# AWS Landing Zone for AI Workloads — Reference Architecture **Publisher:** Earp Strategic Consulting, LLC **Scope:** Multi-account AWS landing zone, built on AWS Control Tower and AWS Organizations, hardened for generative-AI and ML workloads in regulated industries. **Status:** Reference architecture. Adapt names, Regions and address space to your organization; every value below is an example. --- ## 1. Design principles 1. **The account is the blast radius.** One account per workload per environment. Isolation, billing and access boundaries follow the account. 2. **Preventive before detective.** Service control policies (SCPs) and resource control policies deny what must never happen; AWS Config and Security Hub detect what slips through. 3. **Private by default.** Amazon Bedrock, S3, KMS, STS, ECR and other dependencies are reached through VPC endpoints; workload VPCs have no internet gateway. 4. **Identity is the perimeter.** People sign in through IAM Identity Center with permission sets; workloads use IAM roles. No IAM users with long-lived keys. 5. **Everything is code, and every model call is on the record.** Terraform and CDK deploy the estate; an inference gateway writes a hash-chained ledger entry per model call. --- ## 2. Organization and OU structure ``` Organization root ├── Security OU │ ├── Log Archive account # immutable CloudTrail, Config, VPC Flow Logs │ └── Audit / Security Tooling # delegated admin: Security Hub, GuardDuty, Macie, Inspector ├── Infrastructure OU │ ├── Network account # Transit Gateway, inspection VPC, Route 53 Resolver, egress │ └── Shared Services account # CI runners, artifact repos, inference gateway (optional central) ├── Workloads OU │ ├── Prod OU │ ├── Non-prod OU │ └── AI OU # model-consuming workloads with AI-specific SCPs ├── Sandbox OU # isolated, budget-capped, no TGW attachment └── Suspended OU # deny-all SCP; accounts awaiting closure ``` The management (payer) account runs nothing but Organizations, Control Tower, billing and IAM Identity Center administration (or delegates it). --- ## 3. Identity | Control | Implementation | |---|---| | Workforce identity | IAM Identity Center federated to the corporate IdP via SAML/SCIM; groups provisioned automatically | | Permission sets | Least-privilege permission sets per job function (ReadOnly, Developer, PlatformAdmin, SecurityAudit); assigned to groups per account | | Privileged access | Time-bound elevation for PlatformAdmin through an approval workflow; session duration capped | | Workload identity | IAM roles for EC2/ECS/EKS (IRSA or EKS Pod Identity) and Lambda; CI assumes roles through OIDC federation — no access keys | | Root users | Centralised root access management where available; MFA on remaining root credentials; SCP denies root actions in member accounts | | Break-glass | Two emergency IAM principals in the management account, hardware MFA, alerting on any use | --- ## 4. Network ### 4.1 Topology - **AWS Transit Gateway** in the Network account, shared through AWS RAM. Separate TGW route tables for prod, non-prod, shared services and inspection. - **Inspection VPC** with AWS Network Firewall; TGW appliance mode on. All inter-VPC and egress traffic is inspected. - **Centralised egress** through NAT gateways in the egress path behind Network Firewall domain allow-lists. Workload VPCs have no internet gateway. - **Ingress:** Amazon CloudFront with AWS WAF and Shield Advanced for internet-facing apps; ALBs in a dedicated ingress VPC or workload public subnets per pattern. - **Private connectivity:** interface VPC endpoints (AWS PrivateLink) for `bedrock-runtime`, `bedrock`, `sts`, `kms`, `logs`, `ecr.api`, `ecr.dkr`, `secretsmanager`; gateway endpoint for S3. Endpoint policies restrict access to organization principals and approved resources. - **DNS:** Route 53 Resolver endpoints and shared private hosted zones in the Network account. ### 4.2 Example CIDR plan (IPAM-managed) | Pool | Region A | Region B | |---|---|---| | Top-level (Amazon VPC IPAM) | 10.64.0.0/12 | 10.80.0.0/12 | | Network account (inspection, egress, ingress) | 10.64.0.0/20 | 10.80.0.0/20 | | Shared services | 10.64.16.0/20 | 10.80.16.0/20 | | Prod workloads pool | 10.65.0.0/16 | 10.81.0.0/16 | | Non-prod workloads pool | 10.66.0.0/16 | 10.82.0.0/16 | | AI workloads pool | 10.67.0.0/16 | 10.83.0.0/16 | | Sandbox (not routed) | 172.24.0.0/14 | — | Standard AI workload VPC (/22 from the AI pool, three AZs): | Subnet tier | Size per AZ | Purpose | |---|---|---| | `private-app` | /25 | EKS nodes / ECS tasks / Lambda ENIs | | `private-endpoints` | /27 | Interface endpoints (Bedrock runtime, STS, KMS, Logs, ECR) | | `private-data` | /27 | RDS / OpenSearch / vector store | | `tgw-attach` | /28 | Transit Gateway attachment | --- ## 5. Security baseline - **AWS Security Hub** (delegated admin in the Audit account) with AWS Foundational Security Best Practices and CIS standards enabled organization-wide. - **Amazon GuardDuty** in every account and Region, including S3, EKS, RDS and Lambda protection plans and malware protection where applicable. - **AWS CloudTrail** organization trail to the Log Archive account: S3 Object Lock, KMS encryption, bucket policy denying deletion. - **AWS Config** recorders in every account with conformance packs; aggregator in the Audit account. - **Baseline SCPs:** - Deny leaving the organization; deny disabling CloudTrail, Config, GuardDuty, Security Hub - Region allow-list - Deny creation of IAM users and access keys (outside break-glass) - Deny `ec2:CreateInternetGateway` / `AttachInternetGateway` in Workloads OU - Require IMDSv2 - AI OU: deny Bedrock model invocation for models not on the approved list (condition on model ARN) --- ## 6. Data - **Amazon Macie** scheduled discovery jobs across S3 in Workloads OU; findings to Security Hub. - **AWS Lake Formation** for fine-grained (table, column, row) access to the Glue Data Catalog; LF-tags drive which data sets are allowed for retrieval-augmented generation or fine-tuning. - **S3:** Block Public Access at the organization level; SSE-KMS with customer-managed keys; versioning and Object Lock on audit buckets. - **Retention:** prompt/response payloads in an Object Lock bucket for the required period; the ledger stores hashes and metadata only. - **Encryption:** AWS KMS customer-managed keys per workload; key policies scoped to workload roles; automatic rotation enabled. --- ## 7. AI services | Component | Configuration | |---|---| | Amazon Bedrock | Invoked only through the `bedrock-runtime` interface endpoint; endpoint policy restricts principals and model ARNs | | Model access | Model access granted per account from an approved list maintained as code; SCP denies invocation of unapproved models | | Inference gateway | Service in the workload (or Shared Services) VPC: authenticates callers, applies quotas and guardrail checks, hashes prompt + response, writes the ledger entry | | Guardrails | Amazon Bedrock Guardrails configured per use case (denied topics, content filters, sensitive-information filters); guardrail version pinned in code | | Invocation logging | Bedrock model invocation logging to a KMS-encrypted S3 bucket and CloudWatch Logs in the workload account, replicated to Log Archive | | Retrieval | Knowledge bases or a self-managed vector store in `private-data`; sources limited to LF-tag-approved data | | Evaluation | Scheduled evaluation jobs against versioned golden sets; results recorded with the model ID and guardrail version | --- ## 8. IaC module layout ``` infra/ ├── modules/ # Terraform │ ├── org-ous/ # OUs, SCPs, tag policies, delegated admins │ ├── scp/ # SCP documents as code + unit tests │ ├── network-hub/ # TGW, route tables, inspection VPC, Network Firewall, egress │ ├── ipam/ # IPAM pools and allocations │ ├── workload-vpc/ # spoke VPC, subnets, endpoints, TGW attachment │ ├── security-baseline/ # Security Hub, GuardDuty, Config, Macie org settings │ └── ai-workload/ # Bedrock endpoints, invocation logging, KMS, gateway IAM ├── aft/ # Account Factory for Terraform: account requests + customizations ├── cdk/ │ └── apps// # application stacks (CDK) consuming Terraform outputs via SSM └── tests/ ├── scp-simulations/ # IAM policy simulator cases: must-allow / must-deny └── plan-snapshots/ ``` CI rules: `terraform plan` and `cdk diff` posted to the PR; applies only from the main branch via OIDC-assumed roles; SCP changes run simulator cases before attachment. --- ## 9. Day-2 operations - **Account vending:** new workload = account request in AFT; the pipeline creates the account in the right OU, attaches the VPC to the TGW, enables baseline services, applies budgets and assigns permission sets to groups. - **Drift:** Control Tower drift detection plus nightly `terraform plan`; drift opens an issue with the diff. - **Findings SLAs:** Security Hub critical findings to on-call within minutes via EventBridge; high findings triaged within one business day. - **Key rotation and revocation:** automatic KMS rotation; tested runbook for disabling a workload key and confirming Bedrock logging and data paths fail closed. - **Access reviews:** quarterly review of permission-set assignments; IAM Access Analyzer for external and unused access. - **Model lifecycle:** model version changes go through the eval gate; approved-model list updated by pull request. - **Cost:** per-account budgets, Bedrock usage by model and application inference profile, anomaly detection alerts to workload owners. --- *Earp Strategic Consulting — AI systems, governance and cloud architecture. This document describes a reference design; it is not a statement of compliance. Compliance frameworks are addressed through readiness mapping against your specific control set.*