All terms

Glossary

Landing zone

The prepared foundation of an AWS environment: accounts, networking, permissions, logging and cost allocation, before the first application moves in.

A landing zone answers the questions that are painful to change later: how many accounts exist and what for, how the networks connect, who may do what, where logs end up, and how costs are attributed to a department.

AWS offers building blocks such as Control Tower. Whether you use them or describe the structure yourself in Terraform depends less on technology than on who will operate it afterwards.

How you notice it

  • Everything runs in one AWS account, production next to test.
  • Permissions were granted broadly during setup and never trimmed.
  • Logs live in the same account they are logging.

Frequently asked

Do I need Control Tower for a landing zone?

No, but it removes work. Describing the structure yourself in Terraform gives more control and more maintenance. The decision hinges on who operates the environment later: a small team usually fares better with Control Tower, a platform team with its own code.

Read moreRevenue reporting for AdTech platform