Constructs

The account baseline is built from single-purpose CDK constructs that ship in @towardsthecloud/cdk-landing-zone-constructs. Each one does a single job (delete the default VPC, configure GuardDuty for the organization, request a quota increase) and exposes a small, typed props interface.

You do not instantiate these constructs yourself. The StackSets compose them into the templates they roll out across your accounts, and the Organization stack uses a few directly in the management account. The props are preset for you as part of the landing zone wiring. This page is the reference for what each construct does, which props it exposes, and which StackSet ships it, so you know exactly what lands in your accounts.

At a glance

SecureDefaultsConstruct

Applies the per-account hardening baseline in one unit: deletes the default VPC, turns on EBS encryption by default, blocks S3 public access at the account level, enforces a strong IAM password policy, tightens Systems Manager service settings, and strips every inbound and outbound rule from the default security group of any newly created VPC. You interact with the hardening controls through this construct; the five constructs that follow are the pieces it composes.

Props

globalSettingsRegion is the region where account-global settings (S3 Block Public Access and the password policy) are applied once. The region-local controls run in every targeted region. This prevents duplicate account-wide calls when the StackSet rolls out to multiple regions.

Shipped by: SecureDefaultsStackSet (member accounts) and ProvisionManagementStackSet (management account).

DeleteDefaultVPCConstruct

Removes the default VPC in every region of an account, so workloads have to run in an explicitly created VPC instead of the wide-open default.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

EnableEbsEncryptionConstruct

Turns on EBS encryption by default for the whole account, so every new EBS volume is encrypted at rest without workload teams having to opt in.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

S3BlockPublicAccessConstruct

Enables all four account-level S3 Block Public Access settings, so no bucket or object in the account can be made public regardless of its own configuration.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

SetAccountPasswordPolicyConstruct

Enforces a strong IAM user password policy: minimum 18 characters, 90-day maximum age, no reuse of the last 24 passwords, and required uppercase, lowercase, number, and symbol complexity.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

ConfigureSsmServiceSettingsConstruct

Hardens account-level AWS Systems Manager settings: blocks public sharing of SSM documents and routes SSM Automation execution logs to CloudWatch.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

SecurityHubV2Construct

Configures the unified Security Hub V2 management layer from the security account, giving you one place to govern Security Hub CSPM, GuardDuty, Inspector, and Macie across every account and region. Each service ships wired but disabled by default; you turn one on by flipping its options block (cspmOptions, guardDutyOptions, inspectorOptions, or macieOptions) and redeploying.

Props

Shipped by: SecurityHubV2StackSet (security account). Composes SecurityHubCspmConstruct, GuardDutyConstruct, InspectorConstruct, and MacieConstruct.

SecurityHubCspmConstruct

Configures Security Hub CSPM central configuration from the security account: cross-region finding aggregation, the AWS Config organization aggregator, and the organization policies that decide which standards are enabled and which controls are suppressed.

Props

The behavior is driven by cspmOptions (SecurityHubCspmOptions):

Use the SecurityHubV2Standard static constants (for example SecurityHubV2Standard.AWS_FOUNDATIONAL_SECURITY_BEST_PRACTICES) or raw standard ARNs for enabledStandardIdentifiers.

Shipped by: via SecurityHubV2Construct.

GuardDutyConstruct

Configures GuardDuty across the organization from the security account, with per-protection-plan control and automatic association of member accounts.

Props

The behavior is driven by guardDutyOptions (GuardDutyOptions):

Each GuardDutyMemberAccount has a required accountId and email, resolved from your organization structure.

Shipped by: via SecurityHubV2Construct.

InspectorConstruct

Configures organization-wide Amazon Inspector scanning from the security account for EC2 instances, ECR container images, Lambda functions, and code repositories.

Props

The behavior is driven by inspectorOptions (InspectorOptions):

Shipped by: via SecurityHubV2Construct.

MacieConstruct

Configures Amazon Macie across the organization from the security account for sensitive-data discovery and S3 bucket classification, with optional automated discovery and in-place suspend or resume to control billing.

Props

The behavior is driven by macieOptions (MacieOptions):

Each MacieMemberAccount has a required accountId and email, resolved from your organization structure.

Shipped by: via SecurityHubV2Construct.

CloudTrailConstruct

Creates a multi-region CloudTrail trail that delivers to a central S3 bucket and adds a set of CloudWatch alarms aligned with the CIS AWS Foundations Benchmark. The alarms cover root account usage, unauthorized API calls, sign-in without MFA, IAM and policy changes, CloudTrail configuration changes, console authentication failures, KMS key disable or delete, S3 bucket policy changes, AWS Config changes, and network changes (security groups, NACLs, gateways, route tables, and VPCs).

Props

Shipped by: CloudTrailStackSet (member accounts) and ProvisionManagementStackSet (management account, primary region).

EncryptedSNSTopicConstruct

A KMS-encrypted SNS topic with resource policies scoped to your organization or account, with optional email subscriptions. It is the notification backbone for the landing zone's security alerts and budget notifications.

Props

subscribers accepts an optional emails string array.

Shipped by: CentralAlertsStackSet (security account) and CostControlStackSet (member accounts).

BudgetConstruct

Creates an AWS Budget that notifies an SNS topic when actual or forecasted spend crosses 100 percent of the configured limit, with optional tag filtering for per-team or per-project cost attribution.

Props

Shipped by: CostControlStackSet.

CostAnomalyConstruct

Sets up Cost Explorer anomaly detection across all AWS services and notifies an SNS topic as soon as an anomaly reaches full impact, so unexpected spend spikes surface early.

Props

Shipped by: CostControlStackSet.

CdkToolkitConstruct

Provisions the standard CDK bootstrap resources (asset S3 bucket, container image repository, and deploy roles) in a StackSet-compatible form, so every target account is CDK-deployable without anyone running cdk bootstrap by hand.

Props

Shipped by: CdkBootstrapStackSet (Development and Production OUs).

CdkToolkitCleanerConstruct

Periodically removes unused assets (S3 objects and container images) from the CDK bootstrap bucket and repository, so bootstrap storage does not grow without bound.

Props

Shipped by: CdkBootstrapStackSet (Development and Production OUs).

IncreaseServiceQuotaConstruct

Requests a Service Quotas increase for a specific quota during deployment, so workload accounts raise their limits without manual console steps. The request is idempotent: it does nothing if a request is already pending or the quota is already met.

Props

Shipped by: ServiceQuotasStackSet (Development and Production OUs).

DetectStackSetDriftConstruct

Runs a daily drift-detection scan across all StackSets in the management account, so manual changes to StackSet-managed resources surface promptly instead of going unnoticed.

No configurable props.

Shipped by: ProvisionManagementStackSet.

CloseAccountConstruct

Closes an account automatically when you move it into the Suspended OU, so decommissioning an account does not need a manual console action.

Props

Shipped by: ProvisionManagementStackSet.

SetAlternateContactConstruct

Reconciles the security, billing, and operations alternate contacts on every active account in the organization on each deploy, so contact details stay current as accounts come and go.

Props

Each AlternateContact has a required name, title, emailAddress, and phoneNumber. You set these in alternate-contacts.ts.

Shipped by: OrganizationStack (management account).

UnsubscribeMarketingMailsConstruct

Opts every account's root email out of AWS marketing mail, and re-runs as new accounts are added so they are unsubscribed in the same deploy.

Props

Shipped by: OrganizationStack (management account).

Related pages

• StackSets: how these constructs are composed into the templates that roll out across your accounts
• Stacks: the three deployment phases and what each stack owns