Constructs

The account baseline is built from single-purpose CDK constructs that ship in @towardsthecloud/cdk-landing-zone-constructs. Each one does a single job (delete the default VPC, configure GuardDuty for the organization, request a quota increase) and exposes a small, typed props interface.

You do not instantiate these constructs yourself. The StackSets compose them into the templates they roll out across your accounts, and the Organization stack uses a few directly in the management account. The props are preset for you as part of the landing zone wiring. This page is the reference for what each construct does, which props it exposes, and which StackSet ships it, so you know exactly what lands in your accounts.

At a glance

SecureDefaultsConstruct

Applies the per-account hardening baseline in one unit: deletes the default VPC, turns on EBS encryption by default, blocks S3 public access at the account level, enforces a strong IAM password policy, tightens Systems Manager service settings, and strips every inbound and outbound rule from the default security group of any newly created VPC. You interact with the hardening controls through this construct; the five constructs that follow are the pieces it composes. It doesn't set EBS snapshot or AMI sharing: the declarative policy attached at the organization root does.

Props

globalSettingsRegion is the region where account-global settings (S3 Block Public Access and the password policy) are applied once. The region-local controls run in every targeted region.

Shipped by: AccountSecurityStackSet (member accounts) and ProvisionManagementStackSet (management account).

DeleteDefaultVPCConstruct

Removes the default VPC in every region of an account, so workloads have to run in an explicitly created VPC instead of the wide-open default.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

EnableEbsEncryptionConstruct

Turns on EBS encryption by default for the whole account, so every new EBS volume is encrypted at rest without workload teams having to opt in.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

S3BlockPublicAccessConstruct

Enables all four account-level S3 Block Public Access settings, so no bucket or object in the account can be made public regardless of its own configuration.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

SetAccountPasswordPolicyConstruct

Enforces a strong IAM user password policy: minimum 18 characters, 90-day maximum age, no reuse of the last 24 passwords, and required uppercase, lowercase, number, and symbol complexity.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

ConfigureSsmServiceSettingsConstruct

Hardens account-level AWS Systems Manager settings: blocks public sharing of SSM documents and routes SSM Automation execution logs to CloudWatch.

No configurable props.

Shipped by: via SecureDefaultsConstruct.

CentralizedRootAccessConstruct

Enables IAM centralized root access for the organization, so member accounts do not carry their own root credentials and privileged root actions run as short-lived sessions. It runs from the security account, which the organization phase registers as the IAM delegated administrator, once IAM trusted access is enabled, and it leaves centralized root access enabled if the stack is deleted, so member accounts keep centrally managed root rather than being handed back standalone root credentials. The setting is applied once from the configured primary region.

Props

primaryRegion is the region where the account-global setting is applied once, for the account.

Shipped by: OrganizationSecurityStackSet (security account).

IamAccessAnalyzerConstruct

Creates an organization-wide IAM Access Analyzer external access analyzer from the security account, which the organization phase registers as the Access Analyzer delegated administrator. The analyzer uses the organization as its zone of trust, so it reports resources (S3 buckets, IAM roles, KMS keys, and more) that are shared with principals outside the organization. It satisfies Security Hub control IAM.28 / CIS AWS Foundations Benchmark v3.0.0 1.20 for the account and region that own the analyzer. Analyzers are regional, so the StackSet deploys one per configured region.

Props

Shipped by: OrganizationSecurityStackSet (security account, all configured regions).

SecurityHubV2Construct

Configures the unified Security Hub V2 management layer from the security account, giving you one place to govern Security Hub CSPM, GuardDuty, Inspector, and Macie across every account and Region. The starter explicitly disables all four services in security-services.ts. Set the relevant enabled field to true and redeploy to enable a service. The delegated administrator's unified Security Hub V2 hub stays enabled when these four services are disabled. Accounts in the OU passed as suspendedOuId, which the starter sets to the close-account OU (accounts waiting to be closed), have Security Hub CSPM, GuardDuty, and Inspector turned off, and Macie stops managing them. The rest of the Suspended OU keeps the services.

Props

SecurityServicesConfiguration requires all four options objects, and each object requires an explicit enabled boolean. When using the construct directly, omitting an entire options object enables that service with its defaults. The tables below describe library defaults; the starter overrides each service's enabled value to false.

enabledRegions must contain at least one Region and at most 15, with the deployment home Region first and linked Regions after it. See Security Services before removing a Region or disabling a service.

Shipped by: OrganizationSecurityStackSet (security account). Composes SecurityHubCspmConstruct, GuardDutyConstruct, InspectorConstruct, and MacieConstruct.

SecurityHubCspmConstruct

Configures Security Hub CSPM central configuration from the security account: cross-Region finding aggregation, the AWS Config organization aggregator, and the organization policies that decide which standards are enabled and which controls are suppressed. Removing a linked Region cleans up managed member coverage there while retaining configuration in the remaining Regions. Before removal, centrally manage or disable any self-managed member hubs in that Region. See Security Services for the upgrade and Region-removal steps.

Props

secondaryRegions are the Regions linked by the finding aggregator. guardDutyOptions, inspectorOptions, and macieOptions only suppress the Security Hub controls that belong to a protection plan or service you turned off, so they do not raise false findings.

The behavior is driven by cspmOptions (SecurityHubCspmOptions):

The starter sets disabledControlIdentifiers to ['S3.20', 'S3.22', 'S3.23', 'EC2.172'] and ships three automationRules that suppress findings the landing zone's own resources can't meet. Edit these in src/config/security-services.ts to disable additional controls or suppress findings on your own resources.

Use the SecurityHubV2Standard static constants (for example SecurityHubV2Standard.AWS_FOUNDATIONAL_SECURITY_BEST_PRACTICES) or raw standard ARNs for enabledStandardIdentifiers.

Shipped by: via SecurityHubV2Construct.

GuardDutyConstruct

Manages GuardDuty for the organization with AWS Organizations GuardDuty policies, from the security account. One policy turns GuardDuty and the configured protection plans on in each enabled Region for every account, including the management account, the security account, and accounts that join or move into the organization later. A second policy keeps GuardDuty off in the OU passed as suspendedOuId, which the starter sets to the close-account OU; the rest of the Suspended OU keeps GuardDuty. GuardDuty in Regions outside enabledRegions stays as it is. A deployment waits until every covered account reports the desired state and fails naming the accounts that did not get there.

Setting enabled to false keeps the policies and turns GuardDuty off in every covered account and Region, which stops their GuardDuty charges. Removing a Region turns GuardDuty off there. Malware Protection for S3 is the exception: buckets a member account protects keep their protection, and its cost, until the account disables it for each bucket. You do not maintain an account list. See GuardDuty policies in the AWS Organizations documentation.

Props

The protection plans are set through guardDutyOptions (GuardDutyOptions):

Shipped by: via SecurityHubV2Construct.

InspectorConstruct

Configures organization-wide Amazon Inspector scanning from the security account for EC2 instances, ECR container images, Lambda functions, and code repositories, with an AWS Organizations Inspector policy on the organization root. A second policy keeps every scan type off in the OU passed as suspendedOuId, which the starter sets to the close-account OU, including for accounts that move in later, so accounts waiting for closure stop paying for scans. A deployment waits until the covered accounts match the policies. Disabling Inspector turns off scanning across the organization. Removing a Region turns off its scanning while retained Regions keep their configured scan types. See Inspector policies in the AWS Organizations documentation.

Props

The scan types are set through inspectorOptions (InspectorOptions):

Shipped by: via SecurityHubV2Construct.

MacieConstruct

Configures Amazon Macie across the organization from the security account for sensitive-data discovery and S3 bucket classification, with optional automated discovery. Setting enabled to false suspends Macie across the organization so it stops billing, and re-enabling it restores member coverage from your current AWS Organizations accounts. Existing member accounts are discovered from AWS Organizations at deploy time and associated automatically; the delegated administrator, management account, and accounts in the OU passed as suspendedOuId (the close-account OU in the starter) are excluded.

Props

The behavior is driven by macieOptions (MacieOptions):

Automated sensitive data discovery is billed separately by Macie. Set automatedSensitiveDataDiscovery to false to keep bucket monitoring on while turning it off. See Amazon Macie pricing.

Shipped by: via SecurityHubV2Construct.

OrganizationTrailConstruct

Creates the single organization-wide CloudTrail trail from the CloudTrail delegated administrator, the observability account, together with the storage it delivers to: an encrypted log bucket that only the trail can write to, a second bucket for that bucket's S3 server access logs (tagged cdk-landing-zone:access-logs=true, like every access-log bucket the landing zone creates), a rotating KMS key, and an Athena table for querying the logs. One trail captures management events (and optional data events) across every account in the organization, including the management account, and optionally raises the 14 CIS AWS Foundations Benchmark CloudWatch alarms for near-real-time security notifications. The alarms cover root account usage, unauthorized API calls, sign-in without MFA, IAM and policy changes, CloudTrail configuration changes, console authentication failures, KMS key disable or delete, S3 bucket policy changes, AWS Config changes, and network changes.

Data events and CloudTrail Insights are opt-in and off by default, and carry additional CloudTrail charges. The CloudWatch Logs copy that feeds the alarms is also opt-in; the landing zone turns it on.

Props

logRetention is how long the log bucket and its access-log bucket keep their objects, in whole days. primaryRegion limits the construct to one Region when it is deployed through a multi-Region StackSet. The ObservabilityStackSet enables enableCloudWatchLogs, so the landing zone ships with the CIS alarms wired to the security-alerts topic, and passes logRetention and removalPolicy from the auditLogRetention and auditLogRemovalPolicy landing zone settings.

With the default RETAIN, removing the construct keeps the trail, both buckets with their policies, and the key, so the trail keeps logging and the log files stay readable. The CloudWatch Logs delivery and the CIS alarms are removed. Adding the construct back creates new buckets and a new key next to the retained ones and adopts the trail; nothing deletes the retained ones. DESTROY empties and deletes the buckets and deletes the trail and the key, so use it only where the audit logs are disposable.

Shipped by: ObservabilityStackSet (observability account, primary Region).

EncryptedSNSTopicConstruct

A KMS-encrypted SNS topic with resource policies scoped to your organization or account, with optional email subscriptions. It is the notification backbone for the landing zone's security alerts: the Observability StackSet creates the security-alerts topic with it, and the CIS alarms notify that topic.

Props

subscribers accepts an optional emails string array. Each recipient must confirm the SNS subscription before delivery starts.

Shipped by: ObservabilityStackSet (observability account).

OrganizationNotificationsConstruct

Emails the organization's AWS service events to the people who act on them, through AWS User Notifications. Each configuration is one audience: a set of event rules and the email addresses that receive them. Every configuration covers the organization root, so events from accounts you create later are included, and matching events are grouped into one email per aggregation window.

It runs in the User Notifications delegated administrator, the observability account. AWS stores and processes the notifications in us-east-1, whichever Regions the rules cover. Each address becomes a User Notifications email contact, and AWS sends it nothing until someone activates it from the confirmation email AWS sends when the contact is created, including for an address you change later. A deployment finishes only once every event rule is active in each Region it covers.

Props

regions are the Regions whose events the rules receive, normally every active Region. Each OrganizationNotificationConfiguration has a name, a description, the emailAddresses that receive it, its eventRules, and an optional aggregationDuration (NotificationAggregationDuration.SHORT, 5 minutes, by default). Each OrganizationNotificationEventRule names an AWS service event source and eventType, with an optional EventBridge eventPattern and regions. A configuration holds one rule per source and event type, so combine alternatives for the same event type into one pattern with $or.

With the default RETAIN, removing the construct keeps the configurations and email contacts, still notifying, and adding it back adopts them, so the contacts stay activated. DESTROY deletes them, and a reinstall creates contacts that must be activated again.

Shipped by: ObservabilityStackSet (observability account, primary Region).

CostOptimizationEnrollmentConstruct

Opts the management account and every member account of the organization in to AWS Compute Optimizer and AWS Cost Optimization Hub, so the Hub can surface savings recommendations organization-wide. Only the management account can enroll member accounts, so this construct runs there. Compute Optimizer enhanced infrastructure metrics, which are billed separately, stay off; see Compute Optimizer pricing. Enrollment applies to the whole organization, so it runs once, in the primary Region.

Removing the construct keeps the accounts enrolled. The management account cannot opt member accounts out, so each account opts out on its own, which deletes its recommendations.

Props

primaryRegion is the Region where the organization-wide enrollment runs once.

Shipped by: ProvisionManagementStackSet (management account).

CostOptimizationHubPreferencesConstruct

Sets the Cost Optimization Hub organization preferences from the FinOps account: savings are estimated after discounts, and member accounts can see that discounted view, which they need to view cost efficiency. Commitment preferences stay unchanged, and every deployment restores both settings if someone changed them by hand. AWS doesn't let an organization that uses AWS Billing Transfer as a bill source turn on after-discounts savings estimates. While such a transfer is in effect, the construct estimates savings before discounts instead and leaves discount visibility unchanged. Preferences apply to the whole organization, so they are set once, in the primary Region. It expects the organization to be enrolled already, which CostOptimizationEnrollmentConstruct does.

Removing the construct keeps the preferences and the account's enrollment.

Props

primaryRegion is the Region where the organization-wide preferences are set once.

Shipped by: FinOpsStackSet (FinOps account).

ResourceExplorerConstruct

Turns on AWS Resource Explorer in an account: an index in each configured Region, with the aggregator index in one Region so a single view can search across Regions. Existing indexes are adopted, including ones created in the console, and views are never changed. In the FinOps account, an optional organization view searches every account in the organization and becomes that account's default view. If the aggregator index has to move from another Region, search across Regions can take up to a day to return. AWS requires a 24-hour wait before another index can be promoted. See UpdateIndexType.

Props

organizationView (ResourceExplorerOrganizationViewProps) takes the following fields. Set it only in the account that is the Resource Explorer delegated administrator, and deploy the construct with the same aggregatorRegion in every account so the view returns their resources.

With the default RETAIN, removing the construct, or a Region from regions, keeps the indexes, and adding it back adopts them again. DESTROY deletes only the indexes the construct created, which carry the cdk-landing-zone:resource-explorer-index tag. An adopted index and the views in its Region are kept. The organization view holds no data: removing the construct deletes it without restoring an earlier default view, and adding the construct back creates it again.

Shipped by: ResourceExplorerStackSet (member accounts except the FinOps account), FinOpsStackSet (FinOps account, with the organization view), and ProvisionManagementStackSet (management account).

CdkToolkitConstruct

Provisions the standard CDK bootstrap resources (asset S3 bucket, container image repository, and deploy roles) in a StackSet-compatible form, so every target account is CDK-deployable without anyone running cdk bootstrap by hand.

Props

Shipped by: CdkBootstrapStackSet (Development and Production OUs).

CdkToolkitCleanerConstruct

Periodically removes unused assets (S3 objects and container images) from the CDK bootstrap bucket and repository, so bootstrap storage does not grow without bound.

Props

Shipped by: CdkBootstrapStackSet (Development and Production OUs).

IncreaseServiceQuotaConstruct

Requests a Service Quotas increase for a specific quota during deployment, so accounts raise their limits without manual console steps. The request is idempotent: it does not re-request a value that is already requested or already met. A higher limit is not guaranteed to be active during the deploy that submits it, since AWS still has to approve the request.

Props

scope decides where the request applies. REGIONAL requests the increase in each region the construct is deployed to. GLOBAL is for account-wide quotas and is submitted once for the account.

Shipped by: ServiceQuotasStackSet (Lambda concurrency by default, with additional requests configured in service-quotas.ts) and ProvisionManagementStackSet (the global AWS Organizations maximum-accounts quota, when organizationAccountLimit is set).

SetAlternateContactConstruct

Reconciles the security, billing, and operations alternate contacts on every active account in the organization on each deploy, so contact details stay current as accounts come and go.

Props

Each AlternateContact has a required name, title, emailAddress, and phoneNumber. You set these in alternate-contacts.ts.

Shipped by: LandingZoneOrganizationStack (management account).

UnsubscribeMarketingMailsConstruct

Opts every account's root email out of AWS marketing mail, and re-runs as new accounts are added so they are unsubscribed in the same deploy.

No configurable props.

Shipped by: LandingZoneOrganizationStack (management account).

CloseAccountConstruct

Runs on a schedule (every 8 hours) and permanently closes any accounts in your close-account OU that are still active, retrying any that could not be closed on the previous run. It only exists when your organization structure includes a CloseAccountOU.

Props

closeAccountOuId is the ID of the OU whose active accounts get closed. The landing zone wires it from the CloseAccountOU in your organization structure.

Shipped by: LandingZoneOrganizationStack (management account).

DetectCloudFormationDriftConstruct

Runs a daily check that starts CloudFormation drift detection on the landing zone's own StackSets and stacks in the account where it is deployed, so configuration drift on landing-zone resources surfaces in CloudFormation instead of going unnoticed. It is deployed once per account that owns landing-zone CloudFormation resources: the management account (through the organization phase) and the landing zone account (through the foundation stack). It checks the StackSets and stacks that carry the tag you pass in; the starter passes the cdk-landing-zone:managed tag from src/config/tags.ts.

Props

DriftDetectionTag has a required key and value; only StackSets and stacks with that tag are checked.

Shipped by: LandingZoneOrganizationStack (management account) and LandingZoneFoundationStack (landing zone account).

Related pages

• StackSets: how these constructs are composed into the templates that roll out across your accounts
• Stacks: the deployment phases and what each stack owns