AWS Landing Zone and AWS Backup reference architecture

Use and deploy the Customizations for Control Tower (CfCT) resource template to integrate AWS Backup in your environment.

Enable Service Control Policies (SCPs) to set preventive guardrails and backup policies in AWS Organizations.

Enable AWS CloudFormation StackSets for your Organization to centrally deploy resources across multiple accounts.

Enable AWS Backup in your AWS Organizations environment. Enable cross-account monitoring and cross-account backup management.

Centrally manage SSO access to your environment by using . This service integrates with existing corporate identities through federation.

Use services such as CloudTrail, CloudWatch, and AWS Config to maintain audit trails in a centralized manner.

Centralize AWS Backup CloudTrail events and AWS Config logs in an S3 bucket owned by the Log Archive account.

Securely manage shared resources, such as AWS KMS, to centralize and decouple key ownership by using IAM cross-account roles.

Backup policies managed in the management account create backup plans in the target accounts and OUs.

Use AWS Backup Audit Manager to monitor backup compliance in each account.

Centralize backup copies and AWS Backup Audit Manager reports across your organization in a central backup account.

Provide self-service capabilities to end users. They can create or update their backup configuration from a predefined catalog by using AWS Service Catalog.