https://samueltillman.com/tags/cloudtrail/Recent content in CloudTrail on Samuel TillmanHugoen-usTue, 04 Aug 2026 00:00:00 +0000https://samueltillman.com/posts/refplatform/layer-1-the-landing-zone/Tue, 04 Aug 2026 00:00:00 +0000https://samueltillman.com/posts/refplatform/layer-1-the-landing-zone/<p>Last week I walked through <a href="https://samueltillman.com/posts/refplatform/layer-0-bootstrapping-an-aws-org/">Layer 0</a> : the organization itself, OUs, four member accounts, guardrail SCPs, a Terraform state backend, and GitHub OIDC, all managed from the management account and nothing else. That layer was deliberately inward: everything it touched lived in one account.</p> <p>Layer 1 is where the platform stops being a skeleton and grows a nervous system. This is the <em>landing zone</em>, the shared identity, audit, and security backbone that every layer above it, including the EKS platform in Layer 2, quietly depends on. And it&rsquo;s the first time Terraform reaches <strong>across account boundaries</strong> and leans on <strong>organization-wide services with delegated administration</strong>. Those two facts drive almost every interesting decision, and every single one of the gotchas, in this post.</p>