A “landing zone” sounds like something only large enterprises need. In practice, even a three-person team benefits from a few simple structural decisions made early.
Start with accounts, not VPCs
Separate AWS accounts give you the strongest isolation boundary AWS offers. A small but solid layout:
| Account | Purpose |
|---|---|
management |
Billing and AWS Organizations only — no workloads |
security |
Central CloudTrail, GuardDuty and Security Hub |
shared |
DNS, CI/CD runners, shared artifacts |
dev / prod |
Workloads, one account per environment |
Guardrails that cost nothing
- Service Control Policies to block regions you don’t use and prevent disabling CloudTrail.
- IAM Identity Center for human access — no long-lived IAM users.
- Budgets and alerts on every account from day one.
Keep it as code
Whatever you build, build it with Terraform or CloudFormation. The first time you need a new environment, you’ll be glad it’s a pull request and not an afternoon of clicking.
