Skip to main content

LZA Configuration

Last Updated: 2026-03-02 Source: https://github.com/co-cddo/ndx-try-aws-lza Captured SHA: 6d70ae3

Executive Summary​

The Landing Zone Accelerator (LZA) configuration defines the entire AWS organizational structure for NDX:Try, establishing a multi-account hierarchy with Control Tower integration, service control policies, security baselines, centralized logging, and backup policies. Built on LZA Universal Configuration v1.1.0 (LZA v1.14.1), it manages 7 core accounts across 5 organizational units while deliberately delegating Innovation Sandbox account lifecycle management to the ISB platform via ignore: true directives on all sandbox-related OUs.

Configuration Overview​

The repository consists of 7 primary YAML configuration files, 8 SCP JSON policies, 2 IAM policies, 2 SSM automation documents, and supporting policy files across 10 directories. All configuration values support variable substitution through replacements-config.yaml, enabling environment-specific deployments from a single template.

Resolved Variable Replacements​

The replacements-config.yaml file defines all parameterised values used across the configuration:

VariableValuePurpose
AcceleratorPrefixAWSAcceleratorResource naming prefix
HomeRegionus-west-2Primary region for LZA resources
EnabledRegionsus-west-2, us-east-1, eu-west-2Allowed AWS regions
BudgetsEmailndx-try-provider+gds-ndx-try-aws-budgets@dsit.gov.ukBudget alert recipient
SecurityHighndx-try-provider+gds-ndx-try-aws-security-high@dsit.gov.ukHigh-severity security alerts
SecurityMediumndx-try-provider+gds-ndx-try-aws-security-medium@dsit.gov.ukMedium-severity security alerts
SecurityLowndx-try-provider+gds-ndx-try-aws-security-low@dsit.gov.ukLow-severity security alerts
GlobalCidr10.0.0.0/8IPAM global pool
TransitGatewayASN64512BGP ASN for Transit Gateway

Organizational Structure​

All InnovationSandbox OUs are marked ignore: true because the ISB platform dynamically moves accounts between these OUs during the lease lifecycle. LZA creates the OU structure but does not manage accounts within it.

Account Definitions​

Mandatory Accounts (accounts-config.yaml)​

AccountEmailOUPurpose
Managementndx-try-provider+gds-ndx-try-aws@dsit.gov.ukRootAWS Organizations management
LogArchivendx-try-provider+gds-ndx-try-aws-log-archive@dsit.gov.ukSecurityCentralized log aggregation
Auditndx-try-provider+gds-ndx-try-aws-audit@dsit.gov.ukSecuritySecurity auditing and compliance

Workload Accounts​

AccountEmailOUPurpose
SharedServicesndx-try-provider+gds-ndx-try-aws-shared-services@dsit.gov.ukInfrastructureShared infrastructure, Identity Center delegation
Networkndx-try-provider+gds-ndx-try-aws-network@dsit.gov.ukInfrastructureNetwork hub
Perimeterndx-try-provider+gds-ndx-try-aws-perimeter@dsit.gov.ukInfrastructurePerimeter security
InnovationSandboxHubndx-try-provider+gds-ndx-try-aws-isb-hub@dsit.gov.ukWorkloads/ProdISB Core application host

Global Configuration (global-config.yaml)​

Core Settings​

SettingValuePurpose
homeRegionus-west-2 (via replacement)Primary region for all LZA resources
enabledRegionsus-west-2, us-east-1, eu-west-2Operational regions
managementAccountAccessRoleAWSControlTowerExecutionCross-account orchestration
cloudwatchLogRetentionInDays365Compliance log retention
terminationProtectiontruePrevent accidental stack deletion
useV2StackstrueLZA v2 networking stacks
centralizeBucketstrueCentralised CDK asset buckets

Control Tower Integration​

Control Tower v4.0 is enabled with organization-wide CloudTrail, IAM Identity Center access, and 365-day log retention for both general and access logging buckets. LZA defers CloudTrail management to Control Tower to avoid duplication (cloudtrail.enable: false).

Control Tower Controls​

11 detective and preventive controls are deployed to Security, Infrastructure, and all Workloads sub-OUs:

ControlIdentifierPurpose
CONFIG.CLOUDTRAIL.DT.51m3wi9y66gi199vwyqmu4lm4lS3 data events logging
CONFIG.LOGS.DT.1497wrm2xnk1wxlf4obrdo7mejCloudWatch log encryption
CONFIG.IAM.DT.63jw8po9x95lr2nob65iaqhqirIAM groups have users
CONFIG.IAM.DT.5bi738zni6ovf9d6dagobqtk6gNo inline policies
CONFIG.EC2.DT.171d908j9c0qtyr5vq7mora1ht2Internet gateway authorization
AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGWb8pjfqosgkgknznstduvel4rhNo unrestricted IGW routes
CONFIG.SAGEMAKER.DT.33b7ib9mi87kcw90atgx2nboaxSageMaker KMS encryption
CONFIG.SECURITYHUB.DT.11klk5z4sby5l0cfx65dmq2dskSecurity Hub enabled
BACKUP_PLAN_MIN_FREQUENCYdagreqi0i3fitenunuuo4q64tBackup frequency check
BACKUP_RECOVERY_POINT_MANUAL_DELETEd1wltz1jx8c4aok5062g4kzz3Recovery point delete protection
CONFIG.EC2.DT.10aqh482zxh1libhd8e5pff5r1wEC2 backup plan coverage

Central Root User Management​

Root credentials management and root sessions are centrally managed:

centralRootUserManagement:
  enable: true
  capabilities:
    rootCredentialsManagement: true
    allowRootSessions: true

Budget Configuration​

A $2,000/month organizational budget is configured on the Management account with notification thresholds at 50%, 75%, 80%, 90%, and 100% of actual spend, sending alerts to the budgets email address.

Logging Architecture​

Logs are centralized in the LogArchive account with the following lifecycle:

Bucket TypeRetentionGlacier IR TransitionPurpose
Access Log1000 daysAfter 365 daysS3 access logs
Central Log1000 daysAfter 365 daysAggregated logs
ELB Log1000 daysAfter 365 daysLoad balancer access logs

Session Manager logs are sent to CloudWatch Logs with the EC2-Default-SSM-Role attached for SSM connectivity. CloudWatch Logs use dynamic partitioning configured via dynamic-partitioning/log-filters.json.

Cost and Usage Reports​

Monthly CUR reports are generated in Parquet format with refresh of closed reports enabled, stored under the cur S3 prefix with a 365-day lifecycle.

Service Control Policies​

SCP Architecture​

SCP Details​

Core-Guardrails-1 (Infrastructure, Security, Workloads OUs): Protects LZA-managed AWS Config rules, Lambda functions, SNS topics, CloudWatch Log groups, Kinesis/Firehose streams, and EventBridge rules from modification by non-LZA roles.

Core-Guardrails-2 (Infrastructure, Security, Workloads OUs): Protects LZA IAM roles from modification, prevents CloudFormation stack deletion, protects SSM parameters and S3 buckets, denies root user access, and blocks modifications to GuardDuty, Security Hub, Macie, IAM Access Analyzer, EBS encryption defaults, VPC defaults, RAM sharing, and public S3 access blocks.

Security-Guardrails-1 (Audit, LogArchive accounts): Denies creation of internet gateways and VPCs, and enforces encryption for EFS and RDS.

Infrastructure-Guardrails-1 (Network, Perimeter, SharedServices accounts): Comprehensive networking protection denying unauthorized VPC, subnet, Transit Gateway, NAT gateway, route, and IPAM modifications. Protects Network Firewall resources. Enforces EFS and RDS encryption. Protects Route53 VPC associations and endpoint DNS records.

Workloads-Guardrails-1 (Dev, Test, Prod OUs): Protects Accelerator-tagged EC2 resources, denies networking modifications for Accelerator-tagged resources, enforces EFS and RDS encryption.

Sandbox-Guardrails-1 (Workloads/Sandbox OU): Protects Accelerator-tagged EC2 resources and denies networking modifications for tagged resources. Enforces EFS and RDS encryption.

Suspended-Guardrails: Denies all actions for LZA provisioning roles (AWSControlTowerExecution, AWSAccelerator*, cdk-accel*), effectively blocking LZA from managing suspended accounts.

Quarantine-New-Object: Denies all actions for non-LZA roles, preventing any user activity in newly created accounts until LZA provisioning completes.

Exempt Role Patterns​

All SCPs exempt the following role ARN patterns from restrictions:

  • arn:aws:iam::*:role/AWSAccelerator*
  • arn:aws:iam::*:role/AWSControlTowerExecution
  • arn:aws:iam::*:role/cdk-accel*

Resource Control Policies​

A Resource Control Policy (Core-Rcp-Guardrails) is deployed to Infrastructure, Security, and Workloads OUs implementing a data perimeter:

  • S3 data perimeter: Denies external write operations to S3 from principals outside the organization
  • Confused deputy protection: Denies AWS service-to-service calls when the source organization does not match
  • Secure transport enforcement: Denies unencrypted (non-TLS) access to S3, SQS, KMS, Secrets Manager, and STS
  • KMS key protection: Prevents modification of Accelerator-tagged KMS keys by non-LZA roles
  • Control Tower log protection: Protects the Control Tower log bucket from unauthorized access

Declarative Policies​

A VPC Block Public Access declarative policy (lza-core-vpc-block-public-access.json) is deployed to Security, Workloads/Dev, Workloads/Test, Workloads/Prod OUs and the Network and SharedServices accounts. It enforces block_bidirectional mode on internet gateway access with exclusions allowed for legitimate use cases.

Security Configuration (security-config.yaml)​

Central Security Services​

ServiceConfigurationDelegated Admin
MacieEnabled, 15-min policy finding frequency, publish policy findingsAudit
GuardDutyEnabled with S3 and EKS protection, S3 export every 6 hoursAudit
Security HubEnabled with region aggregationAudit
IAM Access AnalyzerEnabledAudit
EBS Default EncryptionEnabled-
S3 Public Access BlockEnabled-
SCP Revert ChangesEnabled-

Security Hub Standards​

StandardEnabledDeployment
AWS Foundational Security Best Practices v1.0.0YesRoot OU
NIST SP 800-53 Rev. 5YesRoot OU
CIS AWS Foundations Benchmark v3.0.0YesRoot OU
CIS AWS Foundations Benchmark v1.2.0No-

AWS Config Rules​

26 Config rules are deployed organization-wide with 2 automated remediations:

Automated Remediations:

  1. EC2 Instance Profile Attachment: Automatically attaches the EC2-Default-SSM-Role instance profile to EC2 instances that lack one, using the Attach-IAM-Instance-Profile SSM document
  2. ELB Logging Enablement: Automatically enables access logging on Elastic Load Balancers using the SSM-ELB-Enable-Logging SSM document

IAM Password Policy​

Minimum 14 characters, uppercase, lowercase, symbols, numbers required. 90-day maximum age, 24-password reuse prevention.

IAM Configuration (iam-config.yaml)​

Identity Center​

IAM Identity Center is enabled with SharedServices as the delegated admin account.

Policy Sets​

Two IAM policies are deployed to all accounts (excluding Management):

  • End-User-Policy: Sample end-user permission boundary (iam-policies/sample-end-user-policy.json)
  • Default-SSM-S3-Policy: SSM agent S3 access for instance management (iam-policies/ssm-s3-policy.json)

Role Sets​

Two roles are deployed to all accounts (excluding Management):

  • Backup-Role: Assumed by backup.amazonaws.com with AWS managed backup/restore policies
  • EC2-Default-SSM-Role: Instance profile for EC2 with SSM, CloudWatch Agent, and the SSM S3 policy. Bounded by the End-User-Policy

Network Configuration (network-config.yaml)​

The network configuration is currently minimal:

  • Default VPCs are not deleted (delete: false)
  • No Transit Gateways configured
  • No VPCs defined
  • No endpoint policies applied

IPAM Address Plan (from replacements)​

A comprehensive RFC 1918 IPAM plan is defined in the replacements configuration using the 10.0.0.0/8 global pool:

PoolCIDRAvailable IPs
Global10.0.0.0/816,777,216
Regional (Home)10.0.0.0/121,048,576
Ingress VPC10.0.0.0/204,096
Egress VPC10.0.16.0/24256
Inspection VPC10.0.17.0/24256
Endpoints VPC10.0.20.0/221,024
SharedServices VPC10.0.24.0/212,048
Sandbox VPCs10.2.0.0/15131,072
Dev Workloads10.4.0.0/14262,144
Test Workloads10.8.0.0/14262,144
Prod Workloads10.12.0.0/14262,144

These IPAM allocations are defined but not yet deployed via network-config.yaml VPC definitions.

Backup and Tagging Policies​

Backup Policy​

A primary backup plan (primary-backup-plan.json) is deployed to Infrastructure and Workloads OUs via the AWSAccelerator-BackupVault. Backup vaults are created in Infrastructure, Dev, Test, and Prod OUs. The plan supports continuous, hourly, daily, weekly, and monthly schedules with VSS enabled for Windows, 1-year standard retention, 35-day continuous retention, and 2-year monthly retention.

Tagging Policies​

Two tagging policies enforce backup tag compliance:

  • OrgTagPolicy: Enforces backup plan tag values across Infrastructure and Workloads OUs
  • S3TagPolicy: S3-specific tagging for continuous backup support (S3 + RDS only)

Repository Directory Structure​

PathContentsPurpose
global-config.yamlCore LZA settingsControl Tower, logging, budgets, backup
organization-config.yamlOU structure, SCPs, policiesOrganization hierarchy and guardrails
accounts-config.yamlAccount definitions3 mandatory + 4 workload accounts
iam-config.yamlIdentity Center, policies, rolesIAM configuration
network-config.yamlVPC/TGW configurationCurrently minimal
security-config.yamlSecurity services, Config rulesComprehensive security baseline
replacements-config.yamlVariable substitutionsEnvironment-specific values
service-control-policies/8 SCP JSON filesGuardrail policies
iam-policies/2 IAM policy JSON filesEnd-user and SSM policies
ssm-documents/2 SSM automation YAML filesRemediation automations
rcp-policies/1 RCP JSON fileResource control policies
declarative-policies/1 declarative policy JSONVPC public access blocking
backup-policies/1 backup plan JSONOrganization backup policy
tagging-policies/2 tagging policy JSON filesTag compliance enforcement
event-bus-policies/1 EventBridge policy JSONDefault event bus policy
dynamic-partitioning/1 log filter JSON fileCloudWatch log partitioning
ssm-remediation-roles/2 remediation role JSON filesConfig rule remediation
vpc-endpoint-policies/1 default policy JSONVPC endpoint access control

Integration with Innovation Sandbox​

The LZA configuration establishes the InnovationSandbox OU hierarchy but marks all 8 sub-OUs with ignore: true. This is a deliberate design choice:

  1. LZA creates the OU structure during initial deployment
  2. LZA does not manage or monitor accounts within ignored OUs
  3. The ISB platform uses AWS Organizations API to move accounts between Active, Available, CleanUp, Entry, Exit, Frozen, and Quarantine OUs during the lease lifecycle
  4. The InnovationSandboxHub account in Workloads/Prod is not ignored and receives full LZA governance

The quarantineNewAccounts feature is enabled with the AWSAccelerator-Quarantine-New-Object SCP, which is applied to newly created accounts until LZA provisioning completes.

SCP revert changes (scpRevertChangesConfig.enable: true) is enabled in security-config.yaml. This can conflict with Terraform-managed SCPs from the ndx-try-aws-scp repository -- the PROPOSAL.md in that repo documents the need to disable this for Terraform-managed SCPs to persist.

Version History​

DateChangeVersion
2025-11-17Added InnovationSandbox OUs to organization-config.yamlv1.0.0
2025-12-15Restructured directory for GitHub configuration sourcev1.0.0
2025-12-19Upgraded from LZA Universal Config v1.0.0 to v1.1.0v1.1.0

Source Files Referenced​

File PathPurpose
repos/ndx-try-aws-lza/global-config.yamlGlobal LZA settings
repos/ndx-try-aws-lza/organization-config.yamlOU structure, SCPs, tagging, backup policies
repos/ndx-try-aws-lza/accounts-config.yamlAccount definitions
repos/ndx-try-aws-lza/network-config.yamlVPC and networking (minimal)
repos/ndx-try-aws-lza/security-config.yamlSecurity baselines and Config rules
repos/ndx-try-aws-lza/iam-config.yamlIAM policies and roles
repos/ndx-try-aws-lza/replacements-config.yamlVariable replacements
repos/ndx-try-aws-lza/service-control-policies/*.json8 SCP policy files
repos/ndx-try-aws-lza/iam-policies/*.json2 IAM policy files
repos/ndx-try-aws-lza/ssm-documents/*.yaml2 SSM automation documents
repos/ndx-try-aws-lza/rcp-policies/lza-core-rcp-guardrails-1.jsonResource control policy
repos/ndx-try-aws-lza/declarative-policies/lza-core-vpc-block-public-access.jsonVPC public access policy
repos/ndx-try-aws-lza/README.mdRepository documentation and changelog

Generated from source analysis. See 00-repo-inventory.md for full inventory.