Article
A cloud landing zone is the part of a migration that nobody demos. It is the account structure, network, identity, logging, and guardrails that every later workload depends on. When it is missing, the first few services work and the next twenty become expensive to govern.
The goal is not a perfect platform. It is a small set of decisions that make the next migration predictable.
Accounts and environments
Production, staging, and development should not share a boundary just because it is quicker to set up. Separate accounts or subscriptions limit the blast radius of a mistake and make cost and access easier to reason about.
A simple structure that your finance and operations teams understand is better than a detailed hierarchy nobody maintains. The landing zone should document where each workload belongs and why.
Identity, network, and policy
Identity is the control plane. Single sign-on, role-based access, and a clear break-glass path are more important than most network appliances. The network then connects the cloud to your sites without exposing management interfaces to the internet.
Policy guardrails, logging, and budget alerts belong here too. They are cheaper to configure before workloads arrive than to retrofit after an incident or an unexpected invoice.
A landing zone is an operating model
The technical build is only half of it. Someone needs to own patching, cost reviews, access changes, and the decision about which new services are allowed. A landing zone that nobody operates becomes a museum piece.
We treat the handover as part of the project: runbooks, budget owners, and a short review cadence so the platform keeps matching the business.