Landing zone
A landing zone is the environment every workload lands in. Getting it right once means every account inherits the same identity model, log archive, network baseline and guardrails — and every new account is a routine operation rather than a project.
Account structure
| Account | Purpose | Key controls |
|---|---|---|
| Management | Organisation root, billing, Control Tower | No workloads; MFA on root; break-glass only |
| Log archive | Centralised CloudTrail and Config history | Write-only from member accounts; immutable retention |
| Security / audit | Security Hub aggregation, GuardDuty admin, Prowler, incident response | Read-only access to member accounts; no workload data |
| Shared services | Directory, DNS, CI/CD shared services, artefact registry | Restricted ingress; approved principals only |
| Network | Transit Gateway, shared VPCs, centralised egress | Controls all inter-account routing |
| Workload — dev | Development environments | Reduced guardrails; no production data |
| Workload — stage | Pre-production, production-shaped | Production guardrails; synthetic data |
| Workload — prod | Customer-facing workloads | Full guardrails; change control; backup and DR |
Separate accounts for dev, stage and prod are the default. They make blast
radius, access boundary and cost attribution structural rather than procedural.
Foundation services
Identity
IAM Identity Center provides single sign-on across every account. No individual IAM users with console passwords. Permissions are assigned through permission sets mapped to identity-provider groups, so joining or leaving a team changes access in one place.
See Identity and SSO.
Logging and audit
- One organisation-wide CloudTrail trail, delivering to the log archive account.
- Config history and snapshots delivered to the same account.
- CloudWatch Logs groups for CloudTrail, organised for query and alarm use.
- Retention: 12 months hot for CloudTrail events; 10 years for access logs to the archive bucket.
Network
- VPCs per environment with public and private subnets across at least two Availability Zones.
- No workload subnets with a route to the internet except through a controlled egress path.
- Centralised egress via the network account for production.
- VPC Flow Logs enabled and delivered centrally.
- PrivateLink endpoints for AWS services where traffic should not traverse the internet.
Guardrails
Applied through Control Tower controls, SCPs and Config rules:
- Deny creation of resources outside approved regions.
- Deny disabling of CloudTrail, Config or GuardDuty.
- Deny public S3 bucket ACLs and policies.
- Deny root account access keys.
- Require encryption on data stores.
- Require tagging on billable resources.
Onboarding a new account
Request Account purpose, owner, environment, cost centre, data classification and expected AWS services are recorded in the request.
Provision through the account factory The account is created through Control Tower Account Factory for Terraform, into the correct organisational unit.
Inherit the baseline Automation applies SCPs, Config rules, CloudTrail, IAM roles, the Terraform state lock table and the standard tags.
Connect identity Permission sets are assigned to the relevant groups; no local IAM users are created.
Verify Compliance checks confirm the baseline is present before the account is released to the workload team.
What the landing zone does not do
- It does not provision workload infrastructure. That is Terraform, in the workload account, against the Terraform standard.
- It does not decide application architecture. It provides the constraints within which architecture choices are made.
- It is not static. Controls are versioned, reviewed and rolled out through the same pipeline discipline as workloads.