// Generated by orrery. Edit the diagram spec and re-render instead of editing this file. import { type SVGProps, useId } from "react"; export default function HybridMultiRegionLandingZoneOnAWS(props: SVGProps) { const uid = useId().replace(/[^A-Za-z0-9_-]/g, ""); return ( Hybrid multi-Region landing zone on AWS Hybrid multi-Region landing zone on AWS. 24 components in 19 groups. Connections: Employees to Corporate identity provider (sign in); Corporate identity provider to AWS IAM Identity Center (SAML 2.0 and SCIM); Customer router to AWS Direct Connect (BGP); AWS Direct Connect to Direct Connect gateway (transit VIF); Direct Connect gateway to AWS Transit Gateway (association); Direct Connect gateway to AWS Transit Gateway (association); Customer router to AWS Site-to-Site VPN (IPsec); AWS Site-to-Site VPN to AWS Transit Gateway (VPN attachment); AWS Transit Gateway to AWS Transit Gateway (inter-Region peering); AWS Transit Gateway to AWS Network Firewall (inspection); AWS Transit Gateway to Amazon Route 53 VPC Resolver; AWS Transit Gateway to AWS Network Firewall (inspection); AWS Transit Gateway to VPC 10.1.0.0/16 (VPC attachment); AWS Transit Gateway to VPC 10.2.0.0/16 (VPC attachment); AWS Transit Gateway to VPC 10.9.0.0/16 (VPC attachment); Corporate DNS to Amazon Route 53 VPC Resolver (conditional forwarding); AWS Control Tower to AWS Organizations (applies controls); AWS Organizations to Security OU (SCPs); AWS Organizations to Infrastructure OU (SCPs); AWS Organizations to Workloads OU (SCPs); AWS Organizations to Security Tooling account (delegated administrator); AWS CloudTrail to Amazon Simple Storage Service (all accounts); AWS Config to Amazon Simple Storage Service (configuration snapshots); AWS CloudTrail to AWS Key Management Service (SSE-KMS); and more. HYBRID MULTI-REGION LANDING ZONE ON AWS Security, Infrastructure and Workloads OUs in AWS Organizations; Direct Connect with VPN backup into two Regions; central inspection, logging and threat detection SIGN IN SIGN IN SAML 2.0 AND SCIM SAML 2.0 AND SCIM BGP TRANSIT VIF ASSOCIATION ASSOCIATION IPSEC VPN ATTACHMENT INTER-REGION PEERING INSPECTION INSPECTION VPC ATTACHMENT VPC ATTACHMENT VPC ATTACHMENT CONDITIONAL FORWARDING APPLIES CONTROLS SCPS SCPS SCPS DELEGATED ADMINISTRATOR ALL ACCOUNTS CONFIGURATION SNAPSHOTS SSE-KMS FINDINGS CORPORATE DATA CENTER AWS CLOUD MANAGEMENT ACCOUNT SECURITY OU INFRASTRUCTURE OU WORKLOADS OU LOG ARCHIVE ACCOUNT SECURITY TOOLING ACCOUNT NETWORK ACCOUNT NON-PRODUCTION ACCOUNT PRODUCTION ACCOUNT US-EAST-1 US-WEST-2 US-EAST-1 US-EAST-1 US-WEST-2 VPC 10.9.0.0/16 VPC 10.1.0.0/16 VPC 10.2.0.0/16 EMPLOYEES CORPORATE IDENTITY PROVIDER Workforce directory CORPORATE DNS CUSTOMER ROUTER VPN customer gateway AWS DIRECT CONNECT Dedicated connection AWS SITE-TO-SITE VPN Over the internet AWS CONTROL TOWER Landing zone AWS ORGANIZATIONS SCPs on each OU AWS IAM IDENTITY CENTER Permission sets in every account AWS CLOUDTRAIL Organization trail AWS CONFIG Organization aggregator AMAZON GUARDDUTY Delegated administrator AWS SECURITY HUB Delegated administrator AWS KEY MANAGEMENT SERVICE Log encryption key AMAZON SIMPLE STORAGE SERVICE Log bucket, SSE-KMS, Object Lock DIRECT CONNECT GATEWAY Global resource AWS TRANSIT GATEWAY Peered with us-west-2 AWS NETWORK FIREWALL Inspection VPC AMAZON ROUTE 53 VPC RESOLVER Inbound and outbound endpoints AWS TRANSIT GATEWAY Peered with us-east-1 AWS NETWORK FIREWALL Inspection VPC AMAZON ECS App tier AMAZON ECS App tier AMAZON ELASTIC CONTAINER SERVICE Staging app tier NETWORK ATTACHMENT OR PEERING (BOTH WAYS) AWS DIRECT CONNECT, PRIMARY PATH AWS SITE-TO-SITE VPN, BACKUP PATH IDENTITY, POLICY, DNS, LOGS AND FINDINGS ); }