A multi-framework AWS multi-account landing zone for a fictional B2B SaaS company (AcmeCorp), generated by Merlin Studio from a single intent spec and emitted in two infrastructure-as-code formats.
This repository is a reference example — it shows what Merlin produces when a SaaS platform has to satisfy four frameworks at once, including a PCI-DSS cardholder-data environment carved out of an otherwise ordinary SaaS estate.
Not a turnkey deployment. All real AWS identifiers are stubbed as
PLACEHOLDER_*tokens and all contact addresses use the reservedexample.comdomain. See each format'sPLACEHOLDERS.mdbefore attempting to deploy.
| Organization | AcmeCorp (fictional B2B SaaS, 51–200 employees) |
| Profile | standard (mid-size) |
| Compliance | SOC 2 · CIS · ISO 27001 · PCI-DSS |
| Home region | us-east-1 |
| Environments | 4 — Dev, Staging, Prod, Sandbox |
| Workloads | ECS · RDS · S3 · DynamoDB |
| Headline control | Dedicated, SCP-isolated PciWorkload account and VPC for the cardholder-data environment |
| Security scorecard | 97/100 (A+) — 268 checks passed, 1 warned, 0 failures |
Nine accounts across three OU branches: the mandatory four
(LogArchive, Audit, SharedServices, Network), one workload account per
environment (AppDev, AppStaging, AppProd, AppSandbox), and PciWorkload
isolated under Workloads/Prod/PCI.
The same intent compiles to two independent deployment paradigms. Pick the one that matches your stack — each folder is self-contained with its own README, deployment guide, scorecards, input assertions, and placeholder list.
| Format | Folder | What it is | Best for |
|---|---|---|---|
| LZA | LZA/ |
AWS Control Tower + Landing Zone Accelerator (declarative YAML) | Teams standardizing on AWS-native governance |
| OpenTofu | OpenTofu/ |
OpenTofu + Spacelift (HCL + per-stack YAML) | Teams standardized on Terraform/OpenTofu IaC |
Shared, format-neutral artifacts live at the repository root:
architecture.mmd— Mermaid topology diagramCOMPLIANCE_UPGRADES.md— every value a compliance framework forcedNETWORK_TOPOLOGY.md— VPCs, CIDRs, Transit Gateway, and egress layout
Four frameworks apply at once, and the strictest wins on every contested value:
- PCI-DSS — the cardholder-data environment gets its own account and VPC, segmented behind the Transit Gateway inspection path; Security Hub subscribes the PCI DSS v4.0.1 standard; the central log archive is WORM-protected with S3 Object Lock (COMPLIANCE mode) at a retention floor of 365 days (10.5.1).
- CIS — CIS AWS Foundations v3.0.0 in Security Hub, IMDSv2 enforced by SCP, EBS default encryption, org-wide CloudTrail with log-file validation.
- SOC 2 — centralized logging with long retention, org-wide Config, GuardDuty and Security Hub enabled across every account.
- ISO 27001 — AWS Foundational Security Best Practices v1.0.0.
COMPLIANCE_UPGRADES.md lists every field a framework overrode, with the citation
that forced it.
The wizard collects intent — company profile, frameworks, regions, environments, workloads — and compiles it to deployable artifacts. No AWS resource in this repository was hand-written; every file, including the scorecards and the deployment guides, is generator output from one spec.
Try it at app.merlin-studio.cloud.