Complete reference for every component the landing zone deploys. Use this section to understand what a specific StackSet creates or how the deployment phases relate to each other.
Feature matrix
| Capability | Targets |
|---|---|
| AWS Organization, OUs, accounts | Management account |
| Trusted service access enablement | Management account (organization phase) |
| Organization policy type enablement (SCP, resource control, tag, backup, Inspector, Security Hub, GuardDuty) | Management account (organization phase) |
| Service Control Policies (5 shipped) | Root, OUs, accounts |
Monthly cost budgets (optional budget on the root, an OU, or an account) | Management account (organization phase) |
| Delegated admin registration (Config, IAM, IAM Access Analyzer, StackSets, CloudTrail, GuardDuty, Security Hub, Inspector, Macie, User Notifications, Compute Optimizer, Cost Optimization Hub, Resource Explorer) | Management account (organization phase) |
| GitHub Actions OIDC provider and deploy role | Management + landing zone accounts |
| Alternate contacts | All accounts |
| Marketing email unsubscribe | All accounts |
| Organization stack output publishing | Management account |
| Account closure automation | Management account (organization phase) |
| CloudFormation drift detection | Management + landing zone accounts |
| StackSet IAM roles | Landing zone account |
| Regional landing-zone asset buckets | Landing zone account, all active Regions |
Organization trail with CIS alarms and the security-alerts topic (ObservabilityStackSet) | Observability account, primary Region |
| Management-account secure defaults, Resource Explorer indexes, and optional account quota request (ProvisionManagementStackSet) | Management account, all active Regions |
| Compute Optimizer and Cost Optimization Hub enrollment (management account and every member account) | Management account, primary Region |
| IAM centralized root access (organization-wide) | Security account (all member accounts) |
| IAM Access Analyzer organization external access analyzer | Security account, all active Regions |
| Security Hub CSPM, GuardDuty, Inspector, and Macie configuration (OrganizationSecurityStackSet) | Security account, primary Region |
| Cost Optimization Hub organization preferences and Resource Explorer organization view (FinOpsStackSet) | FinOps account, primary Region |
| Resource Explorer indexes (ResourceExplorerStackSet) | All member accounts except FinOps, indexes in all active Regions |
| Secure defaults (delete default VPC, EBS encryption, default SG hardening, SSM service settings, password policy, S3 block public access) (AccountSecurityStackSet) | All member accounts, all active Regions |
| CDK bootstrap and asset cleaner (CdkBootstrapStackSet) | Development and Production OUs (excluding the landing zone account), all active Regions |
| Service quota increases (ServiceQuotasStackSet) | Development, Production, and Security OUs, all active Regions |
The active Regions are your primary Region plus any secondaryRegions in landing-zone-settings.ts.
Reference pages
| Page | What you'll find |
|---|---|
| Stacks | The three deployment stacks, the two account phases, the account and OU topology, and the organization output contract between them |
| StackSets | All 8 StackSets: purpose, resources created, composed constructs, and targets |
| Constructs | All 26 account-baseline constructs: intent, props, and which StackSet ships each |