Cloud Transformation

Landing Zone

The foundation every wave lands on: accounts, guardrails, network hub, identity and logs, built once and the same way.

Before the first server moves, the target is built: a tree of accounts with guardrails on its branches, one network hub that every workload connects through, a single sign-in, and logs kept apart where no workload can change them. Every later wave lands in it, so it is Wave 0 of every plan.

private linkspokesOn premisesAWS CloudManagement account · AWS OrganizationsNetwork accountSecurity OU · Log Archive and AuditShared services accountWorkloads OUProduction accountVPC · spokeNon-production accountVPC · spokeData centreAWS Direct ConnectAWS Transit GatewayAWS Network FirewallAmazon Route 53AWS OrganizationsAWS Control TowerAWS Config & SCPsIAM Identity CenterAWS Secrets ManagerAWS Cost ExplorerAWS CloudTrailAWS Security HubAWS ManagedMicrosoft ADAmazon CloudWatchAmazon EC2Amazon EKSAmazon Aurora / RDSfor PostgreSQLAmazon EC2Amazon Aurora / RDSfor PostgreSQLAWS Backup

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

When to use it

  • Every migration: no wave starts before it exists
  • A customer with one shared account that has grown by hand
  • Several business units that must stay apart but share a network and a directory

Where FleziLift fits

The Wave Plan puts it first as Wave 0 · Foundation, and the playbook's Prepare stage lists its work packages: landing zone, network, firewall rules, connectivity, identity, monitoring and backup, each with the cloud's own tool.

Cloud Transformation

The same pattern, the way each provider builds it

Each cloud's own framework and guidance.