DataTerminology.comNEW
Also known as: LZ
Preconfigured, secure, and governed cloud foundation that standardizes accounts, identity, networking, and guardrails for scalable workload deployment.
DESCRIPTION
A landing zone is an opinionated cloud foundation that operationalizes best practices for identity, network, security, and governance at scale. It typically implements multi-account structures, centralized logging, standardized controls, and automation via IaC. Providers offer blueprints such as AWS Control Tower, Azure landing zones, and Google Cloud foundations. Landing zones accelerate adoption by reducing upfront design decisions and enforcing guardrails. They form the substrate for data platforms, analytics, and application workloads. Continuous evolution is required to incorporate new services, security updates, and organizational changes.
ALTERNATIVE DEFINITIONS
AWS Prescriptive Guidance
A landing zone is a well-architected, multi-account environment that is a starting point from which your organization can quickly launch and deploy workloads and applications with confidence in their security and infrastructure.
Stresses multi-account structure and security confidence.
Microsoft Cloud Adoption Framework
An Azure landing zone is an environment that accounts for scale, security, governance, networking, and identity.
Emphasizes core concerns addressed by the environment.
RELATED TERMS
Cloud Architecture Identity Management Network Segmentation Infrastructure as Code DevOps Security Baseline Guardrails Multi-Account Strategy Data Platform Governance
COMPETING TERMS
Single-Account Cloud Setup
RELATIONS
- Broader: Zone
KNOWLEDGE AREAS
Cloud Infrastructure Data Architecture Data Security Platform & Tooling Data Governance
TARGET AUDIENCE
Cloud Architect DevOps Engineer Data Engineer Enterprise Architect Chief Technology Officer Chief Information Officer Data Architect Data Governance Manager
EXTERNAL SOURCES
- AWS - AWS landing zone guidance
- Microsoft - Azure landing zone framework
- Google Cloud - Google landing zone architecture
TOP QUESTIONS
Why is a Landing Zone important for data platforms?
It standardizes identity, network, and security, enabling safe, scalable deployments. This foundation reduces rework and risk later.
Category: Relevancy
What is a common mistake when creating a Landing Zone?
Underestimating identity and access design leads to retrofits. Design roles, SSO, and least privilege early.
Category: Mistakes
How does a Landing Zone enforce governance?
It codifies guardrails like policies, logging, and tagging. Automation detects and remediates drift.
Category: Governance
What are essential components of a Landing Zone?
Multi-account structure, IAM, network segmentation, centralized logging, encryption defaults, and IaC pipelines are essential.
Category: Requirements
How does a Landing Zone support multi-tenancy?
Segregated accounts or projects with shared services provide isolation while enabling centralized control.
Category: Architecture
What is the risk of skipping a Landing Zone?
Ad-hoc environments accumulate security gaps and inconsistent configurations. Remediation later is costly and risky.
Category: Risk
How should Landing Zone updates be managed?
Treat it as product: version infrastructure code, test changes, and roll out via pipelines. Communicate breaking changes.
Category: Management
How does a Landing Zone relate to Zero Trust?
It implements identity-centric controls, segmentation, and continuous verification, aligning with Zero Trust principles.
Category: Security
Where to start building a Landing Zone?
Adopt provider blueprints, define account hierarchy, and stand up identity and network baselines. Iterate with governance guardrails.
Category: Getting started