Skip to main content
Cloud DevOps Solutions
Get a quote Talk to an engineer

AWS Landing Zone Setup

We design and implement an AWS Landing Zone, multi-account structure via Control Tower, IAM Identity Center with SSO, Service Control Policies, centralised GuardDuty and CloudTrail, and a network baseline with Transit Gateway.

Book a working session Request a quote

Problems we solve

  • Single AWS account used for dev, staging, and production, no blast radius control
  • Root account has active access keys and no MFA enforced
  • No central logging, CloudTrail trails exist per account but logs are not centralised
  • No Service Control Policies, any account admin can create resources in any region
  • AWS SSO/IAM Identity Center not configured, engineers share long-lived IAM users

What's included

AWS Control Tower setup (or AWS Organizations if Control Tower not appropriate)
Account vending machine via Service Catalog or Terraform account factory
Landing Zone Accelerator (LZA) or custom Terraform for guardrails
IAM Identity Center (SSO) with Entra ID or Okta federation
Service Control Policies: block root access, require MFA, restrict to approved regions
Centralised CloudTrail, AWS Config, GuardDuty, and Security Hub across all accounts
VPC baseline per account (Transit Gateway or AWS RAM for shared services)
Cost allocation tags enforced via SCP and AWS Config rules

Our approach

  1. 01

    Account structure design

    We design the OU hierarchy: Security, Infrastructure, Workloads (dev/staging/prod), Sandbox. We recommend the number of accounts needed based on your team size, compliance requirements, and blast radius tolerance.

  2. 02

    Control Tower or Organizations setup

    For new AWS estates, AWS Control Tower provides pre-built guardrails and the Account Factory. For existing organisations with complex requirements, we use Terraform with aws_organizations_* resources directly.

  3. 03

    SSO configuration

    IAM Identity Center is configured with your identity provider (Entra ID, Okta, or Google Workspace). Permission sets are defined and assigned to accounts, replacing individual IAM users entirely.

  4. 04

    Security baseline

    GuardDuty, Security Hub, AWS Config, and CloudTrail are enabled in every account via a delegated admin in the security account. Config rules enforce required tags, MFA on root, and CloudTrail enabled.

  5. 05

    Network baseline

    A Transit Gateway connects shared services to workload accounts. VPC baselines with private/public subnets and Flow Logs are deployed to every account via Account Factory customisation.

Tech stack

AWS Control TowerAWS OrganizationsAWS IAM Identity CenterAWS Transit GatewayAWS ConfigGuardDutySecurity HubCloudTrailService Control PoliciesTerraform (aws provider)

Results

We publish results only when a client has approved them. See how we publish case studies and a sample report.

FAQ

What is an AWS Landing Zone?
A Landing Zone is a well-architected, multi-account AWS environment that serves as a baseline for all workloads. It provides account vending, centralised security logging, network connectivity, and guardrails via SCPs, so every new team starts in a consistent, guarded account.
Should I use AWS Control Tower or build my own Landing Zone?
AWS Control Tower is often a good starting point: it provides pre-built guardrails, Account Factory, and a baseline with less engineering effort. It does not make an environment compliant by itself. Build your own (via Terraform + Landing Zone Accelerator) when you have complex existing accounts or need non-standard OU structures.
What are Service Control Policies?
SCPs are IAM policies applied at the OU or account level via AWS Organizations. They set maximum permissions, even an account root user cannot exceed them. Common SCPs: deny actions outside approved regions, require MFA for sensitive actions, prevent GuardDuty or CloudTrail from being disabled.
How many AWS accounts do we need?
At minimum: Management (billing only), Security (centralized logs and SIEM), Shared Services (network hub, artifact repos), and one per workload environment tier (dev, staging, prod). The right number depends on team size, compliance needs and blast radius tolerance.
How long does a Landing Zone implementation take?
It depends on the number of accounts, existing workloads and identity setup. A new Control Tower Landing Zone is usually quicker than migrating existing accounts and workloads into the new structure. The timeline is confirmed in the written scope.

Related services

Related articles

Ready to get started?

Book a free technical consultation. No commitment, just an honest conversation about your goals.

Book a working session Request a quote
Written by Saddique Khan, AWS & Azure Certified · Last updated October 2025