Multi-account landing zone architecture
Separate accounts per environment, one org-wide audit trail, and archived logs.
AWSorganizationscloudtrailgovernanceaccounts
What is in it
Every resource, and what it costs.
Projections from August 2026 list prices for always-on resources. Connect an account and these become the figures your provider actually bills.
| Node | Type | What it is | Projected |
|---|---|---|---|
| Organization root | External | Management account | no direct cost |
| Production workloads ×3 | Compute | 3 × 0.25 vCPU · 0.5 GB | $27/mo |
| Staging workload | Compute | 0.25 vCPU · 0.5 GB | $9.01/mo |
| Org-wide trail | External | first mgmt-event copy free · S3 storage | from $2.00/mo |
| Log archive | Storage | 1 TB deep archive | from $1.00/mo |
Agent steps are priced from provider-reported token usage once the agent runs, not estimated. Guardrails cost nothing and are the reason a runaway agent cannot. 2 rows show from because those services bill by usage, so the total is a scenario at the stated volumes, not a quote.
Open Multi-account landing zone on the canvas.
It loads as an editable graph. Connect an account or instrument an agent and the projected figures above become measured ones.