What you get
Landing Zone Accelerator on AWS is an AWS solution that deploys security and governance controls across every account in your AWS Organization. We tailor it to you and hand it over ready to run.
- Organisational units for security, shared infrastructure and workloads, with dedicated audit, log archive and shared services accounts
- Your existing AWS accounts moved into the new structure, so they inherit the same controls
- Service control policies that limit regions and instance types, block IAM users and stop anyone switching off security services
- AWS Security Hub with Amazon GuardDuty and Amazon Inspector across the organisation
- An organisation-wide AWS CloudTrail and AWS Config rules, with logs kept in a central, encrypted archive
- Sign-in through AWS IAM Identity Center, with permission sets for each role
What an engagement looks like
Every engagement follows the same five phases, delivered remotely by AWS-certified architects with a project manager. A typical build takes six to eight weeks from the start date.
1. Discovery and design
A workshop with your infrastructure and security teams. We agree the account structure, identity and controls, then write a Statement of Work with a high-level design, the deliverables and what we need from you.
2. Start-up
You complete a short list of prerequisites. We set up an AWS Budget alert so spend is watched from day one, and give you a trial of CirrusHQ Acuity for the length of the project.
3. Build
We deploy AWS Control Tower and Landing Zone Accelerator into your management account, with a pipeline that applies changes from your own Git repository. Then we enrol your existing accounts.
4. Documentation and handover
A design document covering the architecture and how to deploy changes, and a remote knowledge transfer session of up to three hours with your team.
5. Acceptance
We check every deliverable with you against the Statement of Work and close the project. A weekly 30-minute call keeps everyone up to date throughout.
Two ways to start
Proof of concept
A baseline landing zone built in one to two weeks, followed by four weeks in which your team uses it with our support. It is designed to become the foundation for production. AWS may fund the professional services for eligible customers.
Production build
The full landing zone in your existing AWS Organization, with your accounts moved across and the controls your sector needs. This is where most universities, councils and charities start.
Often added to the build
Central networking
- AWS Transit Gateway and IP address management through Landing Zone Accelerator
- An inspection VPC with AWS Network Firewall
- Site-to-site VPN to your campus or data centre
Backup and recovery
- A dedicated backup account and Amazon S3 storage for your existing backup software
- Monitoring of access to backup data
- Immutable copies to protect against ransomware
After go-live
An AWS Well-Architected Review of the new environment, and the option to have us run it through Managed Cloud.
What we need from you
People
- A named point of contact who can make decisions
- Time from your infrastructure and security leads for the design workshop
Access and accounts
- Access to your AWS management account
- Two email addresses, one for security and one for operational notifications
- A Git repository to hold the landing zone configuration
Your rules
- Any security policies, standards or compliance requirements the design has to meet
- Basic AWS knowledge in the team that will own it. AWS Skill Builder has free courses we recommend
Why CirrusHQ
Validated by AWS
We hold AWS Service Delivery designations for AWS Control Tower and AWS CloudFormation.
Used across sectors
Universities, colleges, charities, hospitals and councils run on landing zones we have built. See our industries
Funding
We are an AWS Migration Acceleration Program (MAP) partner and can help you access MAP funding where your project qualifies.
Questions
How is this different from AWS Control Tower on its own?
AWS Control Tower sets up the accounts and baseline guardrails. Landing Zone Accelerator on AWS builds on it with security services, logging and compliance controls, all managed as code. See AWS Control Tower.
We already have AWS accounts. Can we still use it?
Yes. We deploy into your existing AWS Organization and move your accounts into the new structure. If something in an existing account would block the build, we agree how to deal with it before going further.
How long does it take?
A production build usually takes six to eight weeks from the start date, and starts five to ten working days after the Statement of Work is signed. A proof of concept is built in one to two weeks, then runs for four weeks while your team uses it.
Who owns the code?
You do. The configuration lives in your repository, and the configurations and documents we create for you become yours.
Is networking included?
Central networking is usually scoped separately because it depends on your existing network. We often deliver both together.
