# AWS landing zone

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Build & ship area: Config, lint, releases, IaC.

Page: https://gradus.kazet.blog/tree/cloud-application/step/aws-landing-zone

Commit to AWS: an account per environment, ECR, ECS Express Mode or ECS on Fargate and a remote Terraform state bucket, with OIDC roles so CI deploys without access keys. Pick this or the GCP landing zone, not both.

One option of Cloud provider: AWS. The others: Google Cloud.

Usually comes after: [Infrastructure as code](https://gradus.kazet.blog/tree/cloud-application/step/infrastructure-as-code).

## Prompt for your AI assistant

```
Set up an AWS landing zone for this project in the existing infrastructure code: one account per environment under an organization, an ECR repository for the container image, an ECS Express Mode service or an ECS on Fargate service for it, an S3 bucket with DynamoDB locking as the remote Terraform state backend and an OIDC identity provider with a deploy role so the CI workflow deploys with a short-lived token instead of access keys. Point the first deploy at this service.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt