How to Build a Well-Architected AWS Landing Zone
· via Gruntwork
Why this matters now: The landing zone is the highest-leverage early decision in AWS, since accounts, identity, networking and guardrails all inherit it. Every workload you add on top makes that foundation more expensive to change. If you are working through an AWS multi-account strategy, this guide covers the build side of the same decisions.
Three takeaways:
- The guide compares the build routes honestly. Control Tower gives a quick start with opinionated defaults and limited customization. Landing Zone Accelerator suits regulated industries with its config-file approach. Gruntwork’s own accelerator is Terraform and OpenTofu native. Fully custom is named the most expensive option over time. Pick based on how much maintenance you want to own.
- OU design and account vending hurt most to change later, so spend your thinking there first. Structure OUs around the policies you apply, start simple with Security, Infrastructure and Workloads OUs, and let vending automate security services, networking, identity federation and cost alerts. Manual steps cause drift. Identity follows the same rule: IAM Identity Center federated to your corporate provider, permission sets by job function, no long-lived credentials in workload accounts, and a break-glass procedure with its own alerting.
- Guardrails work in layers. SCPs hold the non-negotiables, Config rules detect drift, and proactive controls reject noncompliant resources before they deploy. Manage the landing zone itself with IaC from day one and push every change through a pipeline. Console edits become ungoverned drift. The same discipline drives the case I make for strengthening AWS security posture with IaC.
**What I’d add today: A well-architected landing zone is and will be one of the best places to put serious time and effort in getting it right before you scale on AWS.
Who should read it: anyone standing up multi-account AWS from scratch, or re-platforming an organisation that grew one account at a time. The guide also warns against treating the landing zone as a one-time implementation, which is the trap most of those organisations fell into.