Overview
The AWS CDK Landing Zone is a production-ready multi-account AWS environment delivered as a deployable CDK project. You get a fully wired AWS Organization with security guardrails, account baselines, and a CI/CD pipeline on day one, without building any of that plumbing yourself.
The foundation ships as two private packages through AWS CodeArtifact:
@towardsthecloud/cdk-landing-zone-foundation: organization management, delegated administration, GitHub OIDC, and StackSet prerequisites@towardsthecloud/cdk-landing-zone-constructs: 26 single-purpose account-baseline constructs (the organization trail, secure defaults, the security services, cost optimization, Resource Explorer, and more)
Your organization-specific configuration lives in the cdk-landing-zone-starter repo you own and manage. Improvements to the underlying solution reach you as package releases: bump two version numbers, run pnpm exec projen, and redeploy.
Choose CSPM, GuardDuty, Inspector, and Macie capabilities in security-services.ts; all four start enabled. The unified Security Hub V2 hub remains enabled. Configure workload quota increase requests in service-quotas.ts, and set optional monthly cost budgets in organization-structure.ts.
What it deploys
The landing zone rolls out through three stacks across two account phases. The organization phase deploys one stack to your management account; the landing-zone phase deploys the other two from a dedicated landing zone account that acts as the CloudFormation StackSets delegated administrator.
| Stack | Account | What it creates |
|---|---|---|
LandingZoneOrganizationStack | Management | AWS Organization, OUs, accounts, trusted access, policy types, SCPs, cost budgets, delegated administrators, GitHub OIDC, alternate contacts, account-closure automation, management-account drift detection, landing zone account bootstrap, organization stack output publishing |
LandingZoneFoundationStack | Landing zone | StackSet IAM roles, regional asset buckets, landing-zone-account drift detection, and the StackSets for the landing zone's own accounts: the organization trail, CIS alarms, and alert emails (observability account), management-account secure defaults, organization-wide security (security account), and FinOps |
LandingZoneMemberAccountsStack | Landing zone | Member-account baseline StackSets: per-account security hardening, Resource Explorer indexes, CDK bootstrap, and service quotas |
The accounts behind these stacks: a management account that owns the organization, a landing zone account that deploys the StackSets, a security account that runs the security services, an observability account that holds the organization trail and its logs and emails the organization's alerts, and a FinOps account for cost optimization. The landing zone rolls out 8 StackSets across them, in your primary Region plus any secondary Regions you configure, and attaches 5 service control policies. See Stacks for the full topology.
One thing worth calling out: the default AWS Organizations quota is 10 accounts, and new organizations can start lower. A real multi-account setup reaches that ceiling fast. The landing zone handles this for you through the optional organizationAccountLimit setting, which files the AWS Organizations quota increase automatically during deployment. AWS does not approve these requests instantly (AWS can take several days to approve it), so set it early if you already know you will need more accounts.
Why teams choose it
- Zero manual account setup: every new account that joins an OU automatically receives all baseline StackSets
- Version-controlled governance: organization structure, SCPs, and contacts are TypeScript you can code-review and roll back
- Secure CI/CD from day one: GitHub Actions with OIDC, no long-lived AWS keys stored anywhere
- Updates without rebuilding: bump the two pinned package versions and redeploy; the foundation improvements flow in
Documentation map
| Section | What you'll find |
|---|---|
| Install | Prerequisites, CodeArtifact whitelisting, first deployment (two phases), and CI/CD setup |
| Configuration | Every customer-editable file: settings, organization structure, SCPs, contacts, delegated administrators, trusted access, and policy types |
| Guides | Task-oriented walkthroughs: add an account, create an SCP, customize StackSets, validate before deploying, set up GitHub Actions, and update versions |
| Reference | Deep dives into the three deployment stacks, all 8 StackSets, and the 26 account-baseline constructs |
Ready to get started? Follow the Install guide.