AWS Landing Zone Setup Checklist
A foundation checklist for a multi-account AWS landing zone covering OU design, guardrails, centralized logging, networking, identity, and tagging. It emphasizes codifying everything before workloads arrive.
When to Use This Checklist
Use this checklist when establishing your first AWS environment at scale, or when retrofitting governance onto an account estate that grew organically. A landing zone is the secure, multi-account baseline that every future workload inherits, so getting it right before migration starts saves enormous rework.
This applies whether you build with AWS Control Tower, Landing Zone Accelerator, or hand-rolled Terraform.
How to Use This Checklist
Start with the account and OU design, because everything else hangs off it. Decide where security tooling, shared services, networking, and log archives live before you create workload accounts. Treat the guardrail items (SCPs, encryption defaults, GuardDuty) as required: they are far easier to apply to an empty estate than a populated one.
Codify every item as infrastructure as code so the landing zone is reproducible and reviewable. Finish by running one pilot account through the full vending process to prove the flow works.
What Good Looks Like
A good AWS landing zone has a clear OU hierarchy, least-privilege access via IAM Identity Center, and SCPs that block disallowed regions and risky actions. CloudTrail and Config flow into a locked-down log archive account, networking uses a planned IP space and transit gateway, and every resource is tagged to an owner and cost center. The whole thing is defined in code and a new account can be vended in minutes.
Common Pitfalls
The biggest pitfall is creating workload accounts before guardrails exist, which forces a painful retrofit. Another is a flat single-account design that mixes production and experimentation, making blast-radius control impossible. Skipping centralized logging leaves you blind during incidents, and inconsistent tagging makes cost allocation and FinOps impossible later. Finally, click-ops landing zones drift quickly; without IaC you cannot reproduce or audit them.
Related Resources
Anchor the design in the AWS Well-Architected Framework and the cloud landing-zone best practice. Use Terraform module design patterns to keep the codebase maintainable, and the cost-allocation and tagging practice to make FinOps work from day one.