All landing zone configuration lives in src/config/ in your starter repo. These are the only files you need to edit to customize the landing zone for your organization; the reusable implementation stays in the versioned packages.
The two account IDs in landing-zone-settings.ts set the deployment boundary: the management account owns the organization, and a dedicated landing zone account deploys the StackSets as the CloudFormation StackSets delegated administrator.
Important: After changing landing-zone-settings.ts, always re-run pnpm exec projen to regenerate the npm scripts and GitHub Actions workflow with the updated account IDs and Region.
Configuration files
src/config/index.ts re-exports these files for the CDK app. Each page below covers one file or setting.
| File | Page | What it controls |
|---|---|---|
landing-zone-settings.ts | Landing Zone Settings | Organization name, mail domain, account IDs, primary and secondary Regions, external admins, account quota, and audit log removal policy and retention |
organization-structure.ts | Organization Structure | OUs, accounts, SCP attachments, and monthly budgets for your AWS Organization |
service-control-policies/ | Service Control Policies | Shipped guardrails and how to author custom SCPs |
alternate-contacts.ts | Alternate Contacts | Security, billing, and operations contacts applied to every account |
delegated-admins.ts | Delegated Administrators | Which accounts administer StackSets, CloudTrail, and the security and FinOps services on behalf of the org |
trusted-access.ts | Trusted Access | Which AWS services get trusted access to your organization |
security-services.ts | Security Services | Enable or disable CSPM, GuardDuty, Inspector, and Macie and choose their feature options |
service-quotas.ts | Service Quotas | Quota increase requests for workload accounts, including Regional and global scope |
organizationPolicyTypes in src/main.ts | Organization Policy Types | Which policy families (SCPs, backup, tag, GuardDuty, and more) are enabled at the organization root, and how to change them |
tags.ts | Described below | The tag keys the landing zone applies |
Tag keys
tags.ts holds the three tag keys the landing zone applies. It has no page of its own because you rarely edit it:
| Key | What it marks |
|---|---|
cdk-landing-zone:managed (value true) | Every stack, StackSet, and resource the landing zone owns. The protect-tagged-stacks SCP protects the stacks and StackSets that carry it, and the daily drift detection checks them |
cdk-landing-zone:stack | The stack that owns a resource, including resources StackSets roll out to member accounts |
cdk-landing-zone:automation | The landing zone's own automation and the roles it runs as, which keep running in suspended accounts |
Changing a key retags every landing zone resource on the next deployment.