AWS Landing Zone Rollout Playbook
A phased program to build a secure multi-account AWS landing zone: org design, identity and guardrails, network, and automated account vending. Delivers a self-service foundation teams land on safely.
AWS Landing Zone Rollout Playbook
A landing zone is the secure, governed foundation that every AWS workload lands on: multi-account structure, identity, network, logging, and guardrails, all defined as code. Building it first prevents the sprawl of ungoverned accounts that becomes impossible to retrofit. This program delivers a landing zone teams can self-serve into within a quarter.
Phase-by-Phase
Foundations and Org Design. Decide the account topology under AWS Organizations: separate management, security, logging, and shared-services accounts, plus organizational units for environments and business domains. Set naming and tagging standards now; renaming later is painful.
Identity and Guardrails. Centralize identity through IAM Identity Center federated to your IdP. Apply Service Control Policies as preventive guardrails, enable CloudTrail and Config across all accounts into a central logging account, and adopt least-privilege from day one.
Network and Connectivity. Build a hub-and-spoke transit network, segment environments so production is isolated from non-production, and establish hybrid links if on-prem coexistence is required.
Vending and Onboarding. Automate account vending so a team can request an account and receive a fully governed one without tickets. Publish self-service documentation and onboard a pilot team to validate the experience before opening it widely.
Team and Roles
A platform architect owns the design. DevOps engineers build the Terraform modules and vending pipeline. Security owns guardrails and identity. SRE owns logging and observability. Product owns the onboarding experience and adoption.
Risks and Mitigations
Over-engineering is the most common failure; start with a minimal viable landing zone and iterate. SCP lockout can brick the management account, so test policies in a sandbox OU first. Drift from baseline is caught with Config rules and periodic Terraform plan checks. Slow onboarding kills adoption; measure provisioning time and treat it as a product metric.
Success Criteria
Account provisioning drops from days to minutes, guardrails cover all accounts, the estate is audit-ready against your control framework, and teams provision and operate without platform-team tickets.
Tooling
Terraform defines everything as code, GitHub Actions runs the vending and policy pipelines, Vault manages cross-account secrets, S3 holds centralized logs, and Datadog provides cross-account observability.