AWS Reference¶

What this page holds

Look-up facts for AWS multi-account and network design: global footprint, tooling versions, AWS Organizations policy types and quotas, Control Tower landing zone facts, network quotas, list prices, HA/DR figures, 2025-2026 service lifecycle changes, service names, and security/compliance tables. Why things work this way is in Explanation. Commands are in How-to Guides.

Prices and quotas move

Prices below are US East (N. Virginia) list prices checked in September 2026. Other Regions differ. Always confirm on the linked AWS pricing page or in the Service Quotas console before you size a design.

Global Footprint¶

Item	Value (as of 2026-06)	Source
Launched Regions	39	AWS Regions and AZs
Availability Zones	123 (minimum 3 AZs per Region)	same
Local Zones / Wavelength Zones	43 / 33	same
CloudFront	750+ PoPs, 15 Regional edge caches	same
Announced Regions	Saudi Arabia (targeted for December 2026), Chile (targeted for end of 2026)	About Amazon, Business Wire
AWS European Sovereign Cloud	GA 2026-01-15 in Brandenburg, Germany. It is a separate partition, run by an EU-resident German entity, with about 90 services at launch	Amazon press release

Partitions

aws (commercial), aws-cn (China), aws-us-gov (GovCloud) and the European Sovereign Cloud partition are separate. IAM principals, Organizations, and most cross-account features do not span partitions.

Tooling Versions (September 2026)¶

Tool	Latest version	Date	Notes
AWS CLI v2	2.37.3	September 2026	CHANGELOG. Release date is not in the changelog
AWS CLI v1	1.46.1	2026-08-27	Maintenance mode since 2026-07-15 (critical and security fixes only). End of support 2027-07-15 (AWS Developer Tools Blog)
Terraform provider `hashicorp/aws`	6.66.0	2026-09-21	CHANGELOG. Minor releases are roughly weekly
AWS CDK (`aws-cdk-lib`)	2.270.0	2026-09-17	npm / PyPI
Control Tower landing zone	4.0	2025-11-17	See Control Tower Facts
Landing Zone Accelerator on AWS (LZA)	1.15.5	2026-06-02	CHANGELOG. 1.14.0 (2025-11-24) added Control Tower 4.0 support
Account Factory for Terraform (AFT)	1.22.0	TBD (the `VERSION` file carries no date)	aws-ia/terraform-aws-control_tower_account_factory

AWS Organizations Policy Types¶

Organizations has two policy families. Authorization policies (SCP, RCP) cap what IAM can allow. Management policies set or enforce configuration. The API policy-type identifiers come from the ListPolicies API reference.

Policy type	API identifier	Family	What it controls
Service control policy	`SERVICE_CONTROL_POLICY`	Authorization	Maximum permissions for IAM principals (users, roles) in member accounts
Resource control policy	`RESOURCE_CONTROL_POLICY`	Authorization	Maximum permissions on resources in member accounts, whoever the caller is (including external principals)
Declarative policy for EC2 ("EC2 policies")	`DECLARATIVE_POLICY_EC2`	Management	Enforced service configuration for EC2, VPC, and EBS. It holds even when new APIs launch
Tag policy	`TAG_POLICY`	Management	Standard tag keys and values
Backup policy	`BACKUP_POLICY`	Management	AWS Backup plans deployed org-wide
AI services opt-out policy	`AISERVICES_OPT_OUT_POLICY`	Management	Opt out of AI service content use for service improvement
Chat applications policy	`CHATBOT_POLICY`	Management	Amazon Q Developer in chat applications (formerly AWS Chatbot) access
Security Hub policy	`SECURITYHUB_POLICY`	Management	Central Security Hub configuration
Inspector policy	`INSPECTOR_POLICY`	Management	Central Amazon Inspector enablement
Upgrade rollout policy	`UPGRADE_ROLLOUT_POLICY`	Management	Staggers automatic minor-version upgrades (first, second, last) across accounts. Aurora and RDS since 2025-11
Bedrock policy	`BEDROCK_POLICY`	Management	Applies Amazon Bedrock Guardrails to all inference calls
S3 policy	`S3_POLICY`	Management	Account-level S3 Block Public Access
Network security director policy	`NETWORK_SECURITY_DIRECTOR_POLICY`	Management	AWS Shield network security director configuration

SCP vs RCP vs Declarative Policy¶

Attribute	SCP	RCP	Declarative (EC2) policy
Launched	2017	2024-11-13	2024-12-01
Applies to	IAM principals in member accounts	Resources in member accounts	Service configuration (account attributes)
Grants permissions	No, filter only	No, filter only	n/a, sets configuration
Affects the management account	No	No	No
Affects service-linked roles	No	No	n/a
Blocks external principals	No (only your principals)	Yes	n/a (blocks the configuration itself)
Survives new service APIs	Only if written with wildcards	Only if written with wildcards	Yes, by design
Supported services	All IAM-integrated services	Subset (see below)	EC2, VPC, EBS
Language	Full IAM policy language since 2025-09-19 (conditions, resource ARNs, `NotResource`, `NotAction` with Allow)	IAM policy language, Deny-only	JSON with `@@assign` operators under `ec2_attributes`

Sources: RCP launch, declarative policies launch, SCP full IAM language.

RCP Service Coverage¶

Date	Services added
2024-11-13 (launch)	Amazon S3, AWS STS, AWS KMS, Amazon SQS, AWS Secrets Manager
2025-06	Amazon ECR, Amazon OpenSearch Serverless (What's New)
2026-01	Amazon Cognito, Amazon CloudWatch Logs (What's New)
2026 (later)	More services, including DynamoDB. Third-party summaries count "more than two dozen" by mid-2026. Unverified. Check the RCP page for the current list

EC2 Declarative Policy Attributes¶

Attribute key (under `ec2_attributes`)	Enforces
`vpc_block_public_access`	VPC Block Public Access (block IGW ingress, or ingress and egress, with optional exclusions)
`serial_console_access`	EC2 serial console enabled or disabled
`image_block_public_access`	Blocks new public sharing of AMIs (`block_new_sharing`). Existing public AMIs stay public
`snapshot_block_public_access`	Blocks public sharing of EBS snapshots
`instance_metadata_defaults`	Account default IMDS settings (for example IMDSv2 required)
`allowed_images_settings`	Allowed AMI providers for launches
`exception_message`	Custom error message returned to blocked callers

Syntax: EC2 policy syntax and examples. The last three attributes come from the launch announcement and the Control Tower control catalog. Confirm exact key names against the syntax page before use.

Organizations Quotas¶

Quota	Value	Notes
SCPs attached per node (root, OU, account)	10	Raised from 5 in May 2026 (What's New)
Maximum SCP document size	10,240 characters	Raised from 5,120 in May 2026 (same source)
OU nesting depth under the root	5 levels	Organizations quotas
Roots per organization	1	same
RCP attachment and size quotas	TBD	Not re-verified for this refresh. See the quotas page

The FullAWSAccess SCP counts

The default FullAWSAccess SCP (and RCPFullAWSAccess for RCPs) is attached to every node. It uses one of the attachment slots unless you replace it with your own allow-list policy.

Control Tower Facts¶

Fact	Value
Price	No extra charge. You pay for the underlying services (Config, CloudTrail, Service Catalog, and others) (pricing)
Current landing zone version	4.0, announced 2025-11-17
Upgrade path	Landing zones on 3.1 or later can stay put or move to 4.0 during an Update or Reset (v4.0 migration guide)
Control behaviors	Preventive (SCP, RCP, declarative policy), detective (AWS Config rules), proactive (CloudFormation Hooks)
RCP-based managed controls	Since 2024-11-15 (What's New)
Account provisioning options	Account Factory (Service Catalog), Account Factory for Terraform (AFT), Customizations for Control Tower (CfCT), APIs

Landing Zone 4.0 Changes¶

Change	Detail
Optional integrations	AWS Config, AWS CloudTrail, SecurityRoles, and AWS Backup can each be turned on separately
Dedicated resources	Separate resources for Config and CloudTrail instead of shared ones
No mandatory OU layout	The fixed Security OU requirement is gone. You define your own structure
Optional manifest	A "controls-only" landing zone can just integrate with Organizations and enable controls
`ConfigBaseline`	Detective controls without the full `AWSControlTowerBaseline`
Config aggregation	A service-linked Config aggregator replaces the organization and account aggregators
Catalog growth	279 more AWS Config-based controls in the Control Catalog

Source: Key changes in landing zone 4.0.

Network Quotas¶

Transit Gateway¶

Quota	Default	Adjustable
Transit gateways per account (per Region)	5	Yes
Attachments per transit gateway	5,000	No
Transit gateways per VPC	5	No
Route tables per transit gateway	20	Yes
Static routes per transit gateway	10,000	Yes
Peering attachments per transit gateway	50	Yes
Bandwidth per VPC attachment	Up to 100 Gbps per Availability Zone (was 50 Gbps per attachment)	No
Packets per second per attachment	Up to 5,000,000	No
Bandwidth per Site-to-Site VPN tunnel	Up to 1.25 Gbps	No
Bandwidth per Connect peer (GRE)	Up to 5 Gbps	No

Source: Transit Gateway quotas. The 100 Gbps per-AZ figure is from the current quotas page. The archived GitHub copy of the guide still says 50 Gbps.

Connectivity Comparison Matrix¶

Criteria	Transit Gateway	Cloud WAN	VPC Peering	PrivateLink	VPC Lattice
Topology	Regional hub-and-spoke	Global, policy-defined segments	Point-to-point	Service-oriented (one-way)	Application service network
Scope	One Region (peer TGWs for multi-Region)	Multi-Region core network	Same or cross-Region	Same or cross-Region	Same Region, cross-account via RAM
Transitive routing	Yes (route tables)	Yes (segments)	No	No	n/a (L4/L7 proxy)
Overlapping CIDRs	No	No	No	Yes	Yes
Scale	5,000 attachments	See Cloud WAN quotas	O(n^2) links for full mesh	Per-service endpoints	Per service network
Bandwidth	100 Gbps per VPC attachment per AZ	See Cloud WAN quotas	No aggregate limit	NLB/ENI throughput	TBD
Data processing cost	$0.02/GB	$0.02/GB	$0 (standard data transfer only)	$0.01/GB (first PB)	$0.025/GB (services)
Best for	Enterprise multi-VPC in one or a few Regions	Global WAN, segmentation as code	2-4 VPCs, high volume	Exposing one service	Service-to-service across accounts

Pricing (us-east-1, September 2026)¶

Item	Price	Source
Transit Gateway attachment	$0.05 per attachment-hour (VPC, VPN, DX gateway)	TGW pricing
Transit Gateway data processing	$0.02/GB sent into the TGW	same
Cloud WAN core network edge	$0.50 per hour	Cloud WAN pricing
Cloud WAN attachment	Hourly, varies by Region	same
Cloud WAN data processing	$0.02/GB (none on Cloud WAN to TGW peering traffic)	same
PrivateLink interface endpoint	$0.01 per endpoint per AZ-hour	PrivateLink pricing
PrivateLink data processing	$0.01/GB first 1 PB, $0.006/GB next 4 PB, $0.004/GB above 5 PB	same
Gateway endpoint (S3, DynamoDB)	Free	same
VPC Lattice service	$0.025 per service-hour, $0.025/GB, $0.10 per 1M requests above 300,000 per hour	VPC Lattice pricing (hourly price quoted for US East (Ohio))
VPC Lattice resource access	From $0.01/GB	same
NAT gateway (zonal)	$0.045 per hour + $0.045/GB processed	VPC pricing
NAT gateway (regional, since 2025-11)	$0.045 per hour for each active AZ + $0.045/GB	same
Public IPv4 address	$0.005 per IP-hour (about $3.65/month), since 2024-02-01	AWS News Blog
AWS Network Firewall	$0.395 per endpoint-hour + $0.065/GB processed	Network Firewall pricing
AWS Shield Advanced	$3,000/month per organization, 1-year commitment, plus data transfer out fees	Shield pricing
KMS customer managed key	$1/month per key	KMS pricing
Control Tower, Organizations, IAM, IAM Identity Center	No extra charge	vendor pricing pages

HA and DR Figures¶

Service	Figure	Source
RDS Multi-AZ DB instance failover	Typically 60-120 s	RDS Multi-AZ failover
Aurora in-Region failover	Typically under 35 s	Aurora high availability
Aurora cluster read replicas	Up to 15	same
Aurora Global Database	Replication lag typically under 1 s. Cross-Region recovery in under 1 minute	Aurora Global Database
DynamoDB global tables (multi-Region eventual consistency)	Asynchronous. Last-writer-wins. RPO is the replication lag	Global tables
DynamoDB global tables (multi-Region strong consistency)	RPO 0. GA 2025-06-30 in 10 Regions	What's New
S3 Standard durability design	Data stored across at least 3 AZs (not One Zone-IA or Express One Zone)	S3 docs

DR Strategy Summary¶

The RPO/RTO/cost table for Backup & Restore, Pilot Light, Warm Standby, and Active-Active lives in Explanation, next to the reasoning behind each strategy.

Service Lifecycle Changes (2025-2026)¶

AWS publishes these on the AWS Lifecycle Changes page. The table covers services that matter for landing zone, network, and platform designs.

Service or feature	Change	Date	Replacement or note
AWS App Mesh	End of support. Console and resources become inaccessible	2026-09-30	Amazon ECS Service Connect, VPC Lattice, or Istio on EKS
AWS Proton	End of support	2026-10-07	CloudFormation, CDK, Terraform, Service Catalog
Amazon Pinpoint	End of support (closed to new customers 2025-05-20)	2026-10-30	AWS End User Messaging (SMS, voice, push), Amazon Connect
AWS CLI v1	Maintenance mode, then end of support	2026-07-15 / 2027-07-15	AWS CLI v2
AWS App Runner	Maintenance (closed to new customers)	2026-04-30	Amazon ECS Express Mode (launched 2025-11)
AWS Audit Manager	Maintenance (closed to new customers)	2026-04-30	See the availability-change page
AWS CloudTrail Lake	Closed to new customers	2026-05-31	See the availability-change page. Organization trails to S3 are unaffected
Application Recovery Controller readiness check	Maintenance	2026-04-30	Other ARC features are unaffected
Amazon Timestream for LiveAnalytics	Closed to new customers	2025-06-20	Timestream for InfluxDB
AWS Security Hub	Renamed Security Hub CSPM. A new, separate AWS Security Hub went GA	2025-12-02	Both exist. CSPM keeps the standards and ASFF. The new Security Hub correlates findings in OCSF

Sources: Service availability update, March 2026, CloudTrail Lake availability change, Audit Manager availability change, App Mesh user guide, Pinpoint end of support, Security Hub GA. The App Runner migration target is from Migrating from AWS App Runner to Amazon ECS Express Mode and the InfoQ report.

Service Naming Quick Reference¶

Concept	AWS Service	Abbreviation
Virtual Network	Virtual Private Cloud	VPC
Subnet	Subnet	Subnet
Load Balancer (L7)	Application Load Balancer	ALB
Load Balancer (L4)	Network Load Balancer	NLB
Load Balancer (Appliance)	Gateway Load Balancer	GWLB
NAT	NAT Gateway (zonal or regional)	NAT GW
Firewall (L3-L7, managed)	AWS Network Firewall	NFW
WAF	AWS WAF	WAF
DDoS Protection	AWS Shield	Shield
Centralized Firewall Mgmt	AWS Firewall Manager	FMS
DNS Firewall	Route 53 Resolver DNS Firewall	DNS FW
Transit Hub	AWS Transit Gateway	TGW
Global WAN	AWS Cloud WAN	Cloud WAN
App-layer service network	Amazon VPC Lattice	Lattice
Dedicated Line	AWS Direct Connect	DX
VPN	AWS Site-to-Site VPN	VPN
DNS	Amazon Route 53	R53
Anycast Acceleration	AWS Global Accelerator	GA
CDN	Amazon CloudFront	CF
Multi-account management	AWS Organizations	Orgs
Governance / Landing Zone	AWS Control Tower	CT
IAM / SSO	IAM Identity Center	IDC
Resource sharing	AWS Resource Access Manager	RAM
IaC (native)	AWS CloudFormation / AWS CDK	CFN / CDK
Object Storage	Amazon S3	S3
Relational DB (managed)	Amazon RDS	RDS
Cloud-native DB (MySQL/PG)	Amazon Aurora	Aurora
NoSQL (key-value)	Amazon DynamoDB	DDB
In-memory Cache	Amazon ElastiCache (Valkey, Redis OSS, Memcached)	ElastiCache
Data Replication	AWS Database Migration Service	DMS
Audit trail	AWS CloudTrail	CloudTrail (not "CT", which usually means Control Tower)
Compliance	AWS Config	Config
Security posture	AWS Security Hub CSPM	SH CSPM
Unified security findings	AWS Security Hub	SH
Threat Detection	Amazon GuardDuty	GD
Key Management	AWS KMS	KMS
Container Registry	Amazon ECR	ECR
Managed Kubernetes	Amazon EKS	EKS
Managed Containers	Amazon ECS + Fargate	ECS
Serverless Compute	AWS Lambda	Lambda
Backup	AWS Backup	Backup
Elastic DR	AWS Elastic Disaster Recovery	DRS

Identity and Data Protection Tables¶

IAM Identity Center Features¶

Feature	Detail
Permission Sets	Named collections of IAM policies. Assigned to users or groups per account. They become IAM roles (`AWSReservedSSO_*`) in each account
External IdP	SAML 2.0 federation with Okta, Microsoft Entra ID, Google Workspace, Ping Identity, and others
Automatic provisioning	SCIM 2.0 user and group sync from the external IdP
MFA	Built-in MFA, or delegated to the external IdP
Session duration	Configurable per permission set (1-12 hours)
Multi-Region replication	GA 2026-02-03 for organization instances with an external IdP. Needs a multi-Region KMS key. Extended to the Identity Center directory in 2026-07 (What's New)
Former name	AWS Single Sign-On (renamed 2022). CLI namespaces are still `sso`, `sso-admin`, `identitystore`

KMS Key Types¶

Key Type	Description
AWS managed key	Created and rotated automatically by the AWS service (yearly). No monthly fee
Customer managed key	Created by you. Configurable automatic rotation (90-2,560 days), key policy, and grants. $1/month per key
Custom key store (CloudHSM)	Customer managed keys backed by your AWS CloudHSM cluster (FIPS-validated HSMs)
External key store (XKS)	Customer managed keys backed by your own HSM outside AWS
Multi-Region keys	Related keys with the same key material in several Regions. IAM Identity Center multi-Region needs one

S3 Encryption Modes¶

Mode	Key Management	Use Case
SSE-S3	AWS-managed, automatic	Default for all new objects since 2023-01-05
SSE-KMS	KMS key (AWS managed or customer managed)	Key-use audit in CloudTrail, cross-account key control
DSSE-KMS	Two layers of KMS encryption	Compliance regimes that require dual-layer encryption
SSE-C	Customer-provided key per request	Full key control. AWS does not store the key
Client-side	Encrypt before upload	End-to-end encryption. AWS never sees plaintext

Compliance Programs¶

AWS holds certifications and attestations including the following. The current list is on the AWS Compliance Programs page. Reports are in AWS Artifact.

SOC 1/2/3 (audit controls)
ISO 27001, 27017, 27018 (information security)
PCI DSS Level 1 (payment card data)
FedRAMP High (US government, GovCloud; Moderate/High varies by Region and service)
HIPAA (healthcare, needs a BAA)
GDPR (EU data protection, via the AWS GDPR DPA)
C5 (Germany, cloud computing compliance)
IRAP (Australia, government security)
MTCS Level 3 (Singapore, multi-tier cloud security)

Landing Zone Baseline Checklist¶

A look-up checklist of the controls most landing zone designs apply. The reasons are in Explanation. The commands are in How-to Guides.