AWS Landing Zone Bootstrap

The Right Foundation for Multi-Account AWS

Every serious AWS environment eventually needs proper account separation. This StackSet gives you the structure AWS recommends — without spending days reading Control Tower documentation or hiring a consultant to set it up.

What's Included

• Logging account with centralized CloudTrail and Config aggregation
• Security account with GuardDuty delegated admin and Security Hub master
• Baseline Service Control Policies applied at the root and OU level
• Account vending structure: OUs for Production, Staging, Sandbox, and Suspended
• Cross-account IAM roles for read-only audit access

Service Control Policies Deployed

Includes deny-non-approved-regions, require-MFA-for-root, deny-public-S3, and deny-unencrypted-storage out of the box.

Deployment Order

1. Deploy management-account.yaml in root account
2. Run stackset-deploy.sh to push baselines to all accounts
3. Attach SCPs via scp-attach.yaml

Included Files

• management-account.yaml — root account setup
• stacksets/logging-account.yaml — centralized logging baseline
• stacksets/security-account.yaml — security tooling baseline
• scps/ — all SCP JSON documents
• stackset-deploy.sh — automated deployment script
• README.md — architecture overview and rollout sequence