Control Tower Landing Zone for AI Workloads - Bedrock + SageMaker Ready
Kriv AI · Cybersecurity & IT
Certification per AWS Marketplace.
Evidence tier Source Confirmed · 4 captures on record
What the publisher says
As described on AWS Marketplace.
**Generic AWS Control Tower landing zones are saturated on AWS Marketplace, Rackspace, Caylent, Slalom, SoftwareOne, BJSS, Storm Reply, Rebura, IO Connect, Copebit, Mission Cloud all sell them. None are AI-specific. Kriv AI deploys a Control Tower landing zone pre-configured for Amazon Bedrock + SageMaker + AgentCore from day one, with AI-specific Service Control Policies, PHI / PII data boundaries, token-spend cost guardrails, and industry-baseline Bedrock Guardrails already attached.**
Only two notable direct competitors exist on AWS Marketplace today. **Cortex Reply Landing Zone for AI** and **Version 1 AI Landing Zone (Public Sector / FS)** are direct peers, Public Sector / FS framed, not healthcare. Every other Control Tower listing is generic, zero mention Bedrock, SageMaker, AgentCore, AI-specific SCPs, or AI cost guardrails. AWS's Landing Zone Accelerator (LZA) is the free option most partners resell, ships without AI opinions. 100% of competitor listings hide pricing. Kriv publishes $75K / $125K / $175K transparently. **Amazon Bedrock AgentCore became HIPAA-eligible Feb 10, 2026**, unlocking multi-account redesign for healthcare.
Show the rest of the publisher’s description (6 more lines)
**Landing zone deployed.** Organizations: management + Security OU + Workload OU + Infrastructure OU + Sandbox OU; Control Tower mandatory + recommended guardrails. **9 AI-specific SCPs:** `DenyBedrockModelAccessWithoutApproval`, `DenyBedrockCrossRegionEgress`, `DenySageMakerTrainingDataEgress`, `DenyAgentCoreWithoutGuardrails`, `EnforceKMSForBedrockAndSageMaker`, `DenyPublicBedrockEndpoints`, `EnforceBedrockModelInvocationLogging`, `DenyUnencryptedModelRegistry`, `DenyCrossAccountModelSharingWithoutRAM`. PHI / PII data boundaries (Macie + Config block cross-OU transfer; EventBridge alerts). Cost guardrails (AWS Budgets per-account for Bedrock + SageMaker + AgentCore; EventBridge to FinOps). KMS baseline (CMKs per data classification; BYOK / CloudHSM; annual rotation). VPC + PrivateLink (endpoints for Bedrock, SageMaker, S3, Secrets Manager, KMS; no public egress; Transit Gateway; Network Firewall). Bedrock Guardrails organization baseline (healthcare / life sciences / FS variants; integrates N28). IAM Identity Center with AI-specific permission sets + SAML/OIDC. Audit logging (CloudTrail org trail + Bedrock Model Invocation Logging + AgentCore logs → S3 Object Lock 7-yr HIPAA; Audit Manager). AI-workload Config conformance pack. Detection stack (Security Hub + GuardDuty + Macie + Inspector org-level). Multi-region DR (active-passive Foundation/Standard; active-active Enterprise). Cross-account model registry (SageMaker Model Registry + RAM approval; Bedrock Knowledge Bases via VPC endpoints).
**Week-by-week.** W1 Scoping (footprint inventory; OU design; SCP scoping; HIPAA / SOC 2 / FedRAMP decision). W2 Control Tower + Security OU (Audit + Log Archive + Security Tooling; baseline CloudTrail + Config). W3 Workload OU + AI SCPs + KMS + VPC + Identity Center (all 9 SCPs deployed + tested; KMS baseline; PrivateLink; SAML/OIDC). W4 Audit + Detection + Conformance packs, Foundation closes (30-day warranty). W5 Standard: Data boundaries + Cost guardrails + Guardrails baseline + Model Registry (45-day warranty). W6 Enterprise: Multi-region active-active DR + sibling integration (N23 / N27 / N28) + Well-Architected GenAI + ML Lens review (60-day hypercare).
**Three tiers.** Foundation $75K (4 wk; single OU; single region; core 5 of 9 SCPs; 3–5 accounts; 30-day warranty) for AI-native Series B–E + Fortune 1000 first pilot. Standard $125K (5 wk; multi-OU; multi-region active-passive DR; all 9 SCPs; PHI/PII boundaries; cost guardrails; Bedrock Guardrails org baseline; 5–10 accounts; 45-day warranty) for mid-sized scaling AI + SOC 2 expansion. Enterprise $175K (6 wk; 10+ accounts; full AI-governance SCPs + Config conformance pack; industry-variant Guardrails baseline; active-active DR; GenAI + ML Lens review; 60-day hypercare) for regulated, G-SIB banks, top-25 payers + pharmas. Optional Extra Account $25K each.
**Important disclosures.** Kriv does NOT migrate existing workloads (separate). Does NOT operate landing zone post-deployment (unless Managed Service retainer). Issues no SOC 2 / HIPAA / HITRUST / ISO / FedRAMP certifications: external CPA firms, HITRUST EAOs, 3PAOs required. No legal / regulatory / compliance advice. AWS + Anthropic + Bedrock consumption separate. No regulator-outcome guarantee. No Control Tower / Organizations API stability guarantee. Anthropic CPN membership does not constitute endorsement.
**Get Started** EDP-eligible — landing zone engagement fees count toward your AWS Enterprise Discount Program commitment (up to 25%).
Contact info@kriv.ai to structure a private offer against your EDP or PPA.
Highlights
Highlighted by the publisher on AWS Marketplace.
First AI-specific Control Tower landing zone on AWS Marketplace with published pricing, 9 curated AI SCPs pre-deployed: DenyBedrockModelAccessWithoutApproval, DenyBedrockCrossRegionEgress, DenySageMakerTrainingDataEgress, DenyAgentCoreWithoutGuardrails, EnforceKMSForBedrockAndSageMaker, DenyPublicBedrockEndpoints, EnforceBedrockModelInvocationLogging, DenyUnencryptedModelRegistry, DenyCrossAccountModelSharingWithoutRAM. PHI/PII boundaries via Macie + Config at OU edge.
Bedrock Guardrails organization baseline + PrivateLink-only Bedrock + KMS-required + HIPAA-eligible region enforcement via SCPs + token-spend cost guardrails (per-account AWS Budgets + EventBridge alerts to FinOps). IAM Identity Center with AI-specific permission sets (MLOps, Data Scientist, AI Platform Engineer, AI Governance Officer, Compliance Officer, Auditor). CloudTrail org trail + Bedrock Model Invocation Logging + AgentCore logs → S3 Object Lock 7-year HIPAA retention.
AWS Select + Anthropic CPN: 4–6 weeks, $75K / $125K / $175K published-price tiers (100% of competitors hide pricing). Enterprise tier adds multi-region active-active DR + Well-Architected Generative AI + Machine Learning Lens review. Only 2 notable direct competitors globally (Cortex Reply + Version 1, Public Sector / FS framed, not healthcare). AWS AgentCore HIPAA eligibility (Feb 10 2026) drives multi-account redesign for healthcare Customers, Kriv plants the flag.
Agent build and provenance
See the full provenance
The layer-by-layer build, the evidence behind each claim, the risk basis and the cross-marketplace links are open to any account. Some rows are disclosed, some the source leaves Unknown; a free account shows you which.
Compliance
- FedRAMPConfirmedNot listed90%, registry-checkedNo FedRAMP Marketplace entry matched this vendor's domain, checked 2026-08-27registry recordas observed 2026-08-27
Confirmed means matched to a public authoritative registry. Claimed means the vendor or its listing states it, not yet cross-checked. A framework not shown was not found in any source we hold, which is not evidence against it. Not listed means a scoped registry check found no match for this vendor's domain: a No is a scoped registry check, not a compliance judgment. Confidence bands: 95% domain-verified, 90% registry-checked, 80% self-attested, 70% weak signal. Self-attested items marked “vendor's site” are gathered from the vendor's own website and are not verified by us.
Vendor
External enrichment · as of 2026-08-29
Sources
Publisher resources
3 linksLinked repositories
Unknown means this listing does not publish a repository. It is not a statement that the code is closed, and a linked repository is not a claim that the publisher wrote it: the registry computes that relationship privately and does not publish it.
Evidence risk is the share of the build you cannot see before you deploy, not a security rating. Sign in to see the layer-by-layer basis for this band.