Start from the audit questions
Who can access what, how do you know, and can you prove it six months later? A landing zone is the answer to those questions expressed as code: identity boundaries, network segmentation, guardrails and centralised, immutable logs.
The AWS shape
AWS Organizations with separate accounts per environment and workload class, Control Tower or a Terraform equivalent for guardrails, centralised CloudTrail and Config, Transit Gateway hub-and-spoke, and IAM Identity Center for people.
The Azure shape
Management groups and subscriptions per landing zone, Azure Policy for guardrails, a hub virtual network with Firewall and private endpoints, Entra ID with PIM for privileged access, and Log Analytics with immutable storage for audit.
What we standardise regardless of cloud
Everything in Terraform, no console changes in production, break-glass access with alerts, tagging enforced by policy, and a monthly evidence pack generated from the platform itself.
