INFRASTRUCTURE AS CODE · LANDING ZONE

Terraform AWS Landing Zone

Reusable AWS foundation for governance, secure networking, centralized audit logging, encryption, threat detection, and workload guardrails — implemented as reviewable Terraform code.

TerraformAWS OrganizationsSCPsVPCCloudTrailKMSGuardDutySecurity HubS3IAM

View AWS Architecture ↓

PROJECT STATUSImplemented

TERRAFORMReusable IaC

DEFAULT MODESafe Account Baseline

ORG CHANGESOpt-in Only

ARCHITECTURE FLOW

Secure foundation before workloads

Governance → Network → Audit → Security → Workloads

GOVERNAWS Organizations

Optional workload OU and approved-Regions SCP guardrail.

SEGMENTVPC Foundation

Multi-AZ public/private subnet tiers and controlled routing.

AUDITCloudTrail + S3

Multi-region logging into private, versioned audit storage.

PROTECTKMS + Security

KMS encryption, GuardDuty, Security Hub, and EBS encryption.

HOSTWorkload Foundation

Controlled AWS environment ready for application deployments.

Terraform AWS Landing Zone data flow from engineer and GitHub through CI validation and Terraform plan into AWS landing zone controls

AWS architecture diagram for Terraform AWS Landing Zone showing AWS Organizations, Control Tower, service control policies, IAM Identity Center, security and audit accounts, shared networking, shared services, workload accounts, Amazon S3, DynamoDB, GuardDuty, Security Hub, AWS Config, CloudTrail, KMS, Systems Manager, CloudWatch, Terraform, and GitHub

Implemented controls

Multi-region CloudTrail with log-file validation and encrypted S3 retention.

Dedicated KMS keys for audit logs and default EBS workload encryption.

GuardDuty and Security Hub baseline security services.

Public/private subnet separation with an S3 Gateway VPC endpoint.

Optional AWS Organizations OU and region-restriction SCP.

GitHub Actions Terraform format and validation checks.

Project modules

NetworkVPC, subnets, routes, endpoint

AuditS3, KMS, CloudTrail

SecurityGuardDuty, Security Hub, EBS

GovernanceOrganizations, OU, SCP

Identity BaselinePassword policy / federation-ready

AutomationTerraform CI validation

View Project on GitHub ↗

AWS Organizations resources are intentionally disabled by default. Production deployment requires environment-specific account, CIDR, governance, and state-management decisions.

MICROSOFT AZURE REFERENCE ARCHITECTURE

Azure reference equivalent for portfolio comparison. The original project implementation remains as documented elsewhere on this page.