<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-landing-zone-security
description: >-
  Implement secure cloud landing zones with account structure, guardrails,
  service control policies, centralized logging, and baseline security controls
  for multi-account cloud environments.
domain: cybersecurity
subdomain: security-architecture
tags:
  - cloud-security
  - landing-zone
  - aws-organizations
  - azure-landing-zone
  - guardrails
  - scp
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004"]
---

# Implementing Cloud Landing Zone Security

## Overview

Cloud landing zones establish the foundational security architecture for multi-account
cloud environments. This skill covers account structure design, service control
policies, guardrails, centralized logging, and baseline security controls that
prevent insecure resource deployment.

Mode: `[MODE: ARCHITECT]` — Cloud security foundation design.

## Prerequisites

- Cloud provider management account (AWS Organizations, Azure Management Group)
- IaC tooling (Terraform, CloudFormation)
- Python 3.10+

## Key Concepts

### Account Structure

```
Root
├── Security OU
│   ├── Log Archive Account      (centralized logging)
│   ├── Security Tooling Account (GuardDuty, SecurityHub)
│   └── Audit Account            (compliance scanning)
├── Infrastructure OU
│   ├── Shared Services Account  (DNS, CI/CD, artifact registry)
│   └── Network Hub Account      (Transit Gateway, VPN)
├── Workload OU
│   ├── Production OU
│   │   ├── App-A Prod Account
│   │   └── App-B Prod Account
│   └── Non-Production OU
│       ├── Dev Account
│       └── Staging Account
└── Sandbox OU
    └── Sandbox Account          (experimentation, auto-cleanup)
```

### Service Control Policy — Deny Insecure Actions

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyPublicS3",
      "Effect": "Deny",
      "Action": [
        "s3:PutBucketPublicAccessBlock"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:PublicAccessBlockConfiguration/BlockPublicAcls": "true"
        }
      }
    },
    {
      "Sid": "DenyUnencryptedVolumes",
      "Effect": "Deny",
      "Action": "ec2:CreateVolume",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "ec2:Encrypted": "false"
        }
      }
    },
    {
      "Sid": "DenyRegionsOutsideAllowed",
      "Effect": "Deny",
      "NotAction": [
        "iam:*",
        "sts:*",
        "organizations:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": ["us-east-1", "us-west-2", "eu-west-1"]
        }
      }
    }
  ]
}
```

### Guardrail Categories

| Category | Type | Examples |
|----------|------|---------|
| **Preventive** | SCP/Policy | Block public S3, deny unencrypted volumes |
| **Detective** | Config Rules | CloudTrail enabled, VPC flow logs active |
| **Corrective** | Auto-remediation | Auto-enable encryption, close public ports |

### Centralized Logging Architecture

```yaml
log_destinations:
  - source: cloudtrail
    destination: log-archive-account
    encryption: kms
    retention_days: 365
    immutable: true
  - source: vpc-flow-logs
    destination: log-archive-account
    encryption: kms
    retention_days: 90
  - source: guardduty-findings
    destination: security-tooling-account
    encryption: kms
    notification: security-team-sns
```

## Workflow

### Step 1: Design Account Structure

```bash
node scripts/agent.js --action design --config org-config.json
```

### Step 2: Generate Guardrails

```bash
node scripts/agent.js --action guardrails --config org-config.json --output guardrails.json
```

### Step 3: Audit Landing Zone

```bash
node scripts/agent.js --action audit --config org-config.json --output audit.json
```

### Step 4: Validate Compliance

```bash
node scripts/agent.js --action validate --guardrails guardrails.json
```

## Detection

```yaml
title: Cloud Landing Zone Security Detection
id: d2cf475c-f35e-4a4c-b70e-e4e585e63147
status: experimental
description: Detects suspicious activity related to implementing cloud landing zone security techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```

## Verification

- [ ] Account structure separates security, infrastructure, and workloads
- [ ] SCPs prevent public resource creation and unencrypted storage
- [ ] CloudTrail enabled in all accounts with centralized log delivery
- [ ] VPC flow logs enabled for all VPCs
- [ ] GuardDuty enabled across all accounts and regions
- [ ] Region restrictions enforced via SCP
- [ ] Sandbox accounts have auto-cleanup and budget alerts

## References

- [AWS Landing Zone Best Practices](https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-aws-environment/building-landing-zones.html)
- [Azure Landing Zone Architecture](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/)
- [CIS Cloud Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)
