Cloud landing zones
Provision one workload environment from a reviewed definition
Make the first environment reproducible before scaling account creation. Include the access, logging and ownership that turn empty infrastructure into a usable workspace.
In this article
Describe the requested environment
Capture the workload owner, environment purpose, data needs and expected connectivity. These inputs should determine a small number of understandable configuration choices.
Avoid asking teams to select dozens of unexplained infrastructure options. A service team should know why it needs a private connection or a separate production boundary, not memorise an internal template's variable names.
Validate inputs before provisioning, including an accountable owner and a supported deployment identity.
Create the boundary and baseline together
Provision the account or subscription through the chosen supported process. Apply the required organisational controls, audit destinations and access assignments before the workload handles real data.
{
"workload": "document-service-example",
"environment": "test",
"ownerTeam": "business-applications",
"dataClass": "synthetic",
"connectivityProfile": "private-services",
"baselineVersion": "example-3"
}This illustrative request records intent and baseline version. The actual platform should validate these values against its approved catalogue rather than treating arbitrary strings as authority.
Keep deployment credentials out of generated files and logs. Prefer the platform's supported short-lived identity integration where it fits the delivery system.
Deploy a small representative service
Use the normal application pipeline to create a service with a health endpoint, a data dependency and useful logs. Confirm that it can perform required operations with the intended runtime identity.
Test an action that should be denied. A successful deployment only proves that some access exists, not that the boundary is appropriately limited.
Check network name resolution and outbound dependencies from the workload itself. An administrator's laptop may have a different route and identity.
Verify repeatability and removal
Create another environment from the same reviewed definition and compare the important controls. Record differences that are intentional, such as environment-specific authority.
Then rehearse removal of the test workload under its retention policy. Confirm how logs, data and ownership records are handled after resources disappear.
Only scale the provisioning process once the path is understandable and repeatable. Automating account creation without the surrounding operating controls produces empty environments faster, but does not solve the team's delivery problem.
Primary sources
AWS: Control Tower overviewReferences checked 11 September 2026.