, naming, network ranges and who needs access to what.

  2. Build

    Control Tower set up in your management account, with single sign-on, baseline controls and logging defined as code.

  3. Enrol

    Existing accounts moved into the right OUs one at a time, with checks after each move.

  4. Handover

    A runbook for adding new accounts and a walkthrough with your team.

Start with the Landing Zone Quick Start

A governed multi-account AWS setup, built with Control Tower and ready for your first workloads.

Time
[2–3 weeks]
Price
[£ fixed price]
Ask about this package

Questions

More answers on the services page, or ask us directly.

Do we need AWS Control Tower?

Not always. Control Tower is the quickest route to a governed multi-account setup, but some teams prefer AWS Organizations managed directly with Terraform. We recommend one based on your size and the tools you already use.

Can you add a landing zone to accounts we already have?

Yes. Existing accounts can be enrolled into a new landing zone and moved into the right OU one at a time, so nothing has to stop.

Which OUs will we get?

A Security OU with Log Archive and Audit accounts as standard, plus the OUs your organisation needs. Infrastructure, Workloads and Sandbox OUs are a common starting point.

Talk through your architecture and landing zones needs

Tell us what you run today and what you want to change. We'll suggest where to start.

Book an introductory call