FPT SoftwareFHNCertificationsReference architectures
Talk to NGT
AWS · 02 of 4

Architecture

The landing zone in depth: its accounts, its seven areas and how NGT builds it.

AWS Multi-Account Landing Zone
01

The landing zone NGT builds first

A multi-account landing zone, then every wave lands on it.

  • Accounts by purposeSecurity, log archive, network and shared services kept apart from product accounts.
  • One network hubTransit Gateway joins the data centre and every VPC; spokes never peer directly.
  • Guardrails on branchesService control policies and Config rules set on OUs, not account by account.
  • Logs nobody can changeAn organization trail into a separate log archive account.
AWS Multi-Account Landing Zone
private linkspokesaudit trailOn premisesAWS CloudManagement account · AWS OrganizationsCore accounts · Security and Infrastructure OUsNetwork accountSecurity and audit accountLog archive accountShared services accountProduct accounts · Workloads OUDev accountPre-prod accountProd accountDeveloper accounts · Sandbox OUData centreAWS OrganizationsAWS Control TowerAWS Config & SCPsIAM Identity CenterTerraformlanding zone as codeAWS Budgetsbilling toolingAmazon CloudWatchAWS Direct ConnectAWS Transit GatewayAWS Network FirewallAWS Security HubAWS CloudTrailAWS ManagedMicrosoft ADAmazon EKSDevAmazon EKSPre-prodAmazon EKSProdAmazon Aurora / RDSfor PostgreSQLProdDeveloper sandbox

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

Point at a component to see what it does; select it for the best practice.Open the architecture
02

Seven areas of an AWS landing zone

Each area is designed, built as code and handed over with its runbook.

  1. 01Enterprise multi-accountOrganizations, OUs and account vending.AWS OrganizationsAWS Control Tower
  2. 02Identity and accessOne sign-in with the customer's directory; least privilege by role.IAM Identity CenterPermission sets
  3. 03Network and connectivityHub and spoke, a private link to the data centre, central inspection.Transit GatewayDirect ConnectNetwork Firewall
  4. 04Security, governance and compliancePreventive and detective guardrails on every account.SCPsAWS ConfigSecurity Hub
  5. 05Management and monitoringMetrics, logs and alarms set up the same way everywhere.CloudWatchCloudTrailLog archive
  6. 06Business continuity and DRBackup plans and recovery targets per workload tier.AWS BackupElastic Disaster Recovery
  7. 07Platform automation and DevOpsThe landing zone itself delivered through pipelines.TerraformCloudFormationCodePipeline
Everything as code
03

How NGT builds the landing zone

1 of 4

Assess

Understand today's operating model and document the baselines.

  • Accounts, networks and identity today
  • Security and compliance rules
  • Who runs what after go-live
SourcesFPT Software AWS Cloud Journey Service Offering V3NGT Service Offering v2.0 (Mar 2025)NGT Cloud Operations offering (Jan 2025)FPT Software Hanoi certification register (Nov 2024; 2025 records)NGT engineer profiles, a sample of 38 (Nov 2024 – Mar 2026)AWS Well-Architected Framework