Module map
NTC is modular. Each module covers one capability of an AWS Landing Zone and is versioned on its own. This page shows what exists and in which order the pieces are usually rolled out.
Modules by domain
The collection is organized in five domains. The version next to each module is its latest release.
The organization, its accounts, access to them and the parameters they share.
Central security tooling and the audit log archive.
IP address management, core network, VPCs, DNS and network firewalling.
Pipeline administration and centrally managed backup.
Predefined account baselines, lifecycle steps and guardrails to consume and adapt.
Three of the domains hold the modules that create infrastructure: Cloud Management, Security and Connectivity. Operations covers the tooling around it: administration of the CI/CD platform and centrally managed backup. Templates are different in kind. They ship predefined content that other modules consume:
| Template module | Consumed by | Provides |
|---|---|---|
| NTC Guardrail Templates | NTC Organizations | Predefined organizational policies such as service control policies |
| NTC Account Baseline Templates | NTC Account Factory | Account baseline definitions, applied via account_baseline_scopes |
| NTC Account Lifecycle Templates | NTC Account Factory | Account lifecycle automation steps, applied via account_lifecycle_customization_steps |
Deployment order
A new Landing Zone starts in the organization management account and works outwards. The order below follows the Nuvibit AWS Reference Architecture. Every step links to the module documentation, and each module page links to a public implementation blueprint you can copy from.
- NTC Bootstrap is a one-time local apply that provisions the state bucket, its KMS key and the OIDC provider with the IAM role for CI/CD. See the implementation blueprint.
- NTC Organizations sets up AWS Organizations, the OU structure and the first guardrails. The Quickstart walks through this step.
- NTC Parameters creates the central parameters bucket in the management account, so every later module can share what it creates across accounts and pipelines.
- NTC Account Factory creates the core accounts (Log Archive, Security, Connectivity) and every account after them.
- NTC Identity Center provides single sign-on access with permission sets for users and groups.
- NTC Log Archive provisions the central buckets for audit logs. Once the CloudTrail archive exists, CloudTrail is enabled in NTC Organizations.
- NTC Security Tooling configures the central security services in the security account, after the admin delegations are set in NTC Organizations.
- Connectivity modules build the network: IPAM, core network, VPCs, DNS and network firewalling, combined to fit your architecture.
The order is a default, not a constraint. NTC can also be introduced into an existing AWS environment, one module at a time.
Where to go next
- The module catalog lists every module with a filter by name and domain.
- Versions, releases and upgrades explains how to pin and upgrade modules.
- The reference architecture explains the account structure these modules build.