Short explainers for landing zones, multi-cloud, FinOps, IAM, networking, failure domains and cost allocation.
Enforceable landing-zone defaults are on the production landing-zone guide. This article defines the tenancy decisions underneath those defaults. A workload needs compute, storage, and a path to users. Architecture is the container around that workload: which account or subscription owns it, which identity can change it, which network it can leave, which region it dies in, and which cost center sees the bill.
The tree and inheritance are below. How many accounts to vend is the multi-account guide. Microsoft's current CAF page splits the idea in two. The platform landing zone is the centralized foundation: governance, security, and shared resources. An application landing zone is where a workload team deploys. Microsoft states that most organizations should have one platform landing zone per Microsoft Entra tenant.
Using two providers in a lab, or one provider plus Microsoft 365, is not this problem. The architectural event is a second production identity plane and a second production invoice.
The Foundation's current introduction page is explicit that FinOps is a portmanteau of Finance and DevOps, and that "Cloud Financial Operations" is a poor synonym because it collides with a finance-department role. The same page says the point is value. Saving money is one input to that value. Use that definition. Vendor marketing pages that redefine FinOps as a product feature are not the Framework.
If you only need the general practice, start at What is FinOps?. The sections below explain why AI spend does not fit that export without extra dimensions. The Foundation's FinOps for AI technology category describes cost complexity, faster change, spend that is hard to predict, and a need for tighter policy while teams still ship.
Use this article for isolation vocabulary. A second region with RTO and RPO is the DR guide. A third AZ stays inside one region. AWS's fault-isolation whitepaper calls the zonal property Availability Zone Independence: common generators and cooling are not shared, and service deployments to AZs in a region are staggered in time. Zones in a region are linked with high-bandwidth metro fiber.
The matrices below are the documented customer-versus-provider split. They are not a control catalog or an attestation. AWS uses the phrases security of the cloud and security in the cloud. Of the cloud is facilities, hardware, network, and the virtualization layer AWS operates. In the cloud is guest OS patching on EC2, application software, and the security-group firewall you configure.
The sections below are the object model per provider. Hub placement and NAT bills sit on the hub-and-spoke guide. An Amazon VPC is a logically isolated virtual network in one AWS Region. Subnets are zonal. Route tables, internet gateways, NAT gateways, and VPC peering or Transit Gateway attachments are how packets leave. Security groups are stateful instance-level filters.
Human sign-in (IAM Identity Center, Microsoft Entra ID, Google identities, Alibaba Cloud accounts) is the front door. Authorization is the part that pages you at 2 a.m.
FinOps (see What is FinOps?) is the operating practice. Allocation is the data shape that practice needs. AWS Organizations consolidated billing rolls member accounts to the management (payer) account. The account ID is already an allocation key. Tags refine spend inside an account. AWS documents AWS-generated tags (aws: prefix, including createdBy when enabled) and user-defined tags.