A foundation for multiple AWS accounts
An AWS landing zone establishes the account structure, access rules, logging, and network foundations that workloads use. LZA lets a platform team define those foundations in configuration files and deploy them across accounts and Regions, rather than configure each account separately.
AWS publishes LZA as an open-source AWS Cloud Development Kit solution. It supports complex security requirements, but deploying it does not make an organization compliant. Your team must select the controls, verify their operation, and address the policies and processes that infrastructure cannot provide.
AWS Control Tower and LZA
AWS Control Tower sets up and governs a multi-account landing zone. It provides controls and Account Factory for provisioning accounts. LZA adds configuration-driven networking, security services, and logging to that foundation. AWS recommends using the two together.
LZA can also run with AWS Organizations without Control Tower. Current deployment options include creating or managing a Control Tower landing zone through LZA, subject to the installation prerequisites. For an existing environment, assess the accounts, organizational units, and services already in place before choosing an installation path.
What LZA deploys
The reference architecture includes account creation, drift detection, encryption key management, and centralized logging. Other resources depend on your configuration. The configuration reference groups these settings by function:
- Accounts and organization: accounts, organizational units, and service control policies.
- Logging and security: CloudTrail, AWS Config, Security Hub, GuardDuty, and log storage settings.
- Networking: VPCs, subnets, Transit Gateways, endpoints, and firewall policies.
- Identity and access: IAM roles and policies, plus IAM Identity Center permission sets and assignments.
These are configurable capabilities, not a promise that every service is enabled or appropriate for every account. Match the configuration to your workload and security requirements.
How the deployment pipeline works
LZA uses an Installer pipeline and a Core pipeline. The Installer builds the solution and deploys the Core pipeline. The Core pipeline validates configuration, synthesizes infrastructure with AWS CDK, and deploys CloudFormation stacks across the target accounts and Regions.
This pipeline deploys landing zone infrastructure. It is not a ready-made release pipeline for your application code. AWS documents an optional approval stage and pipeline notifications for reviewing infrastructure changes and tracking failures.
When LZA fits
Consider LZA when several accounts need a consistent configuration and your platform team can own the deployment pipeline. It is particularly relevant when central networking, logging, and security services need more configuration than your existing landing zone provides.
For a smaller environment, first identify what Control Tower already covers and which requirements remain. Compare the work of maintaining LZA with the work of managing those requirements directly. A Well-Architected review can help structure that assessment; installing LZA does not replace workload design or review.
Plan deployment before installing
- Define the foundation. Record the account structure, Regions, network ranges, access model, and logging requirements.
- Check prerequisites. Confirm the selected Control Tower or Organizations installation path, required accounts, CodeBuild quotas, and access to the global Region. Existing service control policies or Region restrictions can block deployment.
- Deploy and verify. Follow the AWS deployment guide, wait for the initial pipeline to finish, and update the configuration to match your design. Test changes in a non-production environment before applying them to production.
- Assign an operator. Name who reviews configuration changes, monitors failed runs, validates controls, and manages solution upgrades.
Costs and ongoing operations
LZA has no additional solution charge. You pay for the AWS services it enables. The AWS cost guide provides a sample estimate, not a production budget. Your costs depend on the accounts, Regions, network resources, security services, and logging activity you configure.
Budget for operating the foundation as well as deploying it. Configuration review, pipeline failures, upgrades, and control verification need an owner. Our AWS operational excellence guide covers the operating practices that remain after infrastructure automation is in place.
Assess your AWS landing zone
Start with the requirements your current foundation cannot meet. If you need help assessing the account structure, deployment approach, or operating responsibilities, review Autimo Cloud's architecture work or discuss your platform with Autimo.