{
  "@context": "https://schema.org",
  "@type": "Article",
  "url": "/aws-consulting/aws-landing-zone-guide",
  "markdownUrl": "https://www.desaiinfo.net/kb/aws-consulting/aws-landing-zone-guide.md",
  "publisher": {
    "name": "Desai InfoTech",
    "url": "https://www.desaiinfo.net"
  },
  "type": "article",
  "slug": "aws-landing-zone-guide",
  "pillar": "aws-consulting",
  "order": 5,
  "title": "AWS Landing Zone Guide for Small Businesses",
  "metaTitle": "AWS Landing Zone Guide for Small Businesses",
  "description": "How to build an AWS landing zone for a small business or nonprofit with AWS Organizations, Control Tower, IAM Identity Center, logging and guardrails.",
  "keywords": [
    "aws landing zone",
    "aws control tower",
    "aws multi-account strategy",
    "aws organizations",
    "aws account structure",
    "landing zone accelerator",
    "aws organizational units"
  ],
  "published": "2026-10-17",
  "updated": "2026-10-17",
  "summary": "An AWS landing zone is a secure, pre-configured multi-account AWS environment that serves as the foundation for all workloads. It typically uses AWS Organizations and AWS Control Tower to create separate accounts for production, development, logging and security, with IAM Identity Center for access, centralized logging, baseline networking and guardrails. A small business landing zone usually takes 2-4 weeks to build.",
  "keyTakeaways": [
    "A landing zone separates workloads into accounts so mistakes and compromises stay contained.",
    "AWS Control Tower is the standard way to build one and includes preventive and detective controls.",
    "Keep the organizational unit structure simple, typically Security, Infrastructure, Workloads and Sandbox.",
    "Centralize logging and security tooling in dedicated accounts that workload teams cannot change.",
    "Define account baselines and networking as code so new accounts are consistent."
  ],
  "howTo": {
    "name": "How to build an AWS landing zone",
    "totalTime": "P3W",
    "steps": [
      {
        "name": "Design",
        "text": "Define organizational units, accounts, identity source, regions, network layout and tagging standards."
      },
      {
        "name": "Deploy Control Tower",
        "text": "Set up AWS Control Tower in the management account with log archive and audit accounts and selected regions."
      },
      {
        "name": "Configure identity",
        "text": "Connect IAM Identity Center to your identity provider and create permission sets and group assignments."
      },
      {
        "name": "Enable security services",
        "text": "Turn on GuardDuty, Security Hub and Config organization-wide with a delegated security account."
      },
      {
        "name": "Build networking",
        "text": "Create a shared networking account with Transit Gateway or VPC sharing, VPN connectivity and DNS."
      },
      {
        "name": "Vend workload accounts",
        "text": "Create production and non-production accounts through Account Factory with budgets and baselines applied."
      }
    ]
  },
  "faqs": [
    {
      "q": "Is AWS Control Tower free?",
      "a": "AWS Control Tower has no separate charge, but it enables services that are billed on usage, such as AWS Config, CloudTrail log storage in Amazon S3 and optionally AWS KMS. For a small organization with a handful of accounts, these costs are usually modest. Review the Config recording scope, since AWS Config can be the largest line item in active environments."
    },
    {
      "q": "How many AWS accounts does a small business need?",
      "a": "A typical small business landing zone starts with five to seven accounts, namely management, log archive, audit or security, shared networking, production and one or two non-production accounts. Add accounts per application or team as you grow. Each account adds isolation without adding cost by itself."
    },
    {
      "q": "Can we add a landing zone to an existing AWS account?",
      "a": "Yes. The existing account can be invited into a new AWS Organization and enrolled in Control Tower, or workloads can be moved gradually into new accounts. Enrolling an existing account requires checking for conflicts with Control Tower resources such as Config recorders and CloudTrail trails. Plan this carefully and test in a non-production account first."
    },
    {
      "q": "What is the difference between Control Tower and Landing Zone Accelerator?",
      "a": "AWS Control Tower is a managed service that sets up and governs a multi-account environment with built-in controls. The Landing Zone Accelerator on AWS is an open-source solution that deploys on top of Control Tower and adds extensive configuration, often used for regulated industries. Most small businesses start with Control Tower plus infrastructure as code."
    }
  ],
  "related": [
    {
      "title": "AWS Security Best Practices for Small Businesses",
      "url": "https://www.desaiinfo.net/aws-consulting/aws-security-best-practices"
    },
    {
      "title": "AWS Migration Checklist for Small Businesses",
      "url": "https://www.desaiinfo.net/aws-consulting/aws-migration-checklist"
    },
    {
      "title": "Azure Governance Framework for Small Businesses",
      "url": "https://www.desaiinfo.net/azure-consulting/azure-governance-framework"
    },
    {
      "title": "Terraform Infrastructure as Code Guide for Small Businesses",
      "url": "https://www.desaiinfo.net/devops-consulting/terraform-infrastructure-as-code-guide"
    },
    {
      "title": "Hybrid Cloud Networking: Connecting Offices to Azure, AWS and Google Cloud",
      "url": "https://www.desaiinfo.net/networking-services/hybrid-cloud-networking"
    }
  ],
  "url_path": "/aws-consulting/aws-landing-zone-guide",
  "bodyMarkdown": "Many small organizations start on AWS with a single account, a few IAM users and resources created in the console. That works until it does not: a developer accidentally deletes a production resource, an access key leaks, or nobody can tell which costs belong to which project. A landing zone fixes this by giving every workload its own account inside a governed structure. This guide explains how to build one at small business scale, and it is part of our [AWS consulting](https://www.desaiinfo.net/aws-consulting) series.\n\n## What is an AWS landing zone?\n\nAn AWS landing zone is a well-architected, multi-account environment with identity, logging, security and networking already in place. Workloads land in accounts that inherit guardrails automatically.\n\nA landing zone typically includes:\n\n- **AWS Organizations** to group accounts and apply policies.\n- **AWS Control Tower** to set up and govern the environment with controls.\n- **IAM Identity Center** for single sign-on across all accounts.\n- **A log archive account** that receives CloudTrail and Config logs from every account.\n- **An audit or security account** for GuardDuty, Security Hub and cross-account security access.\n- **Shared networking** with VPCs, connectivity to offices and DNS.\n- **Account Factory** to create new accounts with consistent baselines.\n\n## Why use multiple AWS accounts?\n\nAccounts are the strongest isolation boundary on AWS for security, quotas and billing. Separating workloads limits the blast radius of mistakes and attacks.\n\n| Benefit | What it means in practice |\n|---|---|\n| Security isolation | A compromised developer credential cannot reach production data |\n| Simpler permissions | Broad access in a sandbox, tight access in production |\n| Clear costs | Spend per account maps to an application, environment or program |\n| Independent quotas | One workload cannot exhaust another's service limits |\n| Compliance scoping | Regulated workloads isolated in their own accounts |\n\n## What account structure works for a small business?\n\nA simple organizational unit (OU) structure with five to seven accounts covers most small businesses and nonprofits. Add accounts as applications and teams grow.\n\n- **Root**\n  - **Management account**, used only for billing, Organizations and Control Tower\n  - **Security OU**\n    - Log archive account\n    - Audit (security tooling) account\n  - **Infrastructure OU**\n    - Network account (Transit Gateway, VPN, shared VPCs, DNS)\n    - Shared services account (CI/CD runners, directory services)\n  - **Workloads OU**\n    - Production OU with production accounts\n    - Non-production OU with development and test accounts\n  - **Sandbox OU** for experiments with strict budgets\n  - **Suspended OU** for accounts being closed\n\nNever run workloads in the management account. It holds the keys to the entire organization.\n\n## What guardrails should a landing zone include?\n\nCombine preventive controls that block risky actions with detective controls that flag drift. Control Tower provides a catalog of both, and service control policies add custom rules.\n\n### Starter guardrails\n\n- [ ] Prevent disabling or modifying CloudTrail, Config and GuardDuty.\n- [ ] Deny actions outside approved regions, such as us-west-2 and a secondary region.\n- [ ] Disallow root user actions in member accounts.\n- [ ] Require S3 Block Public Access at the account level.\n- [ ] Require encryption for EBS volumes and RDS instances.\n- [ ] Detect security groups that allow unrestricted SSH or RDP.\n- [ ] Detect IAM users with access keys older than 90 days.\n- [ ] Prevent leaving the organization.\n\nApply stricter controls to production OUs and more permissive ones to sandbox, and always test new SCPs in a non-production OU first. Our [AWS security best practices](https://www.desaiinfo.net/aws-consulting/aws-security-best-practices) guide explains the controls in more depth.\n\n## How should you design identity in a landing zone?\n\nUse IAM Identity Center connected to your existing identity provider, with group-based permission sets. People should never need IAM users.\n\n1. Connect IAM Identity Center to Microsoft Entra ID, Google Workspace or Okta, with SCIM provisioning of users and groups.\n2. Create permission sets by job function, for example ReadOnly, Developer, NetworkAdmin and SecurityAudit.\n3. Assign groups to permission sets per account, so a developer has broad rights in development but read-only in production.\n4. Restrict administrator access to a few named people and monitor its use.\n5. Keep break-glass access documented and tested.\n\n## How should you design networking in a landing zone?\n\nCentralize connectivity in a network account and give workload accounts their own VPCs or shared subnets. Plan IP ranges up front so they never overlap with offices or other clouds.\n\n- **IP address plan:** allocate non-overlapping CIDR blocks per account and region, leaving room to grow. Amazon VPC IP Address Manager can help.\n- **Connectivity:** AWS Transit Gateway connects VPCs and site-to-site VPNs; VPC sharing through AWS Resource Access Manager is a simpler option for small environments.\n- **Egress:** centralize or limit NAT gateways to control cost, as NAT charges can be significant.\n- **DNS:** use Route 53 Resolver for hybrid DNS with on-premises Active Directory.\n\nIf you connect AWS with offices, Azure or Google Cloud, see our [hybrid cloud networking](https://www.desaiinfo.net/networking-services/hybrid-cloud-networking) guide.\n\n## How do you manage a landing zone over time?\n\nDefine it as code, vend accounts consistently and review controls regularly. A landing zone is a living platform, not a one-time build.\n\n- **Infrastructure as code:** manage account baselines, SCPs and networking with Terraform (including Account Factory for Terraform) or CloudFormation StackSets. See our [Terraform infrastructure as code guide](https://www.desaiinfo.net/devops-consulting/terraform-infrastructure-as-code-guide).\n- **Account vending:** create new accounts only through Account Factory so they get budgets, tags and baselines.\n- **Drift detection:** watch for Control Tower drift and fix it promptly.\n- **Updates:** apply Control Tower landing zone updates when AWS releases them, after testing.\n- **Reviews:** quarterly review of access, SCPs and Security Hub posture.\n\n## Landing zones for nonprofits\n\nNonprofits using AWS credits benefit from a landing zone because it separates grant-funded projects into their own accounts, making cost reporting to funders straightforward. Keep the design lean, favor managed services and set budgets on every account so credits are not consumed unexpectedly.\n\n## How Desai InfoTech builds AWS landing zones\n\nDesai InfoTech designs and deploys right-sized AWS landing zones for small businesses and nonprofits, defined as code and documented for your team. It is usually the first step before an [AWS migration](https://www.desaiinfo.net/aws-consulting/aws-migration-checklist). If you also use Azure, compare with our [Azure governance framework](https://www.desaiinfo.net/azure-consulting/azure-governance-framework). To get started, [contact us](https://www.desaiinfo.net/contact)."
}