{"id":23998,"date":"2026-11-02T10:46:25","date_gmt":"2026-11-02T10:46:25","guid":{"rendered":"https:\/\/dianapps.com\/blog\/?p=23998"},"modified":"2026-11-02T10:46:45","modified_gmt":"2026-11-02T10:46:45","slug":"aws-landing-zone-and-control-tower","status":"publish","type":"post","link":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/","title":{"rendered":"AWS Landing Zone and Control Tower: Setting Up a Multi-Account Foundation Properly"},"content":{"rendered":"<p><b>Key Takeaways:<\/b><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">An AWS landing zone is the pre-configured, multi-account foundation where security, identity, networking, logging, and billing rules are set before any workload goes live.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">AWS Control Tower automates the setup and ongoing governance of a landing zone using AWS Organizations, IAM Identity Center, preventive controls, and detective controls.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A clear AWS multi-account strategy separates security, logging, shared services, workloads, and sandboxes into their own organizational units, limiting the blast radius of any mistake.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Following AWS Organizations best practices means using SCPs as guardrails, centralising logs in a Log Archive account and keeping the management account free from workloads.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A cloud consulting company can help through advisory, delivery, or managed engagements, and the right choice depends on in-house skills, timelines, and long-term operating capacity.<\/span><\/li>\n<\/ul>\n<blockquote><p><b>Quick Answer:<\/b><span style=\"font-weight: 400;\"> Setting up an AWS landing zone properly means building a multi-account environment where accounts are grouped into organizational units, guardrails are applied through service control policies, access is managed centrally through IAM Identity Center, and logs from every account are flowing into a dedicated Log Archive account. AWS Control Tower is automating most of this setup, while networking, cost governance, and custom controls still need careful planning based on the business\u2019s own security, compliance, and growth requirements.<\/span><\/p><\/blockquote>\n<p><span style=\"font-weight: 400;\">For most businesses, the AWS journey is starting with a single account, where developers are launching servers, testing new features, and storing customer data side by side, and for the first few months everything is working well enough. If you are still getting familiar with the platform itself, our guide on <\/span><a href=\"https:\/\/dianapps.com\/blog\/what-is-aws\/\"><span style=\"font-weight: 400;\">what AWS is<\/span><\/a><span style=\"font-weight: 400;\"> and how it works covers the basics, but once the team is growing, new products are launching, and auditors are asking questions, that single account is quickly turning into a tangled setup where nobody is fully sure who has access to what.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Inefficiencies like these don\u2019t just slow down the engineering team; they also create real security and compliance risks, as a single misconfigured permission is able to expose production data and a single forgotten test environment is able to inflate the bill for the entire business. This is why organisations are now moving towards an AWS landing zone, a properly structured multi-account foundation that is giving every team its own space while keeping security, identity, logging and billing under central control.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">But what does an AWS landing zone actually include, and how is AWS Control Tower helping businesses build one without months of manual configuration work? Let\u2019s break it down step by step, from the basic definition to the account structure, guardrails, and the role a cloud consulting company is playing in getting it right.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">What Is an AWS Landing Zone?<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">An AWS landing zone is a pre-configured, secure, and scalable multi-account AWS environment, giving businesses a ready foundation where new workloads can be deployed without rethinking identity, networking, logging, and governance each and every time. AWS itself is describing a landing zone as a well-architected, multi-account environment built around security and compliance best practices, with AWS Control Tower automating its setup through integrations for identity, federated access, and account structure.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The easiest way to understand it is to think about an airport, where planes are not landing anywhere they like, as runways, control towers, security checks, and terminals are all set up first, so that every flight is arriving safely and following the same rules. In the same way, an AWS landing zone is preparing the runways for your cloud, and it typically includes the following core building blocks:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Account Structure:<\/b><span style=\"font-weight: 400;\"> Separate AWS accounts for security, logging, shared services, production, development, and sandbox work, grouped into organizational units.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Guardrails:<\/b><span style=\"font-weight: 400;\"> Preventive and detective controls that stop risky actions and flag non-compliant resources across every account in the organization.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Identity and Access:<\/b><span style=\"font-weight: 400;\"> Centralised sign-in through IAM Identity Center, with permission sets that give each user only the access their role actually needs.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Networking:<\/b><span style=\"font-weight: 400;\"> A planned IP address scheme, shared connectivity, and controlled internet access that connects workloads without exposing them unnecessarily to outside threats.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Logging and Monitoring:<\/b><span style=\"font-weight: 400;\"> Organization-wide CloudTrail and AWS Config data flowing into a dedicated, tamper-resistant Log Archive account for audits and investigations.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Cost Governance:<\/b><span style=\"font-weight: 400;\"> Consolidated billing, tagging rules, budgets, and alerts that are showing exactly which team, product, or environment is driving the cloud spend.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Once these building blocks are in place, every new account is created with the same baseline, which is saving time for engineering teams and giving security teams the confidence that nothing is being launched outside the agreed rules.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">It is also worth noting that the older AWS Landing Zone solution, which was a deployable reference implementation, is no longer the recommended path for new setups, as AWS has stopped its active development and is advising customers to transition to AWS Control Tower.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">The Challenges of Running Everything in a Single AWS Account<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Before looking at how a multi-account foundation works, it is important to understand why the single-account approach is failing so many growing businesses, and the reasons are not hard to see once the workloads start piling up.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Running production, testing, and experiments inside one AWS account usually creates a long list of operational problems, resulting in:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Shared Blast Radius:<\/b><span style=\"font-weight: 400;\"> A single compromised credential or faulty script is able to affect production, staging, and development resources all at once.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Permission Sprawl:<\/b><span style=\"font-weight: 400;\"> IAM policies are becoming so complex over time that nobody is confidently able to say who can access sensitive data.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Unclear Cost Ownership:<\/b><span style=\"font-weight: 400;\"> Bills are arriving as one large number, making it difficult to see which product, client, or team is responsible for spending.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Compliance Gaps:<\/b><span style=\"font-weight: 400;\"> Auditors are struggling to verify controls when regulated workloads are sitting next to experimental projects inside the same account boundary.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Service Quota Limits:<\/b><span style=\"font-weight: 400;\"> Teams are competing for the same per-account service limits, which is slowing down deployments during busy release cycles.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Problems like these don\u2019t just frustrate the cloud team; they also affect brand perception, as a single data exposure or prolonged outage gives customers a poor impression that can take years to repair. This is why modern businesses are treating account separation as a real security boundary, and this is exactly where AWS Control Tower is stepping in.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">How AWS Control Tower Builds and Governs Your AWS Landing Zone<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">AWS Control Tower is the managed service that is automating the creation of an AWS landing zone, sitting on top of AWS Organizations and bringing account provisioning, guardrails, and compliance visibility into a single dashboard that both cloud and security teams are able to use.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When the landing zone is first set up, AWS Control Tower typically creates a Security organizational unit with two shared accounts, a Log Archive account for centralised logs and an Audit account for security tooling, while the management account stays at the top of the organization. Here is what AWS Control Tower is bringing to the table for businesses building their first multi-account environment, including:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Account Factory:<\/b><span style=\"font-weight: 400;\"> A standardised way to create new AWS accounts that are automatically enrolled with the right baseline, network settings, and access.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Controls Library:<\/b><span style=\"font-weight: 400;\"> Hundreds of managed preventive, detective, and proactive controls that are mapped to common security and compliance frameworks out of the box.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Compliance Dashboard:<\/b><span style=\"font-weight: 400;\"> A central view showing which accounts and organizational units are drifting from the agreed controls, so issues are fixed quickly.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Drift Detection:<\/b><span style=\"font-weight: 400;\"> Alerts whenever someone is changing the landing zone configuration manually, helping teams keep the baseline consistent across every enrolled account.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Account Factory for Terraform:<\/b><span style=\"font-weight: 400;\"> A GitOps-friendly option for teams that prefer to provision and customise accounts using Terraform pipelines instead of the console.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">And that is not all, as landing zone version 4.0, released on November 17, 2025, is making service integrations optional and introducing a controls-only experience, which means businesses with an existing AWS Organizations setup are now able to adopt AWS Control Tower governance without accepting every default that older versions were enforcing. The same release window also saw AWS Control Tower adding support for seven new compliance frameworks along with 279 additional AWS Config rules, giving regulated businesses far more coverage without writing custom rules themselves.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">From a cost point of view, AWS Control Tower itself is not carrying any additional charge, but businesses are paying for the underlying services it is enabling, such as AWS Config, CloudTrail, Amazon S3 storage, KMS keys, and any VPC components created through Account Factory.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">AWS Control Tower vs Custom Landing Zone vs Landing Zone Accelerator<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Not every business is building its AWS landing zone in the same way, as some are relying fully on AWS Control Tower, some are building custom foundations with Terraform, and highly regulated organisations are often using the Landing Zone Accelerator on AWS alongside AWS Control Tower.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Here is a quick comparison of the three approaches to help you decide which one fits your current stage of cloud maturity:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>Feature<\/b><\/td>\n<td><b>AWS Control Tower<\/b><\/td>\n<td><b>Custom (Terraform\/CDK)<\/b><\/td>\n<td><b>Landing Zone Accelerator<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Setup Time<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Hours to Days<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Weeks to Months<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Days to Weeks<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Governance<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Managed Controls and Dashboard<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Fully Self-Built<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Control Tower Plus Extended Configs<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Flexibility<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Moderate, Improved in v4.0<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Very High<\/span><\/td>\n<td><span style=\"font-weight: 400;\">High Through Config Files<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Maintenance<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Largely Handled by AWS<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Your Own Team<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Shared, Config-Driven<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Compliance Focus<\/span><\/td>\n<td><span style=\"font-weight: 400;\">General Best Practices<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Depends on Build<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Healthcare, Finance, Public Sector<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Best Fit<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Most Businesses<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Unique, Complex Needs<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Regulated Industries<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">For most growing businesses, AWS Control Tower is definitely the right starting point, as it provides a well-governed foundation quickly, while the custom route only makes sense when the business has strong in-house platform engineering skills and requirements that the managed service is simply not covering.<\/span><\/p>\n<div style=\"background: #EEF2FE; border: 1px solid #DBE2FB; border-radius: 14px; padding: 28px 32px; margin: 38px 0;\">\n<p style=\"color: #1b3fae; font-size: 22px; line-height: 1.3; font-weight: bold; margin: 0 0 10px;\"><span style=\"font-weight: 400;\"><b>Not Sure Which Landing Zone Approach Fits Your Business?<\/b><\/span><\/p>\n<p style=\"color: #4b5563; font-size: 16px; line-height: 1.6; margin: 0 0 22px;\"><span style=\"font-weight: 400;\">Our AWS experts are assessing your current accounts, compliance needs, and growth plans to recommend the right AWS landing zone setup from day one.<\/span><\/p>\n<p><a style=\"display: inline-block; background: #2563EB; color: #ffffff; text-decoration: none; font-size: 15px; font-weight: 600; padding: 13px 26px; border-radius: 8px;\" href=\"https:\/\/dianapps.com\/contact\">Talk to Our AWS Experts\u00a0\u2192<\/a><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<h2><span style=\"font-weight: 400;\">Designing an AWS Multi-Account Strategy That Scales<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">A good AWS multi-account strategy is not about creating as many accounts as possible; it is about grouping workloads by security needs and ownership, so that policies are applied once at the organizational unit level and inherited automatically by every account underneath.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The structure that AWS recommends, and that most mature organisations are following, is usually looking like this:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>Organizational Unit<\/b><\/td>\n<td><b>Purpose<\/b><\/td>\n<td><b>Example Accounts<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Security<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Central Security Tooling and Log Storage<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Log Archive, Audit<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Infrastructure<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Shared Networking and Platform Services<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Network Hub, Shared Services<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Workloads<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Business Applications Split by Environment<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Prod, Staging, Dev per Product<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Sandbox<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Free Experimentation With Strict Spend Limits<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Developer Sandboxes<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Policy Staging<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Testing SCPs Before Production Rollout<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Policy Test Accounts<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Suspended<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Holding Closed or Quarantined Accounts<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Decommissioned Accounts<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">A few principles are keeping this AWS multi-account strategy clean and manageable as the business keeps growing, such as:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>One Workload Per Account:<\/b><span style=\"font-weight: 400;\"> Giving each application environment its own account is keeping the blast radius small and making cost ownership very clear.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Shallow OU Hierarchy:<\/b><span style=\"font-weight: 400;\"> Keeping organizational units only two or three levels deep is making policy inheritance easier to understand, troubleshoot, and audit.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Separate Production and Non-Production:<\/b><span style=\"font-weight: 400;\"> Placing production accounts under their own OU is allowing stricter guardrails without slowing down developers in lower environments.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Consistent Naming and Tagging:<\/b><span style=\"font-weight: 400;\"> Following one naming convention for accounts, emails, and tags is helping finance, security, and operations teams speak the same language.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">This is why the account structure is extremely crucial to decide early, as moving workloads between accounts later is costly, disruptive, and often requires changes inside the applications themselves.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">AWS Organizations Best Practices for a Secure Foundation<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">AWS Organizations is the service sitting underneath every AWS landing zone, and following AWS Organizations best practices is what separates a foundation that is truly secure from one that only looks organised on paper, so let\u2019s take a look at the areas that matter the most.<\/span><\/p>\n<h3><span style=\"font-weight: 400;\">Service Control Policies and Guardrails<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Service control policies, or SCPs, set the maximum permissions available in an account, which means even an administrator inside a member account is not able to perform an action that an SCP is denying, making them the strongest preventive guardrail available. The most commonly used SCPs in a well-designed AWS landing zone include the following guardrails:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Region Restriction:<\/b><span style=\"font-weight: 400;\"> Denying the use of AWS Regions where the business is not operating, which supports data residency and reduces the attack surface.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Root User Lockdown:<\/b><span style=\"font-weight: 400;\"> Blocking root user actions in member accounts, so that nobody is using the most powerful credentials for daily work.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Security Service Protection:<\/b><span style=\"font-weight: 400;\"> Preventing anyone from disabling CloudTrail, AWS Config, GuardDuty, or Security Hub inside workload and sandbox accounts.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Organization Exit Prevention:<\/b><span style=\"font-weight: 400;\"> Stopping accounts from leaving AWS Organizations, which keeps every account under central governance and consolidated billing at all times.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Resource control policies also complement SCPs by setting maximum permissions on resources such as S3 buckets and KMS keys, which helps block access from identities that sit outside your organization. It is always better to test new SCPs in a Policy Staging OU first, as a single badly written deny statement is able to break production deployments across dozens of accounts within minutes.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-24005\" src=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Multi-Account-Reality-Check-1.webp\" alt=\"84% of organisations use multiple AWS accounts, but only 40% apply service control policies and 6% use resource control policies\" width=\"1672\" height=\"941\" srcset=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Multi-Account-Reality-Check-1.webp 1672w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Multi-Account-Reality-Check-1-1024x576.webp 1024w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Multi-Account-Reality-Check-1-768x432.webp 768w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Multi-Account-Reality-Check-1-1536x864.webp 1536w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Multi-Account-Reality-Check-1-640x360.webp 640w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Multi-Account-Reality-Check-1-400x225.webp 400w\" sizes=\"auto, (max-width: 1672px) 100vw, 1672px\" \/><\/p>\n<h3><span style=\"font-weight: 400;\">Centralised Identity With IAM Identity Center<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Long-lived IAM users with access keys are one of the most common causes of cloud breaches, which is why AWS Organizations best practices are recommending IAM Identity Center as the single place where people are signing in to every account. IAM Identity Center connects with existing identity providers like Microsoft Entra ID, Okta, or Google Workspace, and permission sets such as ReadOnly, Developer, or SecurityAuditor are being assigned to groups, so access follows each employee\u2019s role automatically.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When someone is joining or leaving the business, access is being granted or removed in one place, which is saving hours for the IT team and closing the gap that orphaned credentials are usually creating.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-24004\" src=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Identity-Risk-Infographic-1.webp\" alt=\"59% of AWS IAM users have access keys over a year old, and 39% of organisations still use IAM user logins\" width=\"1672\" height=\"941\" srcset=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Identity-Risk-Infographic-1.webp 1672w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Identity-Risk-Infographic-1-1024x576.webp 1024w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Identity-Risk-Infographic-1-768x432.webp 768w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Identity-Risk-Infographic-1-1536x864.webp 1536w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Identity-Risk-Infographic-1-640x360.webp 640w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/AWS-Identity-Risk-Infographic-1-400x225.webp 400w\" sizes=\"auto, (max-width: 1672px) 100vw, 1672px\" \/><\/p>\n<h3><span style=\"font-weight: 400;\">Network Architecture Across Accounts<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Networking is often the part of an AWS landing zone that is planned too late, resulting in overlapping IP ranges, duplicated NAT gateways, and complicated peering connections that are difficult to untangle later. A well-planned network foundation that supports growth without constant redesign usually includes the following components:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>IP Address Planning:<\/b><span style=\"font-weight: 400;\"> Using Amazon VPC IP Address Manager to allocate non-overlapping CIDR ranges across every account, region, and on-premises network.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Hub-and-Spoke Connectivity:<\/b><span style=\"font-weight: 400;\"> Connecting workload VPCs through AWS Transit Gateway in a dedicated network account instead of building dozens of peering links.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Centralised Egress and Inspection:<\/b><span style=\"font-weight: 400;\"> Routing internet-bound traffic through shared NAT gateways and AWS Network Firewall, which is reducing cost and improving visibility.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Hybrid Connectivity:<\/b><span style=\"font-weight: 400;\"> Terminating Site-to-Site VPN or AWS Direct Connect links in the network account, so on-premises access is managed in one place.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Planning the network this way not only reduces data transfer and NAT costs, but also gives security teams a single point where traffic is being inspected and logged.<\/span><\/p>\n<h3><span style=\"font-weight: 400;\">Centralised Logging and Security Monitoring<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Logs are only useful when they are complete, protected, and easy to search, which is why every AWS landing zone should be sending organization-wide CloudTrail logs and AWS Config data to the Log Archive account, where S3 Object Lock and restricted access are protecting them from tampering.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">On the monitoring side, services like Amazon GuardDuty, AWS Security Hub, IAM Access Analyzer, and Amazon Inspector are being enabled across all accounts through delegated administration in the Audit account, so the security team is seeing findings from the entire organization in one dashboard. This setup is also making audits much easier, as evidence for frameworks like ISO 27001, SOC 2, and PCI DSS is already sitting in one place, and our <\/span><a href=\"https:\/\/dianapps.com\/cloud-security-services\"><span style=\"font-weight: 400;\">cloud security services<\/span><\/a><span style=\"font-weight: 400;\"> team is helping businesses configure this monitoring layer correctly.<\/span><\/p>\n<h3><span style=\"font-weight: 400;\">Cost Visibility and Governance<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">A multi-account structure is naturally improving cost visibility, as AWS Organizations is consolidating billing across every account while still showing exactly how much each account, and therefore each team or product, is spending. To keep cloud spend predictable as the number of accounts is growing, the landing zone should also include:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Tag Policies:<\/b><span style=\"font-weight: 400;\"> Enforcing mandatory tags like cost center, owner, and environment, so every resource is traceable to a team and budget.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>AWS Budgets and Alerts:<\/b><span style=\"font-weight: 400;\"> Setting per-account and per-OU budgets that notify owners before spending crosses agreed limits, not after the invoice arrives.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Cost Categories and Reports:<\/b><span style=\"font-weight: 400;\"> Grouping accounts into business units and sending Cost and Usage Reports to a central account for finance analysis.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Sandbox Spend Controls:<\/b><span style=\"font-weight: 400;\"> Applying strict budgets and automated clean-up to sandbox accounts, where forgotten experiments are usually generating the most waste.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Savings Plans and Reserved Instances are also being shared across the organization by default, which means discounts purchased centrally are benefiting every eligible account without any extra effort from individual teams.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Step-by-Step Process for Setting Up an AWS Landing Zone<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Setting up an AWS landing zone does not have to be overwhelming, as long as the business is following a clear sequence instead of creating accounts first and thinking about governance later, and the process usually looks like this:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Assess Requirements:<\/b><span style=\"font-weight: 400;\"> Documenting compliance frameworks, data residency needs, existing accounts, identity providers, and expected workloads before any configuration begins.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Design the Account Structure:<\/b><span style=\"font-weight: 400;\"> Defining organizational units, account naming, email aliases, and ownership based on the AWS multi-account strategy agreed with stakeholders.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Prepare the Management Account:<\/b><span style=\"font-weight: 400;\"> Securing the root user with MFA, setting billing alerts, and keeping the account strictly free from application workloads.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Deploy AWS Control Tower:<\/b><span style=\"font-weight: 400;\"> Launching the landing zone in the home Region, selecting governed regions, and configuring the Log Archive and Audit accounts.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Configure Identity:<\/b><span style=\"font-weight: 400;\"> Connecting IAM Identity Center to the corporate identity provider and creating permission sets mapped to job roles and groups.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Apply Controls and SCPs:<\/b><span style=\"font-weight: 400;\"> Enabling recommended controls, adding custom SCPs for Region and root restrictions, and testing them in a staging OU first.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Build the Network Foundation:<\/b><span style=\"font-weight: 400;\"> Deploying the network account, Transit Gateway, IPAM pools, and centralised egress before the first workload account is created.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Automate Account Vending:<\/b><span style=\"font-weight: 400;\"> Using Account Factory or Account Factory for Terraform, so every new account arrives with the same secure baseline.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Enrol Existing Accounts:<\/b><span style=\"font-weight: 400;\"> Moving existing accounts into the right OUs gradually, fixing drift and non-compliant resources carefully along the way.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">If you are still deciding on the home Region, our guide on <\/span><a href=\"https:\/\/dianapps.com\/blog\/aws-regions-and-availability-zones\/\"><span style=\"font-weight: 400;\">AWS Regions and Availability Zones<\/span><\/a><span style=\"font-weight: 400;\"> compares the best options for India, Australia, the UAE, and the US. For businesses that already have workloads running, the enrollment step is usually the most sensitive one, and our <\/span><a href=\"https:\/\/dianapps.com\/cloud-migration-services\"><span style=\"font-weight: 400;\">cloud migration services<\/span><\/a><span style=\"font-weight: 400;\"> are helping teams move existing accounts and applications into the new structure without unplanned downtime.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Common Mistakes That Weaken an AWS Landing Zone<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Even with AWS Control Tower doing most of the heavy lifting, many businesses are still making a few avoidable mistakes that are quietly weakening their AWS landing zone over time, such as:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Running workloads in the management account, which is placing the most privileged account directly in the path of everyday deployment risk.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Creating IAM users with long-term access keys instead of using IAM Identity Center and temporary credentials for every person.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Applying SCPs directly to production without testing, which is breaking pipelines and forcing emergency rollbacks across multiple accounts at once.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Making manual changes to Control Tower resources, which is causing drift and blocking future landing zone updates until it is repaired.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Ignoring IP address planning until later, which is resulting in overlapping CIDR ranges that are making connectivity extremely difficult to fix.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Skipping tagging rules at the start, which is leaving finance teams unable to allocate cloud costs to the right products or clients.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Each of these mistakes is easy to prevent with the right plan, and avoiding them early is saving a lot of rework, audit stress, and unexpected spending later on.<\/span><\/p>\n<div style=\"background: #EEF2FE; border: 1px solid #DBE2FB; border-radius: 14px; padding: 28px 32px; margin: 38px 0;\">\n<p style=\"color: #1b3fae; font-size: 22px; line-height: 1.3; font-weight: bold; margin: 0 0 10px;\"><span style=\"font-weight: 400;\"><b>Build Your AWS Landing Zone the Right Way From Day One<\/b><\/span><\/p>\n<p style=\"color: #4b5563; font-size: 16px; line-height: 1.6; margin: 0 0 22px;\"><span style=\"font-weight: 400;\">From account structure and SCPs to Identity Center, networking and centralised logging, our certified team is designing and deploying multi-account foundations that are secure, compliant and ready to scale.<\/span><\/p>\n<p><a style=\"display: inline-block; background: #2563EB; color: #ffffff; text-decoration: none; font-size: 15px; font-weight: 600; padding: 13px 26px; border-radius: 8px;\" href=\"https:\/\/dianapps.com\/contact\">Get a Free Consultation\u00a0\u2192<\/a><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<h2><span style=\"font-weight: 400;\">What Do Cloud Consultants Do in a Landing Zone Project?<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">A lot of business leaders are asking what cloud consultants do once the decision to build a landing zone has been made, and the answer is that their role goes far beyond clicking through the AWS Control Tower setup wizard. A capable cloud consulting company is usually translating business, security, and compliance requirements into an account design, writing infrastructure as code, configuring guardrails, training internal teams, and documenting every decision, so the foundation stays maintainable long after the project is closed.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If you want a broader view of how these engagements work in general, our guide on <\/span><a href=\"https:\/\/dianapps.com\/blog\/cloud-consulting-services-explained\/\"><span style=\"font-weight: 400;\">cloud consulting services\u00a0<\/span><\/a><span style=\"font-weight: 400;\"><span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\"><a href=\"https:\/\/dianapps.com\/blog\/cloud-consulting-services-explained\/\" target=\"_blank\" rel=\"noopener\">explains<\/a><\/span>\u00a0what you are actually buying in much more detail.<\/span><\/p>\n<h3><span style=\"font-weight: 400;\">Advisory vs Delivery vs Managed Engagements<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Cloud advisory services, hands-on delivery, and ongoing managed services are three very different engagement models, and knowing the difference helps businesses pay only for what they actually need.<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>Aspect<\/b><\/td>\n<td><b>Advisory<\/b><\/td>\n<td><b>Delivery<\/b><\/td>\n<td><b>Managed<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Primary Goal<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Strategy and Design<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Build and Deploy<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Operate and Improve<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Typical Output<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Architecture and Roadmap<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Working Landing Zone in Code<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Ongoing Monitoring and Updates<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Duration<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Short, Fixed Scope<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Project-Based<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Ongoing, Monthly<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Who Executes<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Your Internal Team<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Consultant\u2019s Engineers<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Provider\u2019s Operations Team<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Pricing Model<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Fixed Fee or Daily Rate<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Fixed Fee or Milestones<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Monthly Retainer<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Best For<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Teams With Strong In-House Skills<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Teams Needing Speed and Expertise<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Teams Without Cloud Ops Staff<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">In practice, many businesses are starting with cloud advisory services to validate the design, moving into delivery for the actual build, and then deciding whether to run the environment themselves or hand it over to<\/span> <a href=\"https:\/\/dianapps.com\/cloud-managed-services\"><span style=\"font-weight: 400;\">cloud managed services<\/span><\/a><span style=\"font-weight: 400;\"> for day-to-day operations.<\/span><\/p>\n<h3><span style=\"font-weight: 400;\">Deliverables You Should Expect From a Cloud Consulting Company<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Whichever model is chosen, a professional cloud consulting company should be handing over clear, tangible deliverables rather than just a working console, including:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Architecture Document:<\/b><span style=\"font-weight: 400;\"> A written design covering OU structure, account list, network layout, identity model, and the reasoning behind each decision.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Infrastructure as Code:<\/b><span style=\"font-weight: 400;\"> Terraform, CloudFormation, or CDK repositories that recreate the entire landing zone, stored in your own version control.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Guardrail Catalogue:<\/b><span style=\"font-weight: 400;\"> A list of every enabled control and SCP, mapped to the compliance requirement or business risk it is addressing.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Runbooks:<\/b><span style=\"font-weight: 400;\"> Step-by-step operating procedures for account vending, access requests, incident response, and landing zone version upgrades.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Knowledge Transfer:<\/b><span style=\"font-weight: 400;\"> Hands-on sessions that are preparing your internal team to operate, extend, and troubleshoot the foundation confidently.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">If any of these deliverables are missing from a proposal, it is definitely worth asking why, as a landing zone without code and documentation is becoming a black box the moment the consultants leave.<\/span><\/p>\n<h3><span style=\"font-weight: 400;\">Pricing Models for Cloud Advisory Services<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Pricing for cloud advisory services and landing zone delivery varies widely, as the final cost depends on the number of accounts, compliance frameworks, network complexity, existing workloads to migrate, and the level of automation expected. Most providers are pricing landing zone and advisory engagements through one of the following commercial models:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Fixed-Fee Packages:<\/b><span style=\"font-weight: 400;\"> A set price for a clearly defined scope, which provides predictability but requires very precise requirements upfront.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Time and Materials:<\/b><span style=\"font-weight: 400;\"> Billing by hours or days spent, which offers flexibility for evolving requirements but needs closer budget tracking.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Milestone-Based Pricing:<\/b><span style=\"font-weight: 400;\"> Payments tied to completed phases like design, deployment, and handover, which balances risk between both parties.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Monthly Retainers:<\/b><span style=\"font-weight: 400;\"> A recurring fee for managed operations, covering monitoring, updates, account vending, and compliance reporting every single month.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">For reference, one AWS Marketplace listing for an AI-ready Control Tower landing zone is openly publishing package tiers at $75K, $125K and $175K, although simpler foundations for smaller businesses can cost considerably less depending on scope. Startups should also go through our guide on <\/span><a href=\"https:\/\/dianapps.com\/blog\/aws-activate-credits-for-startups\/\"><span style=\"font-weight: 400;\">AWS Activate credits<\/span><\/a><span style=\"font-weight: 400;\">, as credits sometimes cover part of the underlying infrastructure costs during the early stages.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">How to Choose the Right Cloud Consulting Company for Your AWS Landing Zone<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Choosing a partner for something as foundational as an AWS landing zone is really important, as the decisions made in the first few weeks are shaping security, cost, and agility for years. Once you are clear on what cloud consultants do in such projects, the key things to look for before signing a contract are:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Proven experience applying AWS Organizations best practices and AWS Control Tower for businesses of a similar size, industry, and compliance level.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Infrastructure as code delivery by default, with all repositories and documentation owned by your business rather than the provider.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Clear separation between advisory, delivery and managed scopes, so you are not paying for ongoing services you never needed.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Certified AWS architects and security specialists working on the project, rather than generalist engineers learning the platform on your budget.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Transparent pricing with defined deliverables, change-request rules, and a handover plan agreed before the project begins.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">At DianApps, our<\/span> <a href=\"https:\/\/dianapps.com\/aws-services\"><span style=\"font-weight: 400;\">AWS cloud services<\/span><\/a><span style=\"font-weight: 400;\"> teams are covering the complete journey, from landing zone design to delivery, migration, and long-term management, so businesses are getting one accountable partner instead of juggling several vendors.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Final Thoughts<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">An AWS landing zone is no longer something only large enterprises are building, as every business that is expecting to grow on AWS is benefiting from separating workloads into accounts, applying guardrails centrally, managing identity in one place, and keeping logs safe from the very first day. AWS Control Tower is making this foundation much easier to set up and govern, especially with landing zone 4.0 giving more flexibility, but the real value is still coming from the design decisions around account structure, SCPs, networking, logging, and cost governance.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The businesses that are taking time to plan their AWS multi-account strategy properly are the ones scaling confidently without surprise bills, audit panic, or messy migrations later, and whether your team is building in-house or working with a cloud consulting company, getting these basics right is definitely going to pay off for years. And if you need a helping hand along the way, our team is always here to guide you from beginning until completion.<\/span><\/p>\n<div style=\"background: #EEF2FE; border: 1px solid #DBE2FB; border-radius: 14px; padding: 28px 32px; margin: 38px 0;\">\n<p style=\"color: #1b3fae; font-size: 22px; line-height: 1.3; font-weight: bold; margin: 0 0 10px;\"><span style=\"font-weight: 400;\"><b>Ready to Set Up a Secure Multi-Account Foundation on AWS?<\/b><\/span><\/p>\n<p style=\"color: #4b5563; font-size: 16px; line-height: 1.6; margin: 0 0 22px;\"><span style=\"font-weight: 400;\">Our AWS experts are helping businesses build landing zones that are secure, compliant, and cost-efficient.<\/span><\/p>\n<p><a style=\"display: inline-block; background: #2563EB; color: #ffffff; text-decoration: none; font-size: 15px; font-weight: 600; padding: 13px 26px; border-radius: 8px;\" href=\"https:\/\/dianapps.com\/contact\">Contact Our Team\u00a0\u2192<\/a><\/p>\n<\/div>\n<style>.elementor-23999 .elementor-element.elementor-element-2932a52{text-align:left;}.elementor-23999 .elementor-element.elementor-element-2932a52 > .elementor-widget-container{margin:0px 0px 0px 0px;}.elementor-23999 .elementor-element.elementor-element-0b767d1 .elementor-tab-title{border-width:1px;border-color:#00000014;}.elementor-23999 .elementor-element.elementor-element-0b767d1 .elementor-tab-content{border-width:1px;border-bottom-color:#00000014;}.elementor-23999 .elementor-element.elementor-element-0b767d1 > .elementor-widget-container{margin:0px 0px 0px 0px;}<\/style><div class=\"porto-block elementor elementor-23999\">\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-27707ca elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"27707ca\" data-element_type=\"section\">\r\n\t\t\t\r\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\r\n\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0163611\" data-id=\"0163611\" data-element_type=\"column\">\r\n\r\n\t\t\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\r\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-03a2969 elementor-widget elementor-widget-text-editor\" data-id=\"03a2969\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.14.0 - 26-06-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2932a52 elementor-widget elementor-widget-heading\" data-id=\"2932a52\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.14.0 - 26-06-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-large\">FAQs <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0b767d1 elementor-widget elementor-widget-toggle\" data-id=\"0b767d1\" data-element_type=\"widget\" data-widget_type=\"toggle.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.14.0 - 26-06-2023 *\/\n.elementor-toggle{text-align:left}.elementor-toggle .elementor-tab-title{font-weight:700;line-height:1;margin:0;padding:15px;border-bottom:1px solid #d5d8dc;cursor:pointer;outline:none}.elementor-toggle .elementor-tab-title .elementor-toggle-icon{display:inline-block;width:1em}.elementor-toggle .elementor-tab-title .elementor-toggle-icon svg{-webkit-margin-start:-5px;margin-inline-start:-5px;width:1em;height:1em}.elementor-toggle .elementor-tab-title .elementor-toggle-icon.elementor-toggle-icon-right{float:right;text-align:right}.elementor-toggle .elementor-tab-title .elementor-toggle-icon.elementor-toggle-icon-left{float:left;text-align:left}.elementor-toggle .elementor-tab-title .elementor-toggle-icon .elementor-toggle-icon-closed{display:block}.elementor-toggle .elementor-tab-title .elementor-toggle-icon .elementor-toggle-icon-opened{display:none}.elementor-toggle .elementor-tab-title.elementor-active{border-bottom:none}.elementor-toggle .elementor-tab-title.elementor-active .elementor-toggle-icon-closed{display:none}.elementor-toggle .elementor-tab-title.elementor-active .elementor-toggle-icon-opened{display:block}.elementor-toggle .elementor-tab-content{padding:15px;border-bottom:1px solid #d5d8dc;display:none}@media (max-width:767px){.elementor-toggle .elementor-tab-title{padding:12px}.elementor-toggle .elementor-tab-content{padding:12px 10px}}.e-con-inner>.elementor-widget-toggle,.e-con>.elementor-widget-toggle{width:var(--container-widget-width);--flex-grow:var(--container-widget-flex-grow)}<\/style>\t\t<div class=\"elementor-toggle\">\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1201\" class=\"elementor-tab-title\" data-tab=\"1\" role=\"button\" aria-controls=\"elementor-tab-content-1201\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">What is an AWS landing zone?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1201\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"1\" role=\"region\" aria-labelledby=\"elementor-tab-title-1201\"><p>An AWS landing zone is a secure, pre-configured multi-account AWS environment with built-in identity, networking, logging, guardrails, and billing governance.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1202\" class=\"elementor-tab-title\" data-tab=\"2\" role=\"button\" aria-controls=\"elementor-tab-content-1202\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">What is the difference between an AWS landing zone and AWS Control Tower?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1202\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"2\" role=\"region\" aria-labelledby=\"elementor-tab-title-1202\"><p>An AWS landing zone is the multi-account environment itself, while AWS Control Tower is the managed service that automates its setup and governance.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1203\" class=\"elementor-tab-title\" data-tab=\"3\" role=\"button\" aria-controls=\"elementor-tab-content-1203\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Is AWS Control Tower free to use?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1203\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"3\" role=\"region\" aria-labelledby=\"elementor-tab-title-1203\"><p>AWS Control Tower has no additional charge, but you are paying for underlying services it enables, such as AWS Config, CloudTrail, S3, and KMS.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1204\" class=\"elementor-tab-title\" data-tab=\"4\" role=\"button\" aria-controls=\"elementor-tab-content-1204\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">How many AWS accounts should a business start with?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1204\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"4\" role=\"region\" aria-labelledby=\"elementor-tab-title-1204\"><p>Most businesses are starting with management, Log Archive, Audit, network, and shared services accounts, plus separate production and non-production workload accounts.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1205\" class=\"elementor-tab-title\" data-tab=\"5\" role=\"button\" aria-controls=\"elementor-tab-content-1205\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">What are SCPs in AWS Organizations?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1205\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"5\" role=\"region\" aria-labelledby=\"elementor-tab-title-1205\"><p>Service control policies are organization-level guardrails that define the maximum permissions any user or role can have within member accounts.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1206\" class=\"elementor-tab-title\" data-tab=\"6\" role=\"button\" aria-controls=\"elementor-tab-content-1206\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Can AWS Control Tower be added to an existing AWS Organization?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1206\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"6\" role=\"region\" aria-labelledby=\"elementor-tab-title-1206\"><p>Yes, AWS Control Tower can be deployed on a new or an existing AWS Organization, and existing accounts can be enrolled gradually after fixing conflicting resources.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1207\" class=\"elementor-tab-title\" data-tab=\"7\" role=\"button\" aria-controls=\"elementor-tab-content-1207\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">How long does it take to set up an AWS landing zone?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1207\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"7\" role=\"region\" aria-labelledby=\"elementor-tab-title-1207\"><p>The initial AWS Control Tower deployment can take up to an hour, while a fully customised foundation with networking, migration and automation usually takes several weeks.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1208\" class=\"elementor-tab-title\" data-tab=\"8\" role=\"button\" aria-controls=\"elementor-tab-content-1208\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">What do cloud consultants do?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1208\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"8\" role=\"region\" aria-labelledby=\"elementor-tab-title-1208\"><p>Cloud consultants are designing, building, securing, and optimising cloud environments, translating business and compliance requirements into architecture, code, guardrails, and operating procedures<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is an AWS landing zone?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p>An AWS landing zone is a secure, pre-configured multi-account AWS environment with built-in identity, networking, logging, guardrails, and billing governance.<\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"What is the difference between an AWS landing zone and AWS Control Tower?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p>An AWS landing zone is the multi-account environment itself, while AWS Control Tower is the managed service that automates its setup and governance.<\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Is AWS Control Tower free to use?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p>AWS Control Tower has no additional charge, but you are paying for underlying services it enables, such as AWS Config, CloudTrail, S3, and KMS.<\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"How many AWS accounts should a business start with?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p>Most businesses are starting with management, Log Archive, Audit, network, and shared services accounts, plus separate production and non-production workload accounts.<\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"What are SCPs in AWS Organizations?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p>Service control policies are organization-level guardrails that define the maximum permissions any user or role can have within member accounts.<\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Can AWS Control Tower be added to an existing AWS Organization?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p>Yes, AWS Control Tower can be deployed on a new or an existing AWS Organization, and existing accounts can be enrolled gradually after fixing conflicting resources.<\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"How long does it take to set up an AWS landing zone?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p>The initial AWS Control Tower deployment can take up to an hour, while a fully customised foundation with networking, migration and automation usually takes several weeks.<\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"What do cloud consultants do?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p>Cloud consultants are designing, building, securing, and optimising cloud environments, translating business and compliance requirements into architecture, code, guardrails, and operating procedures<\\\/p>\"}}]}<\/script>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\r\n\t\t\t\t<\/div>\r\n\t\t\t\t\t\t<\/div>\r\n\t\t\t\t<\/section>\r\n\t\t<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Key Takeaways: An AWS landing zone is the pre-configured, multi-account foundation where security, identity, networking, logging, and billing rules are set before any workload goes live. AWS Control Tower automates the setup and ongoing governance of a landing zone using AWS Organizations, IAM Identity Center, preventive controls, and detective controls. A clear AWS multi-account strategy [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":24006,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"AWS Landing Zone & Control Tower: Multi-Account Setup Guide","_yoast_wpseo_opengraph-description":"Set up an AWS landing zone with Control Tower the right way, covering account structure, SCPs, Identity Center, networking, logging, and cost control.","_yoast_wpseo_opengraph-image":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1-1024x576.webp","_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_wp_applaud_exclude":false,"footnotes":""},"categories":[2835],"tags":[2892],"class_list":["post-23998","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aws","tag-aws-landing-zone"],"featured_image_src":{"landsacpe":["https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1-1140x445.webp",1140,445,true],"list":["https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1-463x348.webp",463,348,true],"medium":["https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1-300x169.webp",300,169,true],"full":["https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1.webp",1536,864,false]},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AWS Landing Zone &amp; Control Tower: Multi-Account Setup Guide<\/title>\n<meta name=\"description\" content=\"Set up an AWS landing zone with Control Tower the right way, covering account structure, SCPs, Identity Center, networking, logging, and cost control.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AWS Landing Zone &amp; Control Tower: Multi-Account Setup Guide\" \/>\n<meta property=\"og:description\" content=\"Set up an AWS landing zone with Control Tower the right way, covering account structure, SCPs, Identity Center, networking, logging, and cost control.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/\" \/>\n<meta property=\"og:site_name\" content=\"Learn About Digital Transformation &amp; Development | DianApps Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T10:46:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-02T10:46:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"864\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Pulkit Agarwal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pulkit Agarwal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"22 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AWS Landing Zone & Control Tower: Multi-Account Setup Guide","description":"Set up an AWS landing zone with Control Tower the right way, covering account structure, SCPs, Identity Center, networking, logging, and cost control.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/","og_locale":"en_US","og_type":"article","og_title":"AWS Landing Zone & Control Tower: Multi-Account Setup Guide","og_description":"Set up an AWS landing zone with Control Tower the right way, covering account structure, SCPs, Identity Center, networking, logging, and cost control.","og_url":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/","og_site_name":"Learn About Digital Transformation &amp; Development | DianApps Blog","article_published_time":"2026-11-02T10:46:25+00:00","article_modified_time":"2026-11-02T10:46:45+00:00","og_image":[{"width":1536,"height":864,"url":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1.webp","type":"image\/webp"}],"author":"Pulkit Agarwal","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Pulkit Agarwal","Est. reading time":"22 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/#article","isPartOf":{"@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/"},"author":{"name":"Pulkit Agarwal","@id":"https:\/\/dianapps.com\/blog\/#\/schema\/person\/21673a137bba5fd5c338b15cbbc8723e"},"headline":"AWS Landing Zone and Control Tower: Setting Up a Multi-Account Foundation Properly","datePublished":"2026-11-02T10:46:25+00:00","dateModified":"2026-11-02T10:46:45+00:00","mainEntityOfPage":{"@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/"},"wordCount":4327,"commentCount":0,"image":{"@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/#primaryimage"},"thumbnailUrl":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1.webp","keywords":["aws landing zone"],"articleSection":["AWS"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/","url":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/","name":"AWS Landing Zone & Control Tower: Multi-Account Setup Guide","isPartOf":{"@id":"https:\/\/dianapps.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/#primaryimage"},"image":{"@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/#primaryimage"},"thumbnailUrl":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1.webp","datePublished":"2026-11-02T10:46:25+00:00","dateModified":"2026-11-02T10:46:45+00:00","author":{"@id":"https:\/\/dianapps.com\/blog\/#\/schema\/person\/21673a137bba5fd5c338b15cbbc8723e"},"description":"Set up an AWS landing zone with Control Tower the right way, covering account structure, SCPs, Identity Center, networking, logging, and cost control.","breadcrumb":{"@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/#primaryimage","url":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1.webp","contentUrl":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/11\/Untitled-Design-2026-11-02T110334.466-1.webp","width":1536,"height":864,"caption":"AWS Landing Zone and Control Tower"},{"@type":"BreadcrumbList","@id":"https:\/\/dianapps.com\/blog\/aws-landing-zone-and-control-tower\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/dianapps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"AWS Landing Zone and Control Tower: Setting Up a Multi-Account Foundation Properly"}]},{"@type":"WebSite","@id":"https:\/\/dianapps.com\/blog\/#website","url":"https:\/\/dianapps.com\/blog\/","name":"Learn About Digital Transformation &amp; Development | DianApps Blog","description":"Dianapps","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dianapps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/dianapps.com\/blog\/#\/schema\/person\/21673a137bba5fd5c338b15cbbc8723e","name":"Pulkit Agarwal","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/cropped-DSC_4222-1-96x96.webp","url":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/cropped-DSC_4222-1-96x96.webp","contentUrl":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/cropped-DSC_4222-1-96x96.webp","caption":"Pulkit Agarwal"},"description":"Pulkit Agarwal is an AWS-certified cloud professional holding AWS Certified Solutions Architect \u2013 Associate along with AI Practitioner \u2013 Foundational certification, with a strong interest in cloud computing, AWS technologies, and modern cloud architecture. He is passionate exploring emerging innovations and sharing technical insights to help build scalable, secure, and efficient cloud solutions.","sameAs":["https:\/\/dianapps.com\/"],"url":"https:\/\/dianapps.com\/blog\/author\/pulkit-agarwal\/"}]}},"_links":{"self":[{"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/posts\/23998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/comments?post=23998"}],"version-history":[{"count":1,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/posts\/23998\/revisions"}],"predecessor-version":[{"id":24007,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/posts\/23998\/revisions\/24007"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/media\/24006"}],"wp:attachment":[{"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/media?parent=23998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/categories?post=23998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/tags?post=23998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}