AWS Landing Zone: What It Is and How to Build One That Lasts
A landing zone is the foundation every AWS workload sits on. Get it right, and new projects can launch in days. Get it wrong, and the consequences can last for years.
The foundation behind a well-run AWS environment
A good landing zone makes AWS easier to manage as your environment grows. Teams know where new projects belong, security reviews are more predictable, and new AWS accounts can be provisioned in hours instead of weeks.
Without that foundation, problems tend to build up quietly. Accounts are created ad hoc, logs are scattered, IAM is configured differently across accounts, and answering a simple compliance question can require a spreadsheet. The workloads still run, but every new project adds to the complexity.
What an AWS landing zone actually is
AWS defines a landing zone as a well-architected, multi-account environment that provides a starting point for deploying workloads. It sets the baseline for account structure, identity and access, governance, data security, networking and logging before workloads are deployed on top of it.
Two things are worth clarifying because the terminology can be confusing. First, a landing zone is a pattern, not a product. Second, the original AWS Landing Zone solution is a separate product that is now in long-term support, with no new features planned. AWS recommends moving to AWS Control Tower, which helps you build and govern a landing zone as a managed service.
What you actually get
A Control Tower landing zone takes about 30 minutes to set up. It creates an AWS Organizations hierarchy, sets up IAM Identity Center for access, and provisions three shared accounts: a management account, a log archive account that centralizes CloudTrail and Config logs from governed accounts, and an audit account for security and compliance tooling.
The control layer then helps enforce your baseline. Preventive controls use service control policies to block actions before they happen. Detective controls use AWS Config rules to identify non-compliant resources. Proactive controls use CloudFormation hooks to prevent non-compliant resources from being created. Account Factory then provisions new accounts using the same baseline.
Four decisions that are hard to reverse
Most landing zone problems can be traced back to a few early decisions.
- Your home Region. It is set when you create the landing zone and cannot be changed later. Pick the Region where most of your workloads and data will live.
- Your OU design. Organize OUs around functions and shared controls, not your reporting structure. Start with foundational OUs for security and infrastructure, then add workload OUs as needed. Moving accounts later can mean untangling permissions and controls.
- What runs in the management account. The answer should be as close to nothing as possible.
- Your AWS Config setup. Config charges per configuration item, and short-lived workloads such as Spot Instances and EMR jobs can generate them constantly. Keeping the landing zone up to date also matters because newer versions handle global resources differently by recording them only in the home Region.
Extending it without breaking it
A default landing zone is a starting point, not a finished platform. Most organizations eventually need more, such as a custom network topology, additional compliance frameworks, or resources that are automatically deployed to each new account.
Three AWS options can extend Control Tower rather than replace it. Customizations for AWS Control Tower deploys CloudFormation templates and policies in response to landing zone lifecycle events. Account Factory for Terraform gives Terraform teams a GitOps-based provisioning workflow. Landing Zone Accelerator adds support for regulated workloads and more complex compliance requirements.
The approach is simple: use Control Tower as the foundation, then extend it as your needs grow.
Build it once, then keep it alive
A landing zone is not a project with an end date. Controls change, AWS releases new landing zone versions, accounts drift, and a structure that worked for 40 accounts can start to creak at 400. The organizations that get the most value from their landing zones treat them as a product with an owner, not as a setup task that was completed once and forgotten.
Trustsoft designs, builds and operates AWS landing zones as an AWS Premier Tier Services Partner. Whether you are starting with a single account or cleaning up years of cloud sprawl, explore our Landing Zone service or talk to our team.
