Landing Zone
Architecture & DesignA Landing Zone is a well-architected, multi-account AWS environment that serves as the starting point for deploying workloads. It establishes the foundational security, networking, and governance controls.
Core Components
- Account Structure: OUs for Security, Infrastructure, Workloads, Sandbox
- Identity: centralized access via IAM Identity Center, federated from corporate IdP
- Networking: hub-and-spoke VPC architecture with Transit Gateway, shared services
- Logging: centralized CloudTrail, Config, VPC Flow Logs in a dedicated Log Archive account
- Security: GuardDuty, Security Hub, IAM Access Analyzer enabled in all accounts
- Guardrails: SCPs, Config Rules, and preventive controls
Implementation Options
- AWS Control Tower: managed landing zone setup with Account Factory
- Custom: Terraform/CDK-based landing zone for more control
- AWS Landing Zone Solution: legacy AWS-provided solution (superseded by Control Tower)
Related Terms
A managed service that automates the setup and governance of a secure, multi-account AWS environment based on AWS best practices (landing zone).
Using multiple AWS accounts to isolate workloads, environments, and teams, providing the strongest security boundary available in AWS.
A service for centrally managing multiple AWS accounts with consolidated billing, service control policies (SCPs), and organizational units (OUs).
A security strategy using multiple layers of controls (network, identity, data, application) so that if one layer fails, others still protect the environment.
A minimum set of security configurations that every AWS account must have - including CloudTrail, Config, GuardDuty, default encryption, and root account protection.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.