Design a multi-account AWS landing zone: separate accounts by blast radius (prod/non-prod/security/shared-services) under Organizations, SCP guardrails as ceilings, region/AZ resilience, and the Control-Tower-or-not decision.
Scanned 9/23/2026
Skills Directorynpx -y skills add mcorbett51090/RavenClaude --skill aws-account-strategy --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Aws Account Strategy?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/mcorbett51090-aws-account-strategy)More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.
---
name: aws-account-strategy
description: "Design a multi-account AWS landing zone: separate accounts by blast radius (prod/non-prod/security/shared-services) under Organizations, SCP guardrails as ceilings, region/AZ resilience, and the Control-Tower-or-not decision."
---
# AWS Account Strategy
## Multi-account by blast radius
Separate **prod / non-prod / security / shared-services** accounts under **Organizations**. One account = one blast radius + an unattributable bill.
## Guardrails
**SCPs** set the org-wide ceiling (even an admin can't exceed them). **Control Tower** if you want the landing zone + guardrails managed.
## Resilience
Multi-**AZ** by default (cheap HA); multi-**region** only when RTO/RPO/latency justifies it. State the RTO/RPO.
## Build
The topology is the design; `terraform-iac` builds it.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
