# Building a Custom Multi-Account Landing Zone on AWS China How to engineer a compliant, automated AWS environment in regions lacking Control Tower support. - **Source:** [Hacker News: Show HN](https://news.ycombinator.com) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/20a031ed-44ce-479c-963a-a30d75cab8c1 ## The Control Tower Gap AWS Control Tower is currently unavailable in China regions, leaving teams without managed landing zones. Builders must manually construct account factories, compliance dashboards, and guardrails. This project documents a custom-built, multi-account architecture using Organizations, IAM Identity Center, and StackSets to replicate global-standard governance in the Beijing and Ningxia partitions. ## Core Infrastructure Primitives The build relies on native primitives that matured in China after 2023. AWS Organizations handles account creation, while StackSets enable service-managed auto-deployment across organizational units. IAM Identity Center provides unified identity management, and Service Control Policies enforce root-level guardrails. These tools replace legacy workarounds, providing a stable foundation for production workloads. ## Target Architecture Design The architecture features four accounts across three organizational units: Management, Security, and Workloads. The management account is restricted to billing and organization tasks. The Security OU hosts a log-archive account for audit aggregation, while the Workloads OU houses demo-dev and demo-prod environments, ensuring strict separation of duties and operational visibility. ## Identity and Access Matrix Identity is managed via IAM Identity Center with groups provisioned per product. Permission sets range from PowerUserAccess for DevOps to restricted SecurityRemediator roles for auditors. While the portal experience mirrors global AWS, the lack of multi-region replication requires a robust break-glass strategy to prevent total lockout during potential regional outages. ## Automated Account Vending A new product team is vended using a single YAML file and Terraform apply. Account creation takes 12 seconds, with full team provisioning completed in 45 seconds. This pipeline automates group creation and permission assignments, significantly reducing manual overhead compared to traditional methods, though it requires specific retry logic for IAM propagation. ## Managing Account Quotas A critical constraint in the China partition is the default account quota, which limits fresh organizations to only two accounts. Exceeding this requires a support ticket, as no self-service path exists in the console. Multi-account programs must prioritize this request on day one to avoid blocking deployment pipelines during initial scaling phases. ## Guardrails and Trail Policies Three primary SCPs enforce governance: preventing account removal, restricting regions, and protecting audit trails. CloudTrail configuration requires specific bucket policy prefixes, including the management account ID, to function correctly in China. These policies ensure that logs are aggregated centrally and remain immutable, satisfying core compliance requirements for production-grade cloud environments. ## Config Bootstrap Challenges Config recording requires a specific bootstrap sequence: creating the role, defining the delivery channel, and starting the recorder. Failure to include the delivery channel or using incorrect principal conditions leads to immediate exceptions. The working recipe involves sequential retries, ensuring all accounts are recording within three minutes of their initial creation. ## Security Hub Integration Security Hub in China requires a delegated administrator account, which must be a member account rather than the management root. Existing accounts must be explicitly added via CreateMembers to be visible. Furthermore, FSBP controls remain in an incomplete state until a Config recorder is active, necessitating a strict deployment sequence. ## Closed Compliance Loop The system validates compliance through a four-step loop: violation, detection, remediation, and verification. An engineer creates a public S3 bucket, which is immediately flagged by Security Hub. An auditor uses a scoped SecurityRemediator role to block public access, and Config confirms the recovery, providing a fully auditable and automated security workflow. ## Lessons in Infrastructure Drift Building a thin, manual landing zone allows for granular measurement of every layer. Unlike managed services, this approach requires the team to own deployment, upgrades, and drift detection. By treating the baseline repository as load-bearing infrastructure, builders can anticipate failure modes that Control Tower would otherwise abstract away from the end user. ## Strategic Value of Baselines This custom implementation proves that production-ready governance is achievable in China despite the absence of native managed services. By automating the compliance loop and account vending, teams gain the agility of global AWS environments. Success depends on understanding partition-specific nuances and building resilient, self-healing infrastructure that survives the absence of Control Tower. ## Sources covering this story - https://builder.aws.com/content/3LMdNqdrR6M68oYPRvKa5A1UmTC/aws-china-landing-zone-in-practice-a-control-tower-clone-and-a-multi-account-compliance-baseline — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._