# aws-samples/aws-security-reference-architecture-examples architecture

> Architecture diagram of the GitHub repository aws-samples/aws-security-reference-architecture-examples, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aws-samples/aws-security-reference-architecture-examples
- Repository: https://github.com/aws-samples/aws-security-reference-architecture-examples

## Overview

AWS SRA Examples is a library of deployable security-service configurations for AWS Organizations, with or without Control Tower. The primary workflow is to select and deploy a solution through CloudFormation or Terraform; its Lambda custom-resource handler validates deployment inputs, coordinates organization/account/region setup, and configures the target AWS security service. The tree and README establish the solution breadth, while sampled source confirms several handler-to-service-module calls. Many solution internals and deployment templates were not sampled, so those branches are shown at solution level without inferred internal flows.

Main entry points: [`aws_sra_examples/solutions/macie/macie_org/lambda/src/common.py`](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/macie/macie_org/lambda/src/common.py) (Account and role helpers), [`aws_sra_examples/solutions/genai/bedrock_org/lambda/src/app.py`](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/src/app.py) (Bedrock organization), [`aws_sra_examples/solutions/config/config_org/lambda/src/app.py`](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/config/config_org/lambda/src/app.py) (AWS Config), [`aws_sra_examples/solutions/securityhub/securityhub_org/lambda/src/app.py`](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/securityhub/securityhub_org/lambda/src/app.py) (Security Hub)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_foundation["Organization foundation"]
  node_common["Common prerequisites<br/>[app.py]"]
  node_delegated["Delegated admin<br/>[app.py]"]
end

subgraph group_monitoring["Security monitoring"]
  node_config["AWS Config<br/>[app.py]"]
  node_cloudtrail["CloudTrail<br/>[app.py]"]
  node_securityhub["Security Hub<br/>[app.py]"]
  node_securitylake["Security Lake<br/>[app.py]"]
end

subgraph group_protection["Threat protection"]
  node_guardduty["GuardDuty<br/>[app.py]"]
  node_inspector["Inspector<br/>[app.py]"]
  node_macie["Macie<br/>[app.py]"]
  node_shield["Shield Advanced<br/>[app.py]"]
  node_firewall["Firewall Manager<br/>[app.py]"]
  node_patch["Patch management<br/>[app.py]"]
end

subgraph group_genai["GenAI safeguards"]
  node_bedrockorg["Bedrock organization<br/>[app.py]"]
  node_bedrockguard["Bedrock Guardrails<br/>[app.py]"]
  node_bedrockchecks["Bedrock compliance checks<br/>[app.py]"]
end

subgraph group_shared["Shared utilities"]
  node_orgcommon["Account and role helpers<br/>[common.py]"]
  node_bedrockresources["AWS resource helpers<br/>[sra_kms.py]"]
  node_bedrockresponse["Custom-resource response<br/>[cfnresponse.py]"]
end

node_operator(("Environment operator"))
node_organizations{{"Organizations environment"}}
node_deployment["CloudFormation / Terraform"]

node_operator -->|"prepares environment"| node_organizations
node_operator -->|"selects deployment"| node_deployment
node_deployment -->|"deploys prerequisites"| node_common
node_deployment -->|"deploys solution"| node_delegated
node_deployment -->|"deploys solution"| node_config
node_deployment -->|"deploys solution"| node_cloudtrail
node_deployment -->|"deploys solution"| node_securityhub
node_deployment -->|"deploys solution"| node_securitylake
node_deployment -->|"deploys solution"| node_guardduty
node_deployment -->|"deploys solution"| node_inspector
node_deployment -->|"deploys solution"| node_macie
node_deployment -->|"deploys solution"| node_shield
node_deployment -->|"deploys solution"| node_firewall
node_deployment -->|"deploys solution"| node_patch
node_deployment -->|"deploys solution"| node_bedrockorg
node_deployment -->|"deploys solution"| node_bedrockguard
node_config -->|"uses helpers"| node_orgcommon
node_securitylake -->|"uses helpers"| node_orgcommon
node_securityhub -->|"uses helpers"| node_orgcommon
node_guardduty -->|"uses helpers"| node_orgcommon
node_inspector -->|"uses helpers"| node_orgcommon
node_bedrockorg -->|"calls resource helpers"| node_bedrockresources
node_bedrockorg -->|"sends response"| node_bedrockresponse
node_bedrockorg -.->|"deploys checks"| node_bedrockchecks
node_bedrockguard -->|"sends response"| node_bedrockresponse

click node_common "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/common/common_prerequisites/lambda/src/app.py"
click node_delegated "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/common/common_register_delegated_administrator/lambda/src/app.py"
click node_config "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/config/config_org/lambda/src/app.py"
click node_cloudtrail "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/cloudtrail/cloudtrail_org/lambda/src/app.py"
click node_securityhub "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/securityhub/securityhub_org/lambda/src/app.py"
click node_securitylake "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/security_lake/security_lake_org/lambda/src/app.py"
click node_guardduty "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/guardduty/guardduty_org/lambda/src/app.py"
click node_inspector "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/inspector/inspector_org/lambda/src/app.py"
click node_macie "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/macie/macie_org/lambda/src/app.py"
click node_shield "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/shield_advanced/shield_advanced/lambda/src/app.py"
click node_firewall "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/firewall_manager/firewall_manager_org/lambda/src/app.py"
click node_patch "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/patch_mgmt/patch_mgmt_org/lambda/src/app.py"
click node_bedrockorg "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/src/app.py"
click node_bedrockguard "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_guardrails/lambda/src/app.py"
click node_orgcommon "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/macie/macie_org/lambda/src/common.py"
click node_bedrockresources "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/src/sra_kms.py"
click node_bedrockresponse "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/src/cfnresponse.py"
click node_bedrockchecks "https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/rules/sra_bedrock_check_kb_s3_bucket/app.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_common,node_delegated toneBlue
class node_config,node_cloudtrail,node_securityhub,node_securitylake toneAmber
class node_guardduty,node_inspector,node_macie,node_shield,node_firewall,node_patch toneMint
class node_bedrockorg,node_bedrockguard,node_bedrockchecks toneRose
class node_orgcommon,node_bedrockresources,node_bedrockresponse,node_operator,node_organizations,node_deployment toneIndigo
```

## Components

### Organization foundation

- [Common prerequisites](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/common/common_prerequisites/lambda/src/app.py): `aws_sra_examples/solutions/common/common_prerequisites/lambda/src/app.py`
- [Delegated admin](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/common/common_register_delegated_administrator/lambda/src/app.py): `aws_sra_examples/solutions/common/common_register_delegated_administrator/lambda/src/app.py`

### Security monitoring

- [AWS Config](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/config/config_org/lambda/src/app.py): `aws_sra_examples/solutions/config/config_org/lambda/src/app.py`
- [CloudTrail](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/cloudtrail/cloudtrail_org/lambda/src/app.py): `aws_sra_examples/solutions/cloudtrail/cloudtrail_org/lambda/src/app.py`
- [Security Hub](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/securityhub/securityhub_org/lambda/src/app.py): `aws_sra_examples/solutions/securityhub/securityhub_org/lambda/src/app.py`
- [Security Lake](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/security_lake/security_lake_org/lambda/src/app.py): `aws_sra_examples/solutions/security_lake/security_lake_org/lambda/src/app.py`

### Threat protection

- [GuardDuty](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/guardduty/guardduty_org/lambda/src/app.py): `aws_sra_examples/solutions/guardduty/guardduty_org/lambda/src/app.py`
- [Inspector](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/inspector/inspector_org/lambda/src/app.py): `aws_sra_examples/solutions/inspector/inspector_org/lambda/src/app.py`
- [Macie](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/macie/macie_org/lambda/src/app.py): `aws_sra_examples/solutions/macie/macie_org/lambda/src/app.py`
- [Shield Advanced](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/shield_advanced/shield_advanced/lambda/src/app.py): `aws_sra_examples/solutions/shield_advanced/shield_advanced/lambda/src/app.py`
- [Firewall Manager](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/firewall_manager/firewall_manager_org/lambda/src/app.py): `aws_sra_examples/solutions/firewall_manager/firewall_manager_org/lambda/src/app.py`
- [Patch management](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/patch_mgmt/patch_mgmt_org/lambda/src/app.py): `aws_sra_examples/solutions/patch_mgmt/patch_mgmt_org/lambda/src/app.py`

### GenAI safeguards

- [Bedrock organization](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/src/app.py): `aws_sra_examples/solutions/genai/bedrock_org/lambda/src/app.py`
- [Bedrock Guardrails](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_guardrails/lambda/src/app.py): `aws_sra_examples/solutions/genai/bedrock_guardrails/lambda/src/app.py`
- [Bedrock compliance checks](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/rules/sra_bedrock_check_kb_s3_bucket/app.py): `aws_sra_examples/solutions/genai/bedrock_org/lambda/rules/sra_bedrock_check_kb_s3_bucket/app.py`

### Shared utilities

- [Account and role helpers](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/macie/macie_org/lambda/src/common.py): `aws_sra_examples/solutions/macie/macie_org/lambda/src/common.py`
- [AWS resource helpers](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/src/sra_kms.py): `aws_sra_examples/solutions/genai/bedrock_org/lambda/src/sra_kms.py`
- [Custom-resource response](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/genai/bedrock_org/lambda/src/cfnresponse.py): `aws_sra_examples/solutions/genai/bedrock_org/lambda/src/cfnresponse.py`

### Other components

- **Environment operator**
- **Organizations environment**
- **CloudFormation / Terraform**

## Connections

- Environment operator → Organizations environment: prepares environment
- Environment operator → CloudFormation / Terraform: selects deployment
- CloudFormation / Terraform → Common prerequisites: deploys prerequisites
- CloudFormation / Terraform → Delegated admin: deploys solution
- CloudFormation / Terraform → AWS Config: deploys solution
- CloudFormation / Terraform → CloudTrail: deploys solution
- CloudFormation / Terraform → Security Hub: deploys solution
- CloudFormation / Terraform → Security Lake: deploys solution
- CloudFormation / Terraform → GuardDuty: deploys solution
- CloudFormation / Terraform → Inspector: deploys solution
- CloudFormation / Terraform → Macie: deploys solution
- CloudFormation / Terraform → Shield Advanced: deploys solution
- CloudFormation / Terraform → Firewall Manager: deploys solution
- CloudFormation / Terraform → Patch management: deploys solution
- CloudFormation / Terraform → Bedrock organization: deploys solution
- CloudFormation / Terraform → Bedrock Guardrails: deploys solution
- AWS Config → Account and role helpers: uses helpers (evidence: `aws_sra_examples/solutions/config/config_org/lambda/src/app.py`)
- Security Lake → Account and role helpers: uses helpers (evidence: `aws_sra_examples/solutions/security_lake/security_lake_org/lambda/src/app.py`)
- Security Hub → Account and role helpers: uses helpers (evidence: `aws_sra_examples/solutions/securityhub/securityhub_org/lambda/src/app.py`)
- GuardDuty → Account and role helpers: uses helpers (evidence: `aws_sra_examples/solutions/guardduty/guardduty_org/lambda/src/app.py`)
- Inspector → Account and role helpers: uses helpers (evidence: `aws_sra_examples/solutions/inspector/inspector_org/lambda/src/app.py`)
- Bedrock organization → AWS resource helpers: calls resource helpers (evidence: `aws_sra_examples/solutions/genai/bedrock_org/lambda/src/app.py`)
- Bedrock organization → Custom-resource response: sends response (evidence: `aws_sra_examples/solutions/genai/bedrock_org/lambda/src/app.py`)
- Bedrock organization → Bedrock compliance checks: deploys checks
- Bedrock Guardrails → Custom-resource response: sends response (evidence: `aws_sra_examples/solutions/genai/bedrock_guardrails/lambda/src/app.py`)