AWS Control Tower Landing Zone Architecture

 AWS Secure Landing Zone Architecture : 

Org Management account: 

Org Management account is primarily used to manage resource configuration drift for the
foundational privacy controls across all of the accounts in the organisation, which is managed by AWS Organisation service. 

Security Tooling account :

Security Tooling account is dedicated to operating security and privacy foundational services,monitoring AWS accounts, and automating security and privacy alerting and response.

Log Archive account: 

Log Archive account is where we centralise infrastructure, service, and application log types.
With a dedicated account for logs, we can apply consistent alerting across all log types and to confirm that incident respondents can access an aggregate of these logs from one place.

Network account :

In the Network account, we can manage the networking between virtual private clouds (VPCs)and the broader internet/ on-prem. we can also implement control mechanism by using AWS WAF, use AWS Resource Access Manager (AWS RAM) to share VPC subnets and AWS
Transit Gateway attachments.

Application account:

Application account is where  organisations hosts services that collect and process  data.