{"id":18930358,"url":"https://github.com/mitocgroup/terraform-aws-landing-zone","last_synced_at":"2025-04-03T02:11:29.444Z","repository":{"id":45725468,"uuid":"183020466","full_name":"MitocGroup/terraform-aws-landing-zone","owner":"MitocGroup","description":"Terraform Module for AWS Landing Zone","archived":false,"fork":false,"pushed_at":"2020-02-20T19:30:10.000Z","size":1394,"stargazers_count":177,"open_issues_count":12,"forks_count":113,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-03-24T08:29:10.667Z","etag":null,"topics":["amazon","amazon-web-services","aws-landing-zone","infrastructure","infrastructure-as-code","landing-zone","multi-account","terraform"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/MitocGroup/landing-zone/aws","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MitocGroup.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"docs/CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"docs/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-04-23T13:24:44.000Z","updated_at":"2024-11-06T09:17:44.000Z","dependencies_parsed_at":"2022-09-10T22:02:47.655Z","dependency_job_id":null,"html_url":"https://github.com/MitocGroup/terraform-aws-landing-zone","commit_stats":null,"previous_names":[],"tags_count":26,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MitocGroup%2Fterraform-aws-landing-zone","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MitocGroup%2Fterraform-aws-landing-zone/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MitocGroup%2Fterraform-aws-landing-zone/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MitocGroup%2Fterraform-aws-landing-zone/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MitocGroup","download_url":"https://codeload.github.com/MitocGroup/terraform-aws-landing-zone/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246922248,"owners_count":20855345,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amazon","amazon-web-services","aws-landing-zone","infrastructure","infrastructure-as-code","landing-zone","multi-account","terraform"],"created_at":"2024-11-08T11:37:20.491Z","updated_at":"2025-04-03T02:11:29.414Z","avatar_url":"https://github.com/MitocGroup.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform module `landing-zone`\n[AWS Landing Zone](https://aws.amazon.com/solutions/aws-landing-zone/) is\na solution that helps customers more quickly set up a secure, multi-account\nAWS environment based on AWS best practices. This repository contains\nterraform module `landing_zone` that dynamically deploys components of\nAWS Landing Zone solution based on input list of `.tfvars` files.\n\nRELATED: [terraform module `landing_zone_reader`](https://github.com/MitocGroup/terraform-aws-landing-zone-reader)\n\n\u003e NOTE: Current implementation is fully compatible with terraform v0.12+.\nSwitch to branch `terraform_v0.11` if you still using terraform v0.11.x and below.\n\nQuick Links: [How Does This Module Work](#how-does-this-module-work) | [What Components Are Available](#what-components-are-available) | [Why to Use This Solution](#why-to-use-this-solution)\n\n\n## How Does This Module Work\nTerraform module [landing_zone](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/modules/landing_zone)\nis based on [standard module structure](https://www.terraform.io/docs/modules/index.html#standard-module-structure)\nguidelines and contains the following folders:\n* root folder - module's standard terraform configuration\n* [components](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components) - yaml-based and terraform compatible configurations\n* [examples](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/examples) - different ways to combine components as part of this module\n* [modules](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/modules) - standalone, reusable and production-ready modules\n* [tests](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/tests) - set of automated tests to use in CI/CD pipelines\n\nThis terraform module requires the following prerequisites / dependencies:\n* [nodejs](https://www.nodejs.org) - referenced and validated [here](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/modules/landing_zone/main.tf#L11)\n* [terrahub](https://www.npmjs.com/package/terrahub) - referenced and validated [here](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/modules/landing_zone/scripts/config.js#L48)\n\nTo get started, simply include `main.tf` into your terraform codebase:\n```hcl\nmodule \"landing_zone\" {\n  source  = \"MitocGroup/landing-zone/aws\"\n  version = \"0.2.5\"\n  landing_zone_providers  = var.landing_zone_providers\n  landing_zone_components = var.landing_zone_components\n  terraform_backend       = var.terraform_backend\n}\n```\n\u003e NOTE: Make sure to include `variables.tf` and optionally `terraform.tfvars`\n\nTo simplify and make it easier to understand, we included default values in `terraform.tfvars`:\n```hcl\nlanding_zone_providers = {\n  default = {\n    account_id = \"123456789012\"\n    region     = \"us-east-1\"\n  }\n  [...]\n}\nlanding_zone_components = {\n  landing_zone_vpc = \"s3://terraform-aws-landing-zone/components/landing_zone_vpc/*.tfvars\"\n  [...]\n}\nterraform_backend = {\n  backend = \"local\"\n  path    = \"/tmp/.terrahub/landing_zone\"\n}\n```\n\n\u003e NOTE: Placeholder `[...]` from above is used to suggest that similar syntax can be added. Remove it or update in order to have valid HCL / terraform configuration.\n\nThis means that before you use this terraform module, you will need to:\n1. Change `landing_zone_providers` to values that describe your AWS Organization account\n    * `default` reflects the default setup corresponding to AWS Organization account; add more providers by extending `landing_zone_providers` map with extra AWS accounts and/or AWS regions\n        * `account_id` reflects the AWS account used to deploy AWS resources; prevents provisioning AWS resources into wrong AWS account in case of valid AWS credentials\n        * `region` reflects the AWS region used to deploy AWS resources; create 2 different providers for the same AWS account, but different AWS regions\n2. Change `landing_zone_components` to values that fit into your AWS Landing Zone use case\n    * each key from `landing_zone_components` map represents the name of the component from [this list of available components](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components)\n    * each value from `landing_zone_components` map represents the path to `.tfvars` file on S3 and/or local disk\n        * each `.tfvars` file must use HCL format; DO NOT USE other formats like JSON or YAML\n3. Change `terraform_backend` to values that reflect your terraform backend where `.tfstate` files are stored (in `variables.tf` default parameter value is defined as `local`)\n\n\u003e NOTE: Terraform module `landing_zone` can have tens, hundreds or thousands of deployable components, but not all of them should be and will be deployed. At runtime, components that are not part of `landing_zone_components` variable will be ignored.\n\n### More Examples\n* [Terraform module for AWS Landing Zone (one component: AWS Organization)](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/examples/example_landing_zone_organization)\n* [Terraform module for AWS Landing Zone (multiple components: S3, CodePipeline and CodeBuild)](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/examples/example_landing_zone_s3_and_codepipeline)\n* [Terraform module for AWS Lambda function using AWS Landing Zone reader](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/examples/example_landing_zone_reader)\n\n\n## What Components Are Available\nAWS Landing Zone solution is defined by the following strategy:\n1. [Multi-Account Structure](#multi-account-structure)\n    * AWS Organization Account\n    * Shared Services Account\n    * Log Archive Account\n    * Security Account\n2. [Account Vending Machine](#account-vending-machine)\n3. [User Access and Identity Management](#user-access-and-identity-management)\n4. [Monitoring and Notifications](#monitoring-and-notifications)\n\n\u003e NOTE: Current implementation of this terraform module covers only Multi-Account Structure\ncomponents (work in progress).\n\n### Multi-Account Structure\n\u003cimg align=\"right\" src=\"https://github.com/MitocGroup/terraform-aws-landing-zone/raw/master/docs/aws-landing-zone-architecture.png\" alt=\"AWS Landing Zone Multi-Account Architecture\" /\u003e\n\nBased on the multi-account architecture, here below are currently available components:\n1. [landing_zone_pipeline_s3_bucket](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_pipeline_s3_bucket/.terrahub.yml#L6)\n2. [landing_zone_pipeline_artifact_s3_bucket](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_pipeline_artifact_s3_bucket/.terrahub.yml#L6)\n3. [landing_zone_code_pipeline](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_code_pipeline/.terrahub.yml#L33)\n4. [landing_zone_code_pipeline_role](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_code_pipeline_role/.terrahub.yml#L6)\n5. [landing_zone_code_pipeline_role_policy](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_code_pipeline_role_policy/.terrahub.yml#L41)\n6. [landing_zone_code_build](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_code_build/.terrahub.yml#L21)\n7. [landing_zone_code_build_role](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_code_build_role/.terrahub.yml#L6)\n8. [landing_zone_code_build_role_policy](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_code_build_role_policy/.terrahub.yml#L29)\n9. [landing_zone_organization](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_organization/.terrahub.yml#L6)\n10. [landing_zone_organization_policy](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_organization_policy/.terrahub.yml#L6)\n11. [landing_zone_organization_policy_attachment](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_organization_policy_attachment/.terrahub.yml#L18)\n12. [landing_zone_organization_accounts](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_organization_accounts/.terrahub.yml#L15)\n13. [landing_zone_organization_unit](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_organization_unit/.terrahub.yml#L15)\n\n\u003cbr clear=\"right\" /\u003e\n\n### Account Vending Machine\n\u003cimg align=\"right\" src=\"https://github.com/MitocGroup/terraform-aws-landing-zone/raw/master/docs/aws-landing-zone-account-vending-machine.png\" alt=\"AWS Landing Zone Account Vending Machine Architecture\" /\u003e\n\nBased on the account vending machine architecture, here below are currently available components:\n1. Coming soon ...\n\n\u003cbr clear=\"right\" /\u003e\n\n### User Access and Identity Management\n\u003cimg align=\"right\" src=\"https://github.com/MitocGroup/terraform-aws-landing-zone/raw/master/docs/aws-landing-zone-user-access.png\" alt=\"AWS Landing Zone User Access and Identity Management Architecture\" /\u003e\n\nBased on the user access architecture, here below are currently available components:\n1. [landing_zone_iam_role](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_iam_role/.terrahub.yml#L9)\n2. [landing_zone_iam_policy](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_iam_policy/.terrahub.yml#L9)\n3. [landing_zone_iam_role_policy_attachment](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components/landing_zone_iam_role_policy_attachment/.terrahub.yml#L9)\n4. landing_zone_sso\n5. [landing_zone_directory_service_director](https://github.com/MitocGroup/terraform-aws-landing-zone/blob/master/components/landing_zone_directory_service_directory/.terrahub.yml#L24)\n\n\u003e NOTE: This solution is relying on cross-account role called `OrganizationAccountAccessRole`. Follow [this link](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_create-cross-account-role) to learn more and/or create missing IAM role(s)...\n\n\u003cbr clear=\"right\" /\u003e\n\n### Monitoring and Notifications\n\u003cimg align=\"right\" src=\"https://github.com/MitocGroup/terraform-aws-landing-zone/raw/master/docs/aws-landing-zone-notifications.png\" alt=\"AWS Landing Zone Monitoring and Notifications Architecture\" /\u003e\n\nBased on the notifications architecture, here below are currently available components:\n1. Coming soon ...\n\n\u003cbr clear=\"right\" /\u003e\n\n\n## Why to Use This Solution\n\n### No need for code changes\nTerraform module for AWS Landing Zone solution is up to 10 lines of code that receives a list of `.tfvars` files as input variables which describe providers (to be read: AWS accounts and AWS regions) and configs (to be read: AWS resources)\n\n### No need for code rewrites\nThis implementation engages microservices architecture, allowing any component to be replaced with another component (or multiple components)\n\n### No need for hard-coded values\nExisting AWS resources created by your team can be reused programmatically as read only values by other teams' terraform configurations\n\n### No need to rebuild from scratch\nExisting AWS resources in your current AWS account(s) can be imported and reused without downtime by this terraform module via `terraform import` command\n\n### No need to exclude pieces of account(s) baseline\nSome customers were avoiding in the past AWS Landing Zone because it doesn't support some kind of 3rd party SSO solution or 3rd party Logging solution. By using terraform, we can easily bring those solutions into AWS Landing Zone as a set of components and empower customers to continue using best practices of both worlds\n\n### Additionally, this module helps enforce best practices\n- By removing the need for access to AWS root account(s)\n- By using IAM cross-account roles and/or STS temporary credentials\n- By enabling centralized CloudTrail logs and cross-region replication of CloudTrail logs\n- By empowering complex organizations to separate roles and responsibilities (e.g. InfoSec team can place explicit deny on IAM, VPC, SG and STS for other teams and/or other environments like production or pre-production)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitocgroup%2Fterraform-aws-landing-zone","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmitocgroup%2Fterraform-aws-landing-zone","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitocgroup%2Fterraform-aws-landing-zone/lists"}