<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" modified="2026-06-27" version="21.0.0">
  <diagram id="multi-account-lz" name="Multi-Account Landing Zone">
    <mxGraphModel dx="1422" dy="762" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1654" pageHeight="1169" math="0" shadow="0">
      <root>
        <mxCell id="0"/>
        <mxCell id="1" parent="0"/>

        <!-- TITLE -->
        <mxCell id="2" value="Multi-Account Landing Zone — AWS Organizations, IAM Identity Center, Transit Gateway Hub-and-Spoke" style="text;html=1;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;fontSize=18;fontStyle=1;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="100" y="20" width="1450" height="40" as="geometry"/>
        </mxCell>

        <!-- AWS ORGANIZATIONS ROOT -->
        <mxCell id="3" value="AWS Organizations&#xa;Root (Management)" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#DD344C;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=11;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.organizations;" vertex="1" parent="1">
          <mxGeometry x="760" y="80" width="60" height="60" as="geometry"/>
        </mxCell>

        <!-- IAM IDENTITY CENTER -->
        <mxCell id="4" value="IAM Identity Center&#xa;(SSO / SAML 2.0)" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#DD344C;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=11;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.iam;" vertex="1" parent="1">
          <mxGeometry x="1380" y="80" width="60" height="60" as="geometry"/>
        </mxCell>
        <mxCell id="e_sso" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#DD344C;dashed=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;" edge="1" source="3" target="4" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- OU SECURITY -->
        <mxCell id="10" value="OU: Security" style="points=[[0,0],[0.25,0],[0.5,0],[0.75,0],[1,0],[1,0.25],[1,0.5],[1,0.75],[1,1],[0.75,1],[0.5,1],[0.25,1],[0,1],[0,0.75],[0,0.5],[0,0.25]];shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_account;strokeColor=#DD344C;fillColor=#FFF5F5;verticalLabelPosition=top;verticalAlign=bottom;align=center;html=1;whiteSpace=wrap;fontSize=12;fontStyle=1;fontColor=#DD344C;" vertex="1" parent="1">
          <mxGeometry x="80" y="220" width="310" height="190" as="geometry"/>
        </mxCell>
        <mxCell id="11" value="Security Tooling Account&#xa;(GuardDuty delegated admin)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFEBEE;strokeColor=#DD344C;fontSize=10;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="100" y="265" width="130" height="50" as="geometry"/>
        </mxCell>
        <mxCell id="12" value="Log Archive Account&#xa;(Centralised CloudTrail)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFEBEE;strokeColor=#DD344C;fontSize=10;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="245" y="265" width="130" height="50" as="geometry"/>
        </mxCell>
        <mxCell id="13" value="GuardDuty" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#DD344C;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.guardduty;" vertex="1" parent="1">
          <mxGeometry x="120" y="340" width="45" height="45" as="geometry"/>
        </mxCell>
        <mxCell id="14" value="Security Hub" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#DD344C;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.security_hub;" vertex="1" parent="1">
          <mxGeometry x="265" y="340" width="45" height="45" as="geometry"/>
        </mxCell>
        <mxCell id="e_sec" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#DD344C;" edge="1" source="3" target="10" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- OU INFRASTRUCTURE -->
        <mxCell id="20" value="OU: Infrastructure" style="points=[[0,0],[0.25,0],[0.5,0],[0.75,0],[1,0],[1,0.25],[1,0.5],[1,0.75],[1,1],[0.75,1],[0.5,1],[0.25,1],[0,1],[0,0.75],[0,0.5],[0,0.25]];shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_account;strokeColor=#8C4FFF;fillColor=#F4ECFF;verticalLabelPosition=top;verticalAlign=bottom;align=center;html=1;whiteSpace=wrap;fontSize=12;fontStyle=1;fontColor=#8C4FFF;" vertex="1" parent="1">
          <mxGeometry x="440" y="220" width="310" height="190" as="geometry"/>
        </mxCell>
        <mxCell id="21" value="Network Hub Account&#xa;(Transit Gateway, DNS)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#EDE7F6;strokeColor=#8C4FFF;fontSize=10;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="460" y="265" width="130" height="50" as="geometry"/>
        </mxCell>
        <mxCell id="22" value="Shared Services Account&#xa;(AD, code repos, CI/CD)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#EDE7F6;strokeColor=#8C4FFF;fontSize=10;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="605" y="265" width="130" height="50" as="geometry"/>
        </mxCell>
        <mxCell id="23" value="Transit Gateway" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#8C4FFF;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.transit_gateway;" vertex="1" parent="1">
          <mxGeometry x="480" y="340" width="45" height="45" as="geometry"/>
        </mxCell>
        <mxCell id="24" value="AWS Config&#xa;(Compliance)" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#E7157B;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.config;" vertex="1" parent="1">
          <mxGeometry x="630" y="340" width="45" height="45" as="geometry"/>
        </mxCell>
        <mxCell id="e_inf" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#8C4FFF;" edge="1" source="3" target="20" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- OU WORKLOADS DEV -->
        <mxCell id="30" value="OU: Workloads — Dev" style="points=[[0,0],[0.25,0],[0.5,0],[0.75,0],[1,0],[1,0.25],[1,0.5],[1,0.75],[1,1],[0.75,1],[0.5,1],[0.25,1],[0,1],[0,0.75],[0,0.5],[0,0.25]];shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_account;strokeColor=#3F8624;fillColor=#F0FFF0;verticalLabelPosition=top;verticalAlign=bottom;align=center;html=1;whiteSpace=wrap;fontSize=12;fontStyle=1;fontColor=#3F8624;" vertex="1" parent="1">
          <mxGeometry x="800" y="220" width="310" height="190" as="geometry"/>
        </mxCell>
        <mxCell id="31" value="Dev Account — Team Alpha&#xa;(sandbox, no prod access)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E8F5E9;strokeColor=#3F8624;fontSize=10;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="820" y="265" width="130" height="50" as="geometry"/>
        </mxCell>
        <mxCell id="32" value="Dev Account — Team Beta&#xa;(sandbox, no prod access)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E8F5E9;strokeColor=#3F8624;fontSize=10;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="965" y="265" width="130" height="50" as="geometry"/>
        </mxCell>
        <mxCell id="e_dev" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#3F8624;" edge="1" source="3" target="30" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- OU WORKLOADS PROD -->
        <mxCell id="40" value="OU: Workloads — Prod" style="points=[[0,0],[0.25,0],[0.5,0],[0.75,0],[1,0],[1,0.25],[1,0.5],[1,0.75],[1,1],[0.75,1],[0.5,1],[0.25,1],[0,1],[0,0.75],[0,0.5],[0,0.25]];shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_account;strokeColor=#E7157B;fillColor=#FFF0F7;verticalLabelPosition=top;verticalAlign=bottom;align=center;html=1;whiteSpace=wrap;fontSize=12;fontStyle=1;fontColor=#E7157B;" vertex="1" parent="1">
          <mxGeometry x="1160" y="220" width="310" height="190" as="geometry"/>
        </mxCell>
        <mxCell id="41" value="Prod Account — Team Alpha&#xa;(restricted, MFA required)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FCE4EC;strokeColor=#E7157B;fontSize=10;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="1180" y="265" width="130" height="50" as="geometry"/>
        </mxCell>
        <mxCell id="42" value="Prod Account — Team Beta&#xa;(restricted, MFA required)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FCE4EC;strokeColor=#E7157B;fontSize=10;fontColor=#232F3E;" vertex="1" parent="1">
          <mxGeometry x="1325" y="265" width="130" height="50" as="geometry"/>
        </mxCell>
        <mxCell id="e_prod" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#E7157B;" edge="1" source="3" target="40" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- SCPs banner -->
        <mxCell id="50" value="Service Control Policies (SCPs): Deny regions outside us-east-1/us-west-2 · Prevent root API calls without MFA · Block public S3 ACLs · Require IMDSv2 on EC2" style="text;html=1;strokeColor=#DD344C;fillColor=#FFEBEE;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=1;fontSize=10;fontStyle=1;" vertex="1" parent="1">
          <mxGeometry x="80" y="450" width="1390" height="35" as="geometry"/>
        </mxCell>

        <!-- TRANSIT GATEWAY HUB -->
        <mxCell id="60" value="Transit Gateway&#xa;Hub (us-east-1)" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#8C4FFF;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=12;fontStyle=1;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.transit_gateway;" vertex="1" parent="1">
          <mxGeometry x="735" y="540" width="80" height="80" as="geometry"/>
        </mxCell>

        <!-- SPOKE VPCs -->
        <mxCell id="61" value="VPC: Security&#xa;10.0.0.0/16" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#DD344C;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.vpc;" vertex="1" parent="1">
          <mxGeometry x="150" y="555" width="60" height="60" as="geometry"/>
        </mxCell>
        <mxCell id="62" value="VPC: Shared Svcs&#xa;10.1.0.0/16" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#8C4FFF;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.vpc;" vertex="1" parent="1">
          <mxGeometry x="440" y="555" width="60" height="60" as="geometry"/>
        </mxCell>
        <mxCell id="63" value="VPC: Dev&#xa;10.2.0.0/16" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#3F8624;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.vpc;" vertex="1" parent="1">
          <mxGeometry x="1050" y="555" width="60" height="60" as="geometry"/>
        </mxCell>
        <mxCell id="64" value="VPC: Prod&#xa;10.3.0.0/16" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#E7157B;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.vpc;" vertex="1" parent="1">
          <mxGeometry x="1350" y="555" width="60" height="60" as="geometry"/>
        </mxCell>

        <mxCell id="e_t1" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#8C4FFF;exitX=0;exitY=0.5;exitDx=0;exitDy=0;" edge="1" source="60" target="61" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="e_t2" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#8C4FFF;exitX=0;exitY=0.5;exitDx=0;exitDy=0;" edge="1" source="60" target="62" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="e_t3" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#8C4FFF;exitX=1;exitY=0.5;exitDx=0;exitDy=0;" edge="1" source="60" target="63" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="e_t4" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#8C4FFF;exitX=1;exitY=0.5;exitDx=0;exitDy=0;" edge="1" source="60" target="64" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- CloudTrail + S3 Archive -->
        <mxCell id="70" value="CloudTrail&#xa;(All Regions)" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#E7157B;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.cloudtrail;" vertex="1" parent="1">
          <mxGeometry x="560" y="680" width="55" height="55" as="geometry"/>
        </mxCell>
        <mxCell id="71" value="S3 Log Archive&#xa;(Bucket + MFA Delete)" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#3F8624;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.s3;" vertex="1" parent="1">
          <mxGeometry x="700" y="680" width="55" height="55" as="geometry"/>
        </mxCell>
        <mxCell id="72" value="KMS CMK&#xa;(Log Encryption)" style="outlineConnect=0;fontColor=#232F3E;gradientColor=none;strokeColor=none;fillColor=#DD344C;labelBackgroundColor=#ffffff;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;verticalLabelPosition=bottom;verticalAlign=top;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.key_management_service;" vertex="1" parent="1">
          <mxGeometry x="840" y="680" width="55" height="55" as="geometry"/>
        </mxCell>
        <mxCell id="e_trail" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#3F8624;" edge="1" source="70" target="71" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="e_kms" style="edgeStyle=orthogonalEdgeStyle;html=1;strokeColor=#DD344C;dashed=1;" edge="1" source="71" target="72" parent="1"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- LEGEND -->
        <mxCell id="80" value="&lt;b&gt;Security&lt;/b&gt; — SCPs are the first line of guardrails; GuardDuty delegated admin aggregates threat findings across all accounts into Security Hub&#xa;&lt;b&gt;Reliability&lt;/b&gt; — Transit Gateway hub-and-spoke with non-overlapping CIDRs; single network account owns routing tables&#xa;&lt;b&gt;Operational Excellence&lt;/b&gt; — IAM Identity Center (one identity source, SAML 2.0) | CloudTrail centralised to immutable Log Archive account with KMS CMK encryption" style="text;html=1;strokeColor=#8C4FFF;fillColor=#F4ECFF;align=left;verticalAlign=middle;whiteSpace=wrap;rounded=1;fontSize=11;spacingLeft=10;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="80" y="780" width="1390" height="70" as="geometry"/>
        </mxCell>

      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
