Landing Zones
The foundation every workload lands on: accounts, identity, network, policy and logging, all as code.
The landing zone, drawn for each cloud
Wave 0 of every plan. Switch the cloud: the design stays, the services change.
Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.
What a landing zone holds
Built once, as code, so the hundredth workload lands as safely as the first. Chips show each cloud's service.
- 01Accounts and subscriptionsCore accounts for security, logs, network and shared services; workload accounts per product and environment.AWS Organizations + Control TowerManagement groups + subscriptionsFolders + projectsSandboxes
- 02Identity and accessSingle sign-on with the corporate directory, roles per job, a logged break-glass path.IAM Identity CenterMicrosoft Entra IDCloud IdentityLeast privilege
- 03Network and connectivityHub-and-spoke, central inspection of traffic in and out, hybrid links and private DNS.Transit Gateway + inspection accountHub VNetShared VPCVPN · Direct Connect · ExpressRoute · Interconnect
- 04Guardrails and compliancePolicy as code, encryption by default, posture checks and mandatory tags.SCPs + AWS ConfigAzure PolicyOrganization policiesTagging
- 05Management and monitoringCentral logs and metrics, alerting, and baselines for backup and disaster recovery.CloudTrail log archiveLog AnalyticsCloud Logging sinksBackup and DR baselines
- 06Platform automationReusable modules, account vending and pipelines that change the platform itself.Terraform on every cloudCloudFormation · AWS CDKAccount vending
How NGT builds a landing zone
Four steps on every cloud; pilot applications prove the foundation before the first wave.
- 01Understand
- Current IT operating model
- Security, network, compliance baselines
- Who will run the platform
- 02Design
- Account or subscription structure
- Identity, network, BC/DR
- Security, governance, monitoring
- 03Provision and prove
- Environments from code
- Pilot applications deployed
- Guardrails tested, not assumed
- 04Operate and optimise
- Changes through pipelines only
- New accounts on request
- Cost and posture reviewed
Console clicks versus a landing zone as code
What changes when the foundation lives in Git and every change goes through a pipeline.
Questions about landing zones
The questions this part raises, and their answers.
No. The method starts from your current operating model; existing accounts move into the new structure step by step.
Where a clean break is better, workloads are rehosted into an improved landing zone and the old one decommissioned.