LandingZone

Source: src/AWS/ControlTower/LandingZone.ts

An AWS Control Tower landing zone — the org-wide multi-account environment (organization structure, governed regions, centralized logging, and access management) that Control Tower governs.

A landing zone is a singleton per AWS Organization and can only be managed from the Organizations management account. Creating, updating, and decommissioning a landing zone are asynchronous operations that can take an hour or more.

Creating a Landing Zone

import * as ControlTower from "alchemy/AWS/ControlTower";

const landingZone = yield* ControlTower.LandingZone("LandingZone", {
  version: "3.3",
  manifest: {
    governedRegions: ["us-east-1", "us-west-2"],
    organizationStructure: {
      security: { name: "Security" },
      sandbox: { name: "Sandbox" },
    },
    centralizedLogging: {
      accountId: "111122223333",
      configurations: {
        loggingBucket: { retentionDays: 365 },
        accessLoggingBucket: { retentionDays: 365 },
      },
      enabled: true,
    },
    securityRoles: { accountId: "444455556666" },
    accessManagement: { enabled: true },
  },
});

Upgrading

const landingZone = yield* ControlTower.LandingZone("LandingZone", {
  version: "3.3", // bump to upgrade in place
  manifest,
});