Wipro Landing Zone Accelerator

Step 3 — Choose Landing Zone Approach

Select the approach that fits your customer. The right choice depends on their existing AWS environment and requirements.

AWS Control Tower Recommended

Control Tower

AWS managed governance framework. Best for greenfield environments where compliance is critical.

Pre-built guardrails — 300+ controls
Automated account vending (AFT)
Built-in Log Archive + Audit accounts
Security Hub integration
CT dashboard for visibility
30–60 minute setup

Generates: Terraform (CT resource) + CloudFormation (3 stacks)

Custom Solution

Custom AWS Organizations

Build governance directly using AWS Organizations and SCPs. More flexible but more complex to maintain.

Full control over every setting
No Control Tower overhead
Works with existing Org setups
Custom OU structures allowed
More manual ongoing maintenance
Longer setup — more manual steps

Generates: Terraform (Org resources) + CloudFormation (custom stacks)

Not sure which to choose? Use Control Tower for greenfield + compliance. Use Custom if existing Organizations or non-standard configurations are needed.

Generating blueprint using AI... please wait 30–60 seconds.

Approved

Step 4 — Review Your Blueprint

Edit anything that needs to change. Click Check Changes to see the diff. Then click Approve Blueprint to proceed to variable input.

Editable Blueprint Click anywhere to edit

Original

Edited

Step 6 — Enter Your Variable Values

Fill in all required values. These are passed directly into the generated scripts — no placeholders in the final code.

Four accounts are mandatory for every landing zone: Management, Audit, Log Archive, Shared Services. Break Glass is strongly recommended.

Mandatory Account IDs

Management Account ID * 12-digit AWS account ID

Log Archive Account ID * 12-digit AWS account ID

Audit Account ID * 12-digit AWS account ID

Shared Services Account ID * 12-digit AWS account ID

Account Email Addresses

Log Archive Email * Unique — not used elsewhere

Audit Email * Unique — not used elsewhere

Shared Services Email * Unique — not used elsewhere

Break Glass Email (recommended) Emergency access — hardware MFA

Naming and Network

Company Prefix * Used in resource naming

VPC CIDR Range e.g. 10.0.0.0/8 (optional)

Log S3 Bucket Name Globally unique (optional)

0 of 8 required fields completed

Fill in all required fields above to unlock code generation.

Generating infrastructure code using AI... please wait 30–60 seconds.

Step 7 — Your Infrastructure Code

All values pre-filled. Download files or push directly to your repository.

Deployment Sequence

1

Deploy Control Tower Foundation

01-control-tower.yaml · 30–60 minutes

▶

What this achieves

Creates AWS Control Tower landing zone
Creates Security OU and Sandbox OU automatically
Creates Infrastructure, Workloads, Production, Non-Production, Suspended OUs
Provisions Log Archive and Audit accounts
Creates KMS encryption key
Applies mandatory SCPs to root

Command to run

aws cloudformation deploy --template-file 01-control-tower.yaml --stack-name wipro-lza-control-tower --capabilities CAPABILITY_NAMED_IAM

Before running — verify

No existing AWS Organizations
Root MFA enabled
All 4 account emails are unique and ready
IAM has controltower:*, organizations:* permissions

How to verify complete

CloudFormation → Stacks → wipro-lza-control-tower → Status must show:

CREATE_COMPLETE

Or run:

aws cloudformation describe-stacks --stack-name wipro-lza-control-tower --query "Stacks[0].StackStatus"

Only proceed to Step 2 when status shows CREATE_COMPLETE

↓

2

Enable Security Services

02-security-services.yaml · 5–10 minutes

▶

What this achieves

Enables GuardDuty threat detection across all accounts
Activates Security Hub — aggregates all findings
Enables Macie for PHI/PII detection in S3
Starts Config recorder — tracks all resource changes
Enables CIS Benchmark and AWS Foundational Security standards

Command to run

aws cloudformation deploy --template-file 02-security-services.yaml --stack-name wipro-lza-security --capabilities CAPABILITY_NAMED_IAM

Before running — verify

Step 1 shows CREATE_COMPLETE
CT dashboard shows green status
Log Archive and Audit accounts are active in Organizations

How to verify complete

CloudFormation → wipro-lza-security → Status must show:

CREATE_COMPLETE

Also check: GuardDuty → Detector active. Security Hub → Hub enabled.

Only proceed to Step 3 when status shows CREATE_COMPLETE

↓

3

Set Up Logging and Monitoring

03-logging.yaml · 5–10 minutes

▶

What this achieves

Creates org-level CloudTrail — logs every API call across all accounts
Creates S3 log bucket with encryption and retention policy
Creates CloudWatch log group for real-time streaming
Creates SNS security alert topic
Sets up alarms — root login, unauthorised API, no MFA

Command to run

aws cloudformation deploy --template-file 03-logging.yaml --stack-name wipro-lza-logging --capabilities CAPABILITY_NAMED_IAM

Before running — verify

Step 2 shows CREATE_COMPLETE
Config recorder running
S3 bucket name is globally unique

How to verify complete

CloudFormation → wipro-lza-logging → Status must show:

CREATE_COMPLETE

Also check: CloudTrail → org trail active. S3 → log bucket has objects.

All 3 stacks complete — proceed to post-deploy steps

↓

4

Post-deploy Manual Steps

Manual — engineer does these · 15 minutes

▶

Complete these manually

Enable Region deny control — CT Console → Settings → Region deny control → Edit → Enable. Cannot be done via CF or API.
Verify SSO — IAM Identity Center → Settings → Confirm IdP connected.
Break Glass account — Attach hardware MFA token. Test emergency access works.
Confirm GuardDuty — Generate sample findings. Verify they appear in Security Hub.
Confirm CloudTrail — Log into Log Archive account. Verify logs in S3 bucket.

Landing zone complete when

CT dashboard shows all green
All 3 stacks CREATE_COMPLETE
GuardDuty active in all accounts
CloudTrail logs in S3
Security Hub showing findings
Break Glass MFA configured

1

Initialise Terraform

terraform init · 2–3 minutes

▶

What this achieves

Downloads AWS provider >= 5.36.0
Downloads all required modules
Sets up backend for Terraform state
Validates provider config

Command to run

terraform init

Before running — verify

Terraform >= 1.5.0 installed
AWS CLI configured
All 4 files in same folder: main.tf, variables.tf, outputs.tf, README.md

How to verify complete

Terminal should show:

Terraform has been successfully initialized

Only proceed when init completes successfully

↓

2

Review the Plan

terraform plan · 2–5 minutes

▶

What this achieves

Shows exactly what Terraform will create — no changes yet
Lists every AWS resource to be provisioned
Catches errors before deployment
Shows resource count

Command to run

terraform plan -out=tfplan

What to check in plan output

No errors or warnings
Regions match your selection
Account IDs are correct
Plan shows adds only — no unexpected destroys
4 mandatory accounts visible

Only proceed if plan shows no errors

↓

3

Apply — Deploy Landing Zone

terraform apply · 30–60 minutes

▶

What this achieves

Creates Control Tower landing zone
Creates all OUs including Suspended OU
Enables CT guardrails per OU
Enables GuardDuty and Security Hub org-wide
Creates org-level CloudTrail
Creates KMS key and S3 log bucket

Command to run

terraform apply tfplan

Before running — verify

terraform plan showed no errors
All resources in plan reviewed
No existing CT or Organizations in account

How to verify complete

Terminal should show:

Apply complete! X resources added

Also run:

terraform output

Only proceed when apply completes with no errors

↓

4

Post-deploy Manual Steps

Manual — engineer does these · 15 minutes

▶

Complete these manually

Enable Region deny control — CT Console → Settings → Region deny control → Enable. Cannot be done via Terraform or API.
Verify SSO — IAM Identity Center → Confirm IdP connected.
Break Glass account — Attach hardware MFA. Test emergency access.
Run terraform plan again — should show no changes.
Confirm CloudTrail — Verify logs in Log Archive S3 bucket.

Landing zone complete when

terraform plan — no changes
CT dashboard all green
GuardDuty active
CloudTrail logs in S3
Break Glass MFA configured

Script does this automatically

Set from your answers

Push to Repository

Push generated files to your repo

CI/CD Platform

Personal Access Token

Repository (org/repo-name)

Branch

Commit Message

Monitor Repository

Commits and workflow runs

Recent Commits

Push code first

Workflow Runs

No runs yet

Landing Zone Accelerator

Deployment Journey

Step 1 — Pre-flight Checklist

Step 2 — Customer Qualifier

Q10 Service Control Policies (SCPs)

Step 3 — Choose Landing Zone Approach

Control Tower

Custom AWS Organizations

Step 4 — Review Your Blueprint

Step 6 — Enter Your Variable Values

Step 7 — Your Infrastructure Code

Deployment Sequence

Push to Repository

Monitor Repository