Architecture overview
The AWS Baseline is one AWS Organization with 14 accounts in two organizational units, one Transit Gateway that connects them, every security service delegated to a single security account, one identity plane for people and one for pipelines, and a pipeline that plans on every pull request and applies on merge. The three blueprints deploy into the workload accounts and read what the Baseline publishes.
The 14 accounts
The management account (root) lives under the core folder in the repository but sits outside both OUs in AWS Organizations, so service control policies (SCPs) do not apply to it. It owns the Organization, the SCPs, the tag policy, the Terraform state bucket and the organization CloudTrail, and delegates every security service away from itself.
| Account | Responsibility |
|---|---|
| root | The Organization, OUs and SCPs; the state backend; the organization CloudTrail; delegation of security services to the security account |
| security | Delegated administrator for GuardDuty, Security Hub, Inspector, Macie, IAM Access Analyzer and Firewall Manager; KMS keys for secrets; automated remediation; the CloudWatch observability sink |
| audit | Log archive: the encrypted, write-protected audit bucket and the AWS Config aggregator |
| identity | IAM Identity Center: permission sets and group assignments for every team role |
| network | IPAM, the hub VPC with centralized internet egress, the Transit Gateway, the private DNS zone and the Client VPN endpoint |
| dns | Public Route 53 hosted zones, one apex plus one subdomain zone per stage |
| artifacts | Container image registries with immutable tags and shared artifact storage |
| auto | CI/CD: GitHub OIDC federation, per-repository deployer roles, optional self-hosted runners |
| corp, public | Reserved for internal tools and public-facing services; baselined and ready. public is the one account where public S3 buckets are expected |
| sandbox, dev, staging, prod | Workload accounts, identical in shape, each with a spoke VPC attached to the Transit Gateway |
Every account receives the same account baseline: default EBS encryption, an account-wide S3 public-access block, AWS Config recording, and the acme-terraform-deployer role CI assumes. The landing zones page explains why single-purpose accounts are the unit of isolation.
Network: hub and spoke
Each workload account has a spoke VPC across three Availability Zones with private subnets for workloads and public subnets only for internet-facing load balancers. Spokes have no NAT of their own: private traffic leaves through the Transit Gateway to the hub VPC in the network account, which runs one NAT Gateway per AZ. Remote engineers reach private resources through a single Client VPN endpoint in the hub, federated with IAM Identity Center and off by default until its certificate and SAML applications exist.
Spokes are grouped into isolation domains, each with its own Transit Gateway route table: prod and nonprod (sandbox, dev, staging) by default. The domain tables never learn each other's routes, and every spoke reaches the hub and the CI runner VPC. Every address in the organization comes from one VPC map, delivered through IPAM; no IP range is typed anywhere else, and CI rejects any change that introduces one. Egress inspection with AWS Network Firewall and inter-region Transit Gateway peering are built and switched per region, off by default. Read hub-and-spoke networking.
Security services
Controls are layered so each catches what the previous one cannot:
| Layer | Mechanism |
|---|---|
| Preventive | Three SCPs on both OUs: no IAM users or access keys, S3 public-access block protected, MFA required for anything that is not an SSO session or an approved automation role, approved regions only, CloudTrail and Config cannot be stopped |
| Detective | GuardDuty, Security Hub, IAM Access Analyzer and AWS Config conformance packs, aggregated in the security account; Inspector, Macie, Security Hub standards and Shield Advanced are built and switched on when a deployment needs them |
| Responsive | EventBridge rules: high-severity GuardDuty findings to an SNS topic, public S3 exposure fixed automatically, the seven CIS CloudWatch alarms |
| Evidentiary | One organization CloudTrail with log file validation and VPC Flow Logs from every VPC, delivered to the audit account's protected bucket |
Which detective services run is decided in one file, environments/core/security/security.hcl, read by both the management account (which delegates each service) and the security account (which runs it). Each switch states its price. Read defense in depth.
Identity and access
People sign in through IAM Identity Center. Access is granted by membership of ACME_* groups to eleven role-based permission sets, scoped to the accounts each role needs; production is read-only for every role except Platform Leads and DevOps Leads. Pipelines never hold long-lived keys: GitHub Actions authenticates through OpenID Connect (OIDC) into the auto account and assumes a narrowly scoped deployer role in each target account. Secrets are encrypted with per-stage KMS keys and synchronized into each workload account's Parameter Store. Read least privilege.
Delivery pipeline
Terraform state for every account lives in one encrypted, versioned S3 bucket in the management account with native locking. Changes flow through three workflows: plan.yml runs the static guardrails and plans every unit on a pull request; apply.yml applies on merge to main, in dependency order, behind a GitHub Environment; drift-detection.yml plans every account on a schedule and opens an issue when reality no longer matches the code. Read GitOps and drift.
The blueprints on top
Each blueprint is its own set of repositories with its own deployer role in the auto account and its own state prefix in the shared bucket. It reads VPC, subnet, account and Transit Gateway attachment identifiers from SSM Parameter Store, published by the Baseline's ssm-publish unit, and never duplicates them. The blueprints page describes each one; the AWS Baseline overview opens the full Baseline documentation.