Landing zones

A landing zone is the baseline multi-account or multi-subscription environment that applies identity, network, logging and policy before the first production workload is deployed.

Who this topic is for

Platform teams standing up or repairing the shared environment that every product account inherits.

Problems these pages cover

One account or subscription holds every environment.
Guardrails were never written as policy, only as a wiki.
New accounts are created by hand with no logging or identity baseline.

Guides in this topic

Ankit Mehta Updated Aug 30

Multi-account and multi-subscription structure

Landing zones

The production landing-zone decisions that sit on top of this tree are in Designing a production landing zone. An AWS account is a resource, IAM and billing boundary. A member account belongs to one organization. SCPs attached to an OU limit principals in those member accounts. They do not limit principals in the management account. Azure subscriptions inherit Azure Policy from management groups.

Related runbooks

IAM access lockout

Consulting

Scoped review for this topic: Cloud architecture consulting.