Architecture overview
The AWS Baseline is one AWS Organization with 14 accounts in two organizational units (OUs), a single Transit Gateway that connects every network to a hub, nine security services administered from one security account, and a pipeline that plans every change on a pull request and applies it on merge. Everything is OpenTofu and Terragrunt code, reviewed and applied by CI.
The accounts
Each account has one job. The management account (core-root) owns the Organization, the service control policies (SCPs), billing and the Terraform state, and hands every security service to core-security. It sits outside both OUs, so SCPs do not apply to it; keep workloads out of it.
| Account group | Accounts | What they hold |
|---|---|---|
| Management | core-root | Organization, OUs, SCPs, tag policy, state bucket, organization CloudTrail |
| Security and evidence | core-security, core-audit | Delegated security administration and the monitoring sink; the protected log archive and the AWS Config aggregator |
| Identity | core-identity | IAM Identity Center permission sets and group assignments |
| Network and DNS | core-network, core-dns | Hub VPC, Transit Gateway, IPAM, Client VPN, private zone; public Route 53 zones |
| Delivery | core-artifacts, core-auto | Container registries and shared storage; GitHub OIDC federation, deployer roles, optional runners |
| Reserved | core-corp, core-public | Internal tools; intentionally public assets. Baselined and ready |
| Workloads | plat-sandbox, plat-dev, plat-staging, plat-prod | One account per stage, identical in shape |
Every account gets the same account baseline: default EBS encryption, an account-wide S3 public-access block (off only in core-public), AWS Config recording, and the deployer role CI assumes. The landing zones concept explains why single-purpose accounts are the unit of isolation.
The network
Each workload account has a spoke VPC across three Availability Zones (AZs): private subnets for workloads and public subnets only for internet-facing load balancers. Spokes have no NAT of their own. Private traffic goes through the Transit Gateway to the hub VPC in core-network, which runs one NAT Gateway per AZ.
Spokes are grouped into isolation domains with one Transit Gateway route table each: prod and nonprod (sandbox, dev, staging) by default. The production and non-production tables never learn each other's routes, and each blackholes the other's address ranges, so production and non-production cannot reach each other; every spoke reaches the hub and the CI runner VPC. Every address comes from one VPC map, delivered through IPAM, and CI rejects any change that types an IP range anywhere else.
Two network options are built and off by default, each a single switch with its price stated beside it: AWS Network Firewall egress inspection in the hub, and Transit Gateway peering to a second region. Remote engineers reach private resources through one Client VPN endpoint federated with IAM Identity Center, off until its certificate and SAML applications exist. Read hub-and-spoke networking for the pattern.
The nine security services
| Service | Default | Role |
|---|---|---|
| AWS CloudTrail | On | One organization trail, multi-region, delivered to the audit account |
| AWS Config | On | Recording in every account; organization aggregator; SOC 2 baseline conformance pack on, 28 more available |
| Amazon GuardDuty | On | Threat detection, delegated to the security account |
| AWS Security Hub | On | Finding aggregation; CIS, FSBP, PCI DSS and tagging standards available, off until needed |
| IAM Access Analyzer | On | Organization external-access analyzer; unused-access analyzer in the security account |
| AWS Firewall Manager | On | A baseline AWS WAF policy on every load balancer in the workload accounts |
| Amazon Inspector | Off | Vulnerability scanning of EC2, ECR and Lambda |
| Amazon Macie | Off | Sensitive-data discovery in S3 |
| AWS Shield Advanced | Off | DDoS protection for listed resources, $3,000/month |
These sit behind three SCPs: no IAM users or access keys, protected S3 public-access blocks and MFA outside approved roles; approved regions only; CloudTrail and Config cannot be stopped. Responses are automatic where the fix is clear: EventBridge rules route high-severity findings to an SNS topic and block public S3 buckets outside core-public. Seven CIS CloudWatch alarms watch root use, unauthorized calls and changes to IAM, CloudTrail, S3 policies and the network. The defense in depth page explains how the layers fit.
Identity and delivery
People sign in through IAM Identity Center with group-based permission sets scoped by environment; production is read-only for everyone except Platform Leads and DevOps Leads. Pipelines hold no AWS keys: GitHub Actions authenticates through OpenID Connect (OIDC) into core-auto and assumes a deployer role in each target account.
State for every unit lives in one encrypted, versioned S3 bucket in the management account with native locking. Three workflows move changes: a plan on every pull request after static guardrails, an apply on merge in dependency order, and scheduled drift detection that opens an issue when an account no longer matches its code. See GitOps and drift.
Where the blueprints fit
The Web App, Data and ETL, and Secrets blueprints deploy into the workload accounts from their own repositories. They read VPC, subnet, Transit Gateway attachment and account identifiers from SSM Parameter Store, where the Baseline publishes them, and never read Baseline state. Start with the Web App Blueprint, the Data and ETL Blueprint or the Secrets Blueprint.