Before moving production workloads into Azure, AWS, or Google Cloud, decide how resources will be organized, how people and services will get access, how networks will connect, and how the environment will be secured, monitored, recovered, and paid for. A cloud landing zone is the foundation for those decisions—not just a network segment or an initial account setup.
Use this checklist to document the decisions, owners, and rollout sequence that fit your first workloads. The provider architectures have different hierarchy and control models, so use the shared checklist as a planning guide rather than treating their services or designs as interchangeable.
As an Amazon Associate I earn from qualifying purchases.
What should a cloud landing zone establish?
A landing zone is a governed foundation for deploying and operating workloads. Microsoft’s Cloud Adoption Framework describes an Azure landing zone as a flexible architecture for governing, securing, and scaling a multi-subscription environment. AWS frames its guidance around a secure, scalable multi-account environment, while Google Cloud describes a modular cloud foundation.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11In practice, the foundation should clarify where workloads live, who can administer them, what shared capabilities they use, which guardrails apply, and how the organization will detect and respond to problems. It should produce a documented design and an implementation sequence—not simply a set of accounts or subscriptions.
#1 Best Overall
How should you scope the first landing zone?
Identify the first workloads and constraints
- Name the business outcomes and workloads in the initial scope, along with their environments, data classifications, and intended regions.
- Identify regulatory, contractual, connectivity, and operational requirements before choosing controls or locations.
- Decide whether one shared foundation is suitable or whether workloads with materially different risk, compliance, or connectivity requirements need distinct boundaries.
- Keep the first iteration proportional to the workloads you plan to onboard. Google Cloud recommends building around early use cases and extending the modular foundation as needs emerge.
Assign decision rights
- Name owners for platform services, identity, networking, security, operations, finance, and each workload.
- Record who may provision environments, change organization-wide policy, alter network controls, access central logs, and approve exceptions.
- Specify how workload teams request shared capabilities or policy exceptions, who reviews the request, and how the decision is recorded.
How will you organize accounts, subscriptions, and projects?
Choose boundaries using the provider’s native hierarchy, and decide how policy and cost ownership will follow those boundaries. Separate shared platform responsibilities from workload-team environments where your operating model requires it.
- Define top-level organization and billing ownership.
- Choose account, subscription, project, folder, organizational-unit, or management-group boundaries for platform services, production, non-production, sandbox, and restricted workloads as appropriate.
- Document naming conventions, tags or labels, ownership metadata, and the process for creating and retiring workload environments.
- Decide which policies inherit from parent scopes and which teams can manage resources within their assigned boundaries.
- Set the process for allocating costs to workloads, teams, and environments.
Keep provider terminology distinct: Azure separates platform landing zones from workload landing zones; AWS Control Tower organizes accounts and organizational units; Google Cloud uses an organization, folders, projects, and billing structures. Microsoft’s landing-zone guidance includes resource organization; AWS’s design guidance covers account structures and OUs; Google Cloud’s foundation design covers the resource hierarchy and organization.
Rank #2
How will people and workloads authenticate?
- Decide how the cloud identity model connects to the organization’s identity provider, including federation or single sign-on where appropriate.
- Define human roles, privileged access, workload identities, emergency access, and joiner, mover, and leaver processes.
- Use least privilege, and establish periodic access reviews for both human and machine identities.
- Limit who can create accounts or projects, change organization-wide settings, alter network controls, or access centralized logs.
- Prefer short-lived or federated credentials for workloads when practical. Google Cloud guidance recommends restricting service-account key creation for most use cases and considering service-account impersonation or workload identity federation.
- Document an exception route for integrations that cannot use the preferred short-lived or federated method, including an owner and review process.
How will networks and external connections work?
- Choose a network topology and assign responsibility for IP addressing, routing, DNS, firewall rules, segmentation, ingress, and egress.
- Map how workloads will reach shared services, the internet, on-premises systems, and other cloud environments.
- Decide whether connectivity is centralized or distributed, and establish review and monitoring for network changes.
- Document trust boundaries, permitted traffic flows, and the process for requesting and reviewing exceptions to network policy.
Provider examples are alternatives within their respective ecosystems, not interchangeable product names. Azure reference patterns include hub-and-spoke and Virtual WAN. AWS’s landing-zone guide discusses connectivity using services such as Transit Gateway, Direct Connect, and Site-to-Site VPN. Google Cloud describes Shared VPC, Cloud NAT, Cloud Interconnect, Cloud VPN, and private DNS options.
Which security and governance guardrails are required?
- For every guardrail, identify whether it is preventive or detective, who owns it, which scope it covers, and how compliance is checked.
- Set baseline rules for permitted regions and services, public exposure, encryption, identity permissions, and resource configuration according to organizational requirements.
- Plan how misconfiguration and threats will be detected, triaged, escalated, and resolved.
- Establish an exception process that records a rationale, accountable owner, expiry or review date, and any required compensating control.
- Document how policy changes are reviewed and tested before they affect workload teams.
Keep implementation choices provider-specific. For AWS, document how Control Tower controls, CloudTrail, AWS Config, and related services support the intended governance and audit model. Google Cloud’s security guidance identifies Security Command Center, centralized audit logs, and VPC Service Controls as examples; it also cautions that perimeter design brings operational complexity and should match the use case. For Azure, document the identity, policy, security, and management choices for the selected landing-zone implementation.
Rank #3
What should logging, monitoring, and operations cover?
- Choose which administrative, network, workload, and security events to collect, where to store them, who can change or delete them, and how long to retain them. Set retention according to business and regulatory requirements rather than assuming a universal period.
- Centralize logs where appropriate, and define access to the log store separately from access to workload environments.
- Build dashboards and alerts that point to actionable exceptions; name the team or responder responsible for each alert.
- Define configuration inventory, drift detection, incident response, patching, and cloud service health processes.
- Record who operates each shared service and how workload teams engage that operator.
AWS’s design guidance explicitly covers centralized logging and monitoring, log archiving, alerting, and AWS Config. Google Cloud includes logging and monitoring in its foundation and recommends dashboards and alerts for actionable exceptions.
How will data be protected and workloads recovered?
- Identify applicable regulatory and contractual obligations before selecting regions, controls, or data-handling patterns.
- For each workload class, decide encryption requirements, key ownership, secrets handling, backup scope, and retention.
- Set workload-specific recovery objectives and assign responsibility for meeting them.
- Plan and schedule restoration tests, and make the results and follow-up actions discoverable to the relevant owners.
- Keep compliance evidence and control ownership accessible; do not assume provider defaults meet every organizational obligation.
Google Cloud’s landing-zone overview explicitly includes backup and disaster recovery, compliance, and workload-specific requirements among design considerations.
How will cost and environment delivery be controlled?
- Assign billing access and budget ownership, define cost-allocation labels, and decide how budgets or alerts and cost reviews will work.
- Describe how teams request new workload environments and shared capabilities, including the approvals and information required.
- Choose a change and deployment approach that your team can operate. Infrastructure as code can support repeatable deployments; CI/CD or GitOps can apply internal guidelines through a controlled workflow.
- Where you adopt automation, define review, versioning, testing, and rollback expectations.
Google Cloud recommends considering infrastructure as code for repeatable, modular deployments and CI/CD or GitOps for applying internal guidelines. Microsoft says its landing-zone accelerators use infrastructure as code. These are implementation choices, not mandatory products; select them to fit the team’s capabilities and operating model.
How do Azure, AWS, and Google Cloud differ?
The shared planning questions are similar, but hierarchy, isolation boundaries, and implementation patterns differ. The provider guidance below is a starting point for architecture decisions, not a substitute for validating fit against workload and organizational requirements.
Best Value
| Provider | Foundation model and hierarchy | Examples of provider-specific design areas |
|---|---|---|
| Azure | Microsoft’s Cloud Adoption Framework distinguishes a platform landing zone for centralized governance, security, and shared capabilities from workload landing zones for workload teams; the architecture is multi-subscription. | Resource organization, networking, security, and management. Reference patterns include hub-and-spoke and Virtual WAN. |
| AWS | The landing-zone design is a multi-account environment; AWS Control Tower organizes accounts and organizational units. | Account structure, preventive, detective, and proactive controls, networking, authentication and authorization, centralized logging and monitoring, and configuration management. |
| Google Cloud | The foundation is modular and uses an organization, folders, projects, and billing structures. | Identity provisioning, resource hierarchy, network, security controls, logging and monitoring, backup and disaster recovery, compliance, and cost. Examples include organization/folder/project structures and shared networking patterns. |
Compare candidate designs on the questions that affect your operating model: isolation boundaries; central versus workload-team control; hybrid connectivity; identity integration; policy enforcement; log ownership and retention; deployment automation; operational complexity; and compliance or workload-specific fit.
What should the design document and rollout sequence contain?
Turn the checklist into a record of agreed architecture decisions. AWS’s design guidance treats the design document as a record of those decisions, while Google Cloud recommends starting with elements needed for the first workload and adding modules later.
Quick Recap
- Document scope and owners. Record the first workloads, environments, requirements, accountable teams, and exception approvers.
- Agree on boundaries. Capture the provider hierarchy, workload isolation, billing ownership, and naming and metadata conventions.
- Define access and connectivity. Record identity flows, role boundaries, network topology, allowed traffic, and exception handling.
- Set guardrails and operations. Specify security controls, log collection and access, monitoring and response ownership, configuration management, and change review.
- Address recovery and cost. Document workload-specific protection and recovery decisions alongside budget ownership and allocation.
- Onboard in modules. Implement the capabilities required for the first workloads, validate them with their owners, and add further foundation capabilities as requirements emerge.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
