All landing zone configuration lives in src/config/ in your starter repo. These are the only files you need to edit to customize the landing zone for your organization; the reusable implementation stays in the versioned packages.
The two account IDs in landing-zone-settings.ts set the deployment boundary: the management account owns the organization, and a dedicated landing zone account deploys the StackSets as the CloudFormation StackSets delegated administrator.
Important: After changing landing-zone-settings.ts, always re-run pnpm exec projen to regenerate the npm scripts and GitHub Actions workflow with the updated account ID and region.
Configuration files
| Page | What it controls |
|---|---|
| Landing Zone Settings | Organization name, mail domain, management account ID, deployment regions, and optional features |
| Organization Structure | OUs, accounts, and SCP attachments for your AWS Organization |
| Service Control Policies | Shipped guardrails and how to author custom SCPs |
| Alternate Contacts | Security, billing, and operations contacts applied to every account |
| Delegated Administrators | Which accounts administer Config, StackSets, and the security services on behalf of the org |
| Trusted Access | Which AWS services get trusted access to your organization |
| Organization Policy Types | Which policy families (SCPs, backup, tag, and more) are enabled at the organization root, and how to change them |