Cloud Landing Zone

Best Practice: Cloud Landing Zone

A landing zone is a well-architected, multi-account cloud environment that is set up before any workloads arrive. It establishes the foundational guardrails: identity and access management, account structure, network topology, logging, and security baselines. The goal is to give teams a safe, consistent place to land applications so that every new account inherits the same governance instead of being configured by hand. This matters because ad hoc cloud accounts are the leading source of misconfiguration, security gaps, and unmanageable sprawl. A landing zone makes the secure path the default path.

Step-by-Step Implementation Guidance

1. Define an account structure. Separate production, non-production, security, and shared-services accounts.
2. Centralize identity. Use single sign-on and federated roles instead of per-account users.
3. Establish network design. Define VPCs, connectivity, and segmentation with a hub-and-spoke or equivalent topology.
4. Apply guardrails. Use service control policies and config rules to prevent disallowed actions automatically.
5. Centralize logging and audit. Aggregate logs and findings into a dedicated security account.
6. Codify everything as infrastructure as code so the landing zone is reproducible and version-controlled.
7. Provide a vending mechanism so teams request new compliant accounts on demand.

Common Mistakes Teams Make When Ignoring This Practice

• Letting teams create cloud accounts manually with no shared baseline.
• Using long-lived root or admin credentials instead of federated identity.
• Bolting on security and logging after workloads are already live.
• Treating the landing zone as a one-time setup rather than a maintained product.
• Hardcoding configuration instead of managing it as code.

Tools and Techniques That Support This Practice

• AWS Control Tower and AWS Organizations for account vending and guardrails.
• Azure Landing Zones and Microsoft Cloud Adoption Framework.
• Google Cloud Foundation Toolkit.
• Terraform and CloudFormation for infrastructure as code.

How This Practice Applies to Different Migration Types

• Cloud Migration: The landing zone is the destination; build it before migrating any workload.
• Database Migration: Place managed databases inside governed accounts with enforced network isolation.
• SaaS Migration: Use the identity foundation to integrate SaaS with single sign-on and central audit.
• Codebase Migration: New cloud-native services deploy into pre-approved, compliant accounts.

Checklist

• Define a multi-account structure separating environments.
• Centralize identity with single sign-on and federated roles.
• Establish baseline network topology and segmentation.
• Apply automated guardrails via policies and config rules.
• Aggregate logs and security findings centrally.
• Codify the entire landing zone as infrastructure as code.
• Provide an automated, compliant account vending process.