AWS Secure Landing Zone with Control Tower and AFT

Name: AWS Secure Landing Zone with Control Tower and AFT
Rating: 4.5 (825 reviews)

AWS Secure Landing Zone with Control Tower Account Factory for Terraform (AFT). Updated for 2024.

Created byKostiantyn Skrypnyk

Last updated 1/2025

English

What you'll learn

The Landing Zone concept
Best practice solutions of Landing Zone implementation on AWS cloud
AWS ControlTower service installation and maintaining for multi-account AWS structure
Account Factory for Terraform (AFT) for IaC and automation of Landing Zone
AWS security services implementation and usage across all accounts inside the Landing Zone
Troubleshoot multi-account AWS architecture

Course content

8 sections • 36 lectures • 4h 23m total length

Introduction0:59
Introduction video, with the introduction of the author and review of course topics
Requirements1:51
The video with requirements for this course

Organizations structure11:23
Review of AWS organization structure and methods of security
Master account8:04
The review of the role of the Master account in Landing Zone architecture and discovery of properties.
Security and control9:02
Accounts concept (Network account)15:29
The review of the role of the Network account in Landing Zone architecture and discovery of properties.
Accounts concept (Shared services account)6:32
The review of the role of the Shared Services account in Landing Zone architecture and discovery of properties.
Accounts concept (Security account)7:21
The review of the role of the Security account in Landing Zone architecture and discovery of properties.
Accounts concept (Log archive account)3:55
The review of the role of the Log Archive account in Landing Zone architecture and discovery of properties.
Accounts concept (Workload accounts)7:31
The review of the role of the Workload accounts in Landing Zone architecture and discovery of properties.
Implementation ways9:18
Discovery of different ways of installation and usage of Landing Zones on AWS cloud.

Service review8:41
Theory lecture with a detailed review of AWS Control Tower services
Prerequisites5:35
Lecture with requirements that need to have before practical implementation of AWS Control Tower.
Setting up p.1 [Control Tower]16:06
Practical setting up video of Landing Zone using AWS Control Tower service (p.1)
Setting up p.2 and Organization logging solution [Control Tower/CloudTrail]12:53
Practical setting up video of Landing Zone using AWS Control Tower service (p.2) and review of the organizational trail.
OUs and accounts creation procedure [Service Catalog]8:55
Practical video with the creation of OU structure and accounts creation procedure on Control Tower Landing Zone.
Organization policies [SCP]10:56
Practical implementation of Service Control Policies to protect the Landing Zone.
Organizational Access Analyzer [IAM Access Analyzer]5:27
Practical implementation of IAM Access Analyzer on the Landing Zone.
Global security audit [SecurityHub]6:26
Practical implementation of AWS SecurityHub on the Landing Zone.
Organizational threat detection and audit customization [GuardDuty/SecurityHub]8:57
Practical implementation of AWS GuardDuty on the Landing Zone.
Vulnerability management in Landing Zone [Inspector]5:15
Practical implementation of AWS Inspector on the Landing Zone.

Service review6:28
Theory lecture with a detailed review of AWS Control Tower Account Factory for Terraform feature.
Prerequisites2:53
Lecture with requirements that need to have before practical implementation of AWS Control Tower Account Factory for Terraform.
Pre-setup of tools and repositories4:12
Is a pre-installation actions video of AWS Control Tower Account Factory for Terraform, with setting up all tools and services.
Setting up [AFT]11:42
Practical video of automation of Landing Zone using AWS Control Tower Account Factory for Terraform service.
AFT configuration [CodeStar / Service Catalog]3:32
The practical video covers AWS CodeStar connection setup and granting permissions on ServiceCatalog for AFT.
AFT components review and initial accounts pipeline invoke11:21
The lecture with a review of AFT AWS resources and initial invoke of account initialization.
Accounts creation using the AFT8:03
Practical video with the creation of accounts using the AWS Control Tower Account Factory for Terraform.
Initial customization scripts invoke6:25
The practical video with initial invokes of account customization scripts of AFT.
Implementation of Terraform on AFT account customizations5:35
Practical video with the Terraform scripts implementation using the AWS Control Tower Account Factory for Terraform.
Usage of custom scripts on AFT customizations4:45
Practical video with the custom script implementation using the AWS Control Tower Account Factory for Terraform.

Requirements

Foundational knowledge of AWS
AWS account (to follow practical steps)
Windows / Linux / Mac OS X machine

Description

Welcome!

This course covers the topic of "Landing Zones".

In today's dynamic cloud environment, the prominence of Landing Zones has grown significantly. This module explores why Landing Zones are increasingly favored in modern cloud setups and how they play a pivotal role in addressing challenges posed by large workloads.

Here we will discover the Landing Zones' best practices, implement them in practice on the AWS cloud, using the AWS Control Tower service, and even automate it, using the "Infrastructure as code" feature AWS Control Tower Account Factory for Terraform [AFT].

Workflow of the course :

Review of the problem of current Cloud setups
Landing Zone concept exploration
A detailed review of each type of the account in Landing Zone
Implementation of security practices on Master AWS account
Discovery of AWS ControlTower service
Implementation of the Landing Zone using the AWS Control Tower from the scratch
Configuring the organizational security using the AWS services
Discovery in details of AWS Control Tower Account Factory for Terraform
Automation of Landing Zone using the AFT

- - - - - - - -

List of used services/tools :

AWS Organizations
AWS ControlTower
AWS Service Catalog
AWS Config
AWS SNS
AWS Budgets
AWS KMS
AWS CloudTrail
AWS S3
AWS IAM Access Analyzer
AWS Security Hub
AWS GuardDuty
AWS Inspector
AWS CodePipeline
AWS Control Tower Account Factory for Terraform
Terraform CLI
AWS CLI
Git
GitHub

As a result of this course, you will receive a fully working and protected Landing Zone on the AWS cloud, which is also automated via AFT.

This course will allow you to put the structure of your account on scripts (using the Terraform) and prepare the high level of security of your multi-account infrastructure followed by AWS whitepaper best practices.

Who this course is for:

Cloud engineers interested in AWS best practices
AWS architects who are looking for the multi-account solution
Engineers/Architects who are planning the migration of workloads to AWS
Anyone interested on ControlTower and AFT service
People who are working with large environments

AWS Secure Landing Zone with Control Tower and AFT

What you'll learn

Explore related topics

Course content

Introduction2 lectures • 3min

Landing Zone concept2 lectures • 11min

AWS Landing Zone and best practices overview9 lectures • 1hr 19min

Master account1 lecture • 13min

Control Tower10 lectures • 1hr 29min

Control Tower Account Factory for Terraform (AFT)10 lectures • 1hr 5min

Summary1 lecture • 2min

Updates and releases1 lecture • 2min

Requirements

Description

Who this course is for: