Demo: Larkspur's landing zone design
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
design Larkspur's landing zone and show a non-compliant resource being stopped, preparing ARC-020-LAB1.
Draft outline details
Step by step
- Draw the hierarchy: Security, Shared network, Workloads (prod, non-prod), Sandbox with budget.
- Define guardrails: approved regions only, no public data stores, encryption required, mandatory tags, logging cannot be disabled.
- Define the tag standard and central logging to the security account.
- Define the IaC workflow with review and policy checks.
- Planned mistake: a developer creates an unencrypted public bucket in the console during the walkthrough. Show the preventive policy deny it, and the detective rule flag an existing one.
- Record exceptions process and the owner of the landing zone.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.