control-tower

iac for management account

Terraform module to create Control tower baseline resources on AWS.

Customisations for AWS Control Tower Management Account

Reduce AWS Config costs in Control Tower environments by automatically switching from continuous to daily recording with smart resource exclusions

Sanitized AFT (Account Factory for Terraform) blueprint — automated, secure, cost-aware AWS account vending. Spans platform engineering, security/governance, and FinOps.

Requesting AWS Accounts through the Account Factory for Terraform

Account-specific customisations used in the Account Factory for Terraform

Provisioning AWS Accounts through the Account Factory for Terraform

Governed AWS multi-account estate in Terraform: Control Tower landing zone, OUs, SCP guardrails, RCP data perimeter, IAM Identity Center with ABAC, GitHub OIDC deploys, break-glass and detection (in progress)

Multi-account AWS landing zone for a SOC 2 + PCI-DSS B2B SaaS: 4 environments, SCP-isolated PCI CDE, Transit Gateway inspection, Object Lock WORM log archive. Generated by Merlin Studio in two formats — Landing Zone Accelerator (LZA) YAML and OpenTofu + Spacelift.

Global customisations used in the Account Factory for Terraform

Deploying and managing the Account Factory for Terraform for AWS Control Tower

Terraform module for AWS SSO Permissions Set

Fork of Account Factory for Terraform from AWS-IA

AWS multi-account landing zone for an EU bank — PCI DSS, ISO 27001, CIS, EUCS, GDPR. Dedicated CDE account, EU-only SCP, Network Firewall inspection, Object Lock audit logs, dual-region warm DR. LZA + OpenTofu, generated by Merlin.