عرض عملي: تصميم منطقة الهبوط لـ Larkspur

خطوة بخطوة

1. Draw the hierarchy: Security, Shared network, Workloads (prod, non-prod), Sandbox with budget.
2. Define guardrails: approved regions only, no public data stores, encryption required, mandatory tags, logging cannot be disabled.
3. Define the tag standard and central logging to the security account.
4. Define the IaC workflow with review and policy checks.
5. Planned mistake: a developer creates an unencrypted public bucket in the console during the walkthrough. Show the preventive policy deny it, and the detective rule flag an existing one.
6. Record exceptions process and the owner of the landing zone.