A landing zone is the secure, organized AWS foundation your workloads move into. Getting it right first saves painful clean-up later — especially once you need to pass a customer's security review or an AWS technical validation.
1. Accounts and structure
- Use AWS Organizations with separate accounts for production, staging, development, security and logging.
- Consider AWS Control Tower to set up the structure and baseline guardrails for you.
- Group accounts into organizational units so policies apply consistently.
- Keep the management account for billing and governance only — no workloads.
2. Identity and access
- Give people access through IAM Identity Center connected to your identity provider, not long-lived IAM users.
- Require MFA, and lock away the root user of every account.
- Use roles with least privilege; review them every quarter.
3. Guardrails
- Service control policies to block risky actions, such as disabling logging or using unapproved regions.
- Default encryption for storage and databases.
- Block public access to S3 at account level unless there's a reason not to.
4. Logging and security monitoring
- An organization-wide AWS CloudTrail trail into a dedicated log archive account.
- AWS Config to record resource changes and check rules.
- Amazon GuardDuty and AWS Security Hub enabled across accounts, with alerts routed to the team.
5. Networking
- Plan IP ranges up front so VPCs can be connected later without overlap.
- Decide how accounts connect (for example, a transit gateway) and how traffic leaves to the internet.
- Keep databases and internal services in private subnets.
6. Cost controls
- A tagging standard (team, environment, product) enforced from day one.
- AWS Budgets alerts per account and per team.
- Cost anomaly detection switched on.
7. Automate it
Define the landing zone and new accounts in infrastructure as code, so every environment is built the same way and changes are reviewed.
Next step
Our migration service starts with this foundation, then moves workloads in planned waves.