Skip to main content
Documentation

Nuvibit Terraform Collection

Terraform / OpenTofu building blocks for AWS multi-account Landing Zones. Running in production at Swiss government agencies and regulated enterprises.

These pages cover how to deploy NTC, configure each module and upgrade between versions.

Quickstart Browse modules

01Modules by domain

Searchable catalog

Every module documents its usage example, inputs and outputs, and links to a public implementation blueprint.

Cloud Management

The organization, its accounts, access to them and the parameters they share.

Security

Central security tooling and the audit log archive.

Connectivity

IP address management, core network, VPCs, DNS and network firewalling.

Operations

Pipeline administration and centrally managed backup.

Templates

Predefined account baselines, lifecycle steps and guardrails to consume and adapt.

02Latest releases

All release notes
ntc-organizations2.4.0support delegating SECURITYHUB_POLICY, INSPECTOR_POLICY and GUARDDUTY_POLICY
ntc-identity-center2.2.1remove reserved concurrency of identity center encryption lambda
ntc-guardrail-templates2.5.0add aiservices opt-out policy templates
ntc-guardrail-templates2.4.1use partition-aware default for exclude_principal_arns
ntc-identity-center2.2.0add multi-region support for IAM Identity Center
ntc-security-tooling2.1.2allow RDS_DATA_RISK additional configuration for guardduty RDS_LOGIN_EVENTS
ntc-parameters2.0.3add lifecycle configuration to parameters bucket (Security Hub S3.13)
ntc-account-baseline-templates4.6.2add lifecycle rule to tfstate backend bucket

03Upgrade guides

All guides
NTC v1 to v2

Upgrade NTC modules to v2

AWS provider v6 with the region attribute, AWS European Sovereign Cloud compatibility and consolidated module calls. One guide per module.

Account baseline templates v4

TFState backend template v4

Regional state buckets per baseline region. Resources are re-keyed, so a state migration is required.

04Nuvibit whitepapers

Architecture Center
sovereigntyPractical Strategies for an AWS Multi-Partition Future
architectureNuvibit AWS Reference Architecture
devopsCI/CD Pipelines for Infrastructure-as-Code Delivery

05Frequently asked

All questions
What is the Nuvibit Terraform Collection (NTC)?

NTC is a modular collection of enterprise-grade Terraform and OpenTofu building blocks for setting up and operating a secure, scalable and compliant AWS Landing Zone. It covers network architecture, security hardening, compliance automation, and more.

Who is NTC designed for?

NTC is built for teams managing multi-account AWS environments: Platform Engineering, Cloud and DevOps, Security, and Enterprise Architecture. It is especially suited for regulated industries and the public sector.

What outcomes can I expect after adopting NTC?

A reproducible, version-controlled platform setup with defined standards, guardrails, and centralized security and audit log structures, consistently deployable across all accounts and environments.

Is NTC an all-or-nothing solution?

No. NTC is modular by design: building blocks can be adopted incrementally, combined freely, and extended as needed. You can start with a limited scope and expand over time.

What are the prerequisites for using NTC?

You need a valid NTC subscription, an AWS Management Account, and a CI/CD pipeline (e.g. Spacelift, GitHub Actions). After a one-time bootstrap of the Terraform state, NTC Organizations and NTC Parameters are typically the first building blocks you deploy, creating your AWS Organization, the OU structure and the central parameters bucket. From there, you incrementally add building blocks for identity, audit logging, security, and networking based on your target architecture. See the Quickstart Guide for step-by-step instructions.

Support

Stuck on a deployment or an upgrade?

Standard support is part of every NTC subscription. The support page lists the tiers, the channels and the response times.

Support optionsContact Nuvibit