AWS multi-account landing zone architecture with AWS Organizations for account governance, Transit Gateway for centralized networking, shared services VPC with Directory Service, centralized logging account with CloudTrail and Config aggregation, security account with GuardDuty and Security Hub, and workload accounts with isolated VPCs. Includes SSO for federated access and Service Control Policies for guardrails. Fork this diagram on Diagrams.so to customize the account structure or add additional organizational units for your enterprise landing zone. Source: https://aws.amazon.com/architecture/