AWS
Networking
advanced
Landing Zone Network — AWS Architecture Template
Multi-account-style network foundation: dedicated ingress VPC, Transit Gateway core, workload VPCs, and org guardrails.
Why this architecture works
- A dedicated ingress VPC concentrates all inbound exposure so workload VPCs have zero public subnets
- Transit Gateway as the core makes adding a new workload VPC a routing change, not a re-architecture
- Centralised egress NAT enforces one outbound inspection and logging point for every environment
- CloudTrail from day one gives an immutable record of every network and IAM change
- IAM guardrail roles standardise who can alter routing, preventing accidental cross-env exposure
What's inside (10 resources)
Public DNS
aws-route53
Central Ingress ALB
aws-alb
Ingress VPC
aws-vpc
Transit Core
aws-transit-gateway
Central Egress
aws-nat-gateway
Prod Workload VPC
aws-vpc
Dev Workload VPC
aws-vpc
Audit Trail
aws-cloudtrail
Network Monitoring
aws-cloudwatch
Org Guardrails
aws-iam
From template to running infrastructure
- Open this template in the CloudForge visual designer (free account, no credit card).
- Customize resources, names, and connections on the drag-and-drop canvas — or ask Vani, the AI architect, to adapt it.
- Generate production-ready Terraform or CloudFormation in one click.
- Review the plan diff and security scan, then deploy with human approval.