Landing Zone Accelerator on AWS (LZA) Universal Configuration

The LZA Universal Configuration provides enterprise-ready configuration templates that utilize the Landing Zone Accelerator on AWS (LZA) to establish secure, scalable, and well-architected multi-account AWS environments. It enables rapid deployment of baseline environments supporting multiple global compliance frameworks and industry-specific requirements.

Getting Started

To get started with this project, please refer to the comprehensive documentation in the docs/ directory. The documentation is organized in a logical sequence to guide you through understanding, deploying, and operating your LZA environment:

1. Overview - Architecture overview and design principles
2. Getting Started - Deployment prerequisites and initial setup procedures
3. Management & Governance - Organization structure and account management
4. Security, Identity & Compliance - Security controls and compliance frameworks
5. Networking - Network architecture patterns and connectivity
6. Logging & Monitoring - Centralized logging and monitoring setup
7. Operations - Day-to-day operational procedures and management tasks

We recommend reviewing the documentation in order, starting with the Overview and Getting Started sections.

Specific Regional and Industry Guidelines

For detailed information about supported regions and industry-specific configurations, including compliance frameworks, regulatory requirements, and implementation guidance, please refer to:

Support for Regions and Industries

This comprehensive guide covers:

• Regional compliance requirements
• Industry-specific security controls and frameworks
• Regulatory compliance mappings

What's Included

The LZA Universal Configuration provides ready-to-deploy configuration files and implementation guidance for LZA Universal Configuration baseline:

Configuration Modules

Pre-configured LZA Universal Configuration files organized by the following deployment patterns:

• Base configurations - Security, Governance, and Organization settings
• Network configurations - Hub-and-spoke, and Shared VPC networking patterns

Documentation

Architecture guides, deployment procedures, and detailed design principles that explain the implementation rationale and configuration decisions, supported by architectural diagrams and technical documentation for secure multi-account AWS environments.

Cost

You are responsible for the cost of the AWS services used while running this solution. As of this revision, the cost for running the Universal Configuration in its current form through the Landing Zone Accelerator on AWS with AWS Control Tower in the US East (N. Virginia) Region within a non-critical sandbox environment with no activity or workloads is approximately $101.06 (USD) each month.

We recommend creating a budget through AWS Cost Explorer to help manage costs. Prices are subject to change. For full details, refer to the pricing webpage for each AWS service used in this solution.

Sample Cost Table

The following table provides a sample cost breakdown for deploying this solution with the default parameters in the US East (N. Virginia) Region, with no activity, for one month.

Note: The VPC calculation is done if you're utilizing a hub-and-spoke topology. Data transfer, AWS CodeArtifact, Amazon Detective, Amazon DynamoDB, AWS Lambda, AWS Service Catalog, Amazon Simple Notification Service (Amazon SNS), Amazon Simple Queue Service (Amazon SQS), AWS Step Functions, and AWS Systems Manager are priced at the Free Tier or less than $0.01 each month.

Scripts and CI/CD Integration

Automation utilities for configuration management and environment setup, including account configuration generation and deployment helpers. The .gitlab-ci.yml file demonstrates how to integrate these configurations with CI/CD options for automated multi-environment deployments.

IMPORTANT

LZA Universal Configuration will not, by themselves, make you compliant. They offer an opinionated, best-practice approach to establishing a well-architected AWS multi-account environment from which additional complementary solutions can be integrated. The information is not exhaustive - you must review, evaluate, and approve the solution according to your organization's security requirements. You are responsible for determining applicable regulatory requirements and ensuring compliance. While this solution addresses technical and administrative requirements, it does not help with non-technical administrative compliance requirements.

Security

See CONTRIBUTING for more information.

License

This project is licensed under the Apache-2.0 License.