AWS Multi-Account Landing Zone

digraph lz {
  rankdir=TB;
  graph [bgcolor=transparent];
  node [shape=box, style="rounded,filled", fontname=Inter, fontsize=10];

  Mgmt [label="Management account\n(billing, IAM Identity Center)", fillcolor="#fce7f3"];

  OUcore [label="OU: Core", fillcolor="#fef3c7"];
  Sec  [label="Security tooling\n(GuardDuty, Security Hub)", fillcolor="#dbeafe"];
  Log  [label="Log archive\n(immutable S3)", fillcolor="#dbeafe"];

  OUwl  [label="OU: Workloads", fillcolor="#fef3c7"];
  Prod  [label="Prod account", fillcolor="#dcfce7"];
  Stg   [label="Staging account", fillcolor="#dcfce7"];
  Dev   [label="Dev account", fillcolor="#dcfce7"];

  OUsbx [label="OU: Sandboxes", fillcolor="#fef3c7"];
  Sbx1  [label="Engineer sandboxes"];

  Mgmt -> OUcore -> Sec;
  OUcore -> Log;
  Mgmt -> OUwl -> Prod;
  OUwl -> Stg;
  OUwl -> Dev;
  Mgmt -> OUsbx -> Sbx1;
}