Multi-account landing zone architecture
Separate accounts per environment, one org-wide audit trail, archived logs and a budget guardrail on top.
AWSorganizationscloudtrailgovernanceaccounts
What is in it
Every resource, and what it costs.
Projections from August 2026 list prices for always-on resources. Connect an account and these become the figures your provider actually bills.
| Node | Type | What it is | Projected |
|---|---|---|---|
| Organization root | External | Management account | no direct cost |
| Production workloads ×3 | Compute | 3 × 1 vCPU · 2 GB | $108/mo |
| Staging workload | Compute | 1 vCPU · 2 GB | $36/mo |
| Org-wide trail | External | first mgmt-event copy free · S3 storage | from $2.00/mo |
| Log archive | Storage | 1 TB deep archive | from $1.00/mo |
| Budget cap | Guardrail | Halts runs over $5000/mo | enforced at runtime |
Agent steps are priced from provider-reported token usage once the agent runs, not estimated. Guardrails cost nothing and are the reason a runaway agent cannot. 2 rows show from because those services bill by usage, so the total is a scenario at the stated volumes, not a quote.
Open Multi-account landing zone on the canvas.
It loads as an editable graph. Connect an account or instrument an agent and the projected figures above become measured ones.