AWS SAP — The Multi-Account Landing Zone — the city and its law

One account is a home. Two hundred accounts are a city, and a city needs law before it needs buildings.

§ IFrame — Where the Rotation Opens

The Cloud cert rotation fires today for the first time, opening on AWS Solutions Architect Professional. SAP-C02 weighs four domains: Design Solutions for Organizational Complexity ~26%, Design for New Solutions ~29%, Continuous Improvement ~25%, Migration and Modernization ~20%. The opening lesson takes the first domain's first question, because every other SAP topic assumes its answer: how does an organization hold many AWS accounts without the many becoming a mess?

The move mirrors how each track opened. Terraform began at state, Kubernetes at the reconciliation loop, and SAP begins at the landing zone. The vendor directory holds warm history: 07-14 used Service Control Policies as budget guardrails; 05-26 laid the IAM credential ground. Today supplies the frame both were standing in without naming.

One idea carries the lesson: the account is the blast radius. Inside one account, IAM misconfigurations travel. The account boundary is the one wall AWS never lets permissions cross by accident; cross-account access exists only by explicit grant on both sides. So the professional-level isolation answer is rarely a subnet and rarely a tag: it is a separate account. Workload from workload, prod from dev, security tooling from the things it audits.

§ IIAWS Organizations — The City Charter

Organizations turns a pile of accounts into a tree. At the root sits the management account: it pays the consolidated bill, invites and creates accounts, moves them between OUs, attaches policies. The first discipline of the domain: nothing runs there. The management account is exempt from every guardrail this lesson builds, so the only safe workload for it is governance itself.

Beneath the root, organizational units group accounts by function, not org chart. OUs nest; policies attach at any layer; accounts inherit everything above them. Consolidated billing arrives free: one payer, per-account visibility, volume discounts pooled across the organization. The 07-14 budget machinery assumed exactly this shape.

Two facts recur on the exam because they recur in incidents. Account creation is an API call (CreateAccount), which is what makes account-per-workload economics possible. And an account can only leave the organization with standalone billing configured; an SCP can deny organizations:LeaveOrganization outright, the first guardrail most security teams write.

§ IIIService Control Policies — The Ceiling and the Grant

An SCP looks like an IAM policy and behaves like nothing else in the family. The organizing distinction: SCPs never grant. An SCP is a ceiling; IAM policies inside the account are the grant; effective permission is the intersection. Ceiling without grant is nothing. Grant above the ceiling is nothing. The same intersection logic governs permissions boundaries and session policies one level down, and SAP loves asking which layer denied the action: walk the layers in order, and any explicit deny anywhere ends the conversation.

Evaluation walks the tree per level: root's policies, each intervening OU's, the account's own; every level must permit. Organizations ships every node with a default FullAWSAccess SCP, making the strategy question deny-list versus allow-list. Deny-list keeps the default and layers targeted denies; allow-list removes it and enumerates the permitted, airtight and expensive to maintain. Deny-list is the working default; allow-list appears in regulated enclaves, and the exam expects you to know the maintenance cost the tightness buys.

Three classic traps. SCPs do not affect the management account, ever. SCPs do bind the root user of member accounts, the only tool in AWS that can. SCPs do not touch service-linked roles. Day-one guardrails: deny leaving the org, deny root-user actions, deny CloudTrail/Config tampering, deny all but sanctioned regions (aws:RequestedRegion, global services carved out). The 07-14 SCP denying oversized ec2:RunInstances was this instrument pointed at cost.

§ IVControl Tower — The Paved Road

Everything above can be assembled by hand, and the first landing zones were. Control Tower is the productized version: the paved road. It stands up the shape the field converged on: a Security OU holding a Log Archive account (every account's CloudTrail and Config streams, centralized, immutable) and an Audit account (security tooling with cross-account read into everything); a Sandbox OU; and Account Factory, the vending machine that stamps out accounts pre-enrolled, pre-networked, pre-guarded.

Guardrails are Control Tower's packaged controls, and the taxonomy is exam-portable: preventive = SCPs (the action cannot happen); detective = Config rules (the drift is found); proactive = CloudFormation hooks (the resource is stopped at provisioning). When the exam contrasts "prevent the action" with "detect the violation," it is testing this row.

Notice what the Log Archive account is in this trio's terms: the organization keeping its own run-record. Today's Ops lesson taught a Python tool to write witnesses nobody can quietly delete; an org trail streaming every account's API calls into a locked archive is the same discipline at company scale. The org that cannot lose its history is the org whose incidents end in findings rather than mysteries.

§ VCross-Account Roles — The Diplomatic Visa

Accounts isolate; work still crosses. The instrument is the IAM role plus sts:AssumeRole, and the grammar has two halves tested separately: the trust policy says who may assume; the permission policy says what the session may do. Both must agree, and the assuming principal must also hold sts:AssumeRole on the role's ARN. Two accounts, two documents, one handshake.

Brikman shows the working shape in six lines: one provider block per account, each carrying assume_role with the target's role ARN, so one terraform apply plans against parent and child through two visas at once (ch. 7, pp. 378-379). The same pattern is the CI deploy backbone: the pipeline account holds nothing but the right to assume deploy roles in workload accounts. Compromising the pipeline yields visas, not passports, and every assumption lands in CloudTrail with the session name attached.

Two professional-grade details. ExternalId answers the confused-deputy problem: the per-customer secret that stops customer A from pointing a vendor's credentials at customer B's role. Role chaining caps the second session at one hour regardless of configured maximums, a fact that has ended more than one hub-and-spoke design in review. For humans, IAM Identity Center vends short-lived sessions per account per permission set; laptop access keys are the pattern the landing zone exists to retire, the 05-26 point in its organizational frame.

§ VIWorked Scenario — The Hedronite Landing Zone

A firm runs a quant stack, a public website, a security function, and a CI system deploying to both. The root holds the management account, empty, root user MFA-locked. Security OU: Log Archive (org trail, Config aggregator, S3 Object Lock per 06-23) and Audit. Infrastructure OU: Network (Transit Gateway, shared endpoints) and Shared Services (registries, CI runners). Workloads OU nests Prod OU (trading, website-prod) and NonProd OU (dev, staging). Sandbox OU gives builders room where the region-lock and a spend guardrail are the only law.

SCPs: keep FullAWSAccess everywhere; layer org-wide denies for leaving, root actions, trail tampering, and non-sanctioned regions; Prod adds a deny on deleting backup vaults; Sandbox adds the 07-14 instance-size ceiling. Account Factory stamps new accounts into NonProd with the baseline VPC and a deploy role pre-created, trust pointed at Shared Services. Every deploy is an AssumeRole hop recorded in a trail no workload account can silence. The blast radius of any compromise is one account's contents plus its enumerated visas.

§ VIIDrill — Six Questions

Tap a card to reveal its resolution. Score cold first.

§ VIIIClosing

The landing zone pays twice: a quarter of the blueprint stands on it, and every later domain quietly assumes it. Organizations is the tree. SCPs are the ceiling that never grants. Control Tower is the paved road with the log archive at the end of it. The cross-account role is the visa: two documents, one handshake. Isolation wants an account before a subnet; control wants the layer named before the policy.

Score the six questions cold. The rotation returns to AWS at the DOP seat in three Python-days; between now and then, the Terraform and Kubernetes seats will both be standing inside accounts this lesson taught you to vend.