Account and organisation structure
- Multi-account structure defined with production isolated from non-production
- Separate account for security tooling and audit logs
- Billing consolidated with per-account cost visibility
Cloud Landing Zone Checklist
Landing zone decisions are cheap before any workload exists and painful afterwards. Account structure in particular is close to irreversible once production is running, so it is worth deciding deliberately rather than discovering.
What you get
- Account and subscription structure decisions with their implications
- Identity, network, and logging foundations
- Guardrail policies to apply before the first workload
- A readiness gate before production workloads are permitted
How to use this template
- 1
Decide account structure first and deliberately. Separating production from non-production at the account level is the strongest blast-radius control available, and restructuring later means migrating resources between accounts. Decide it now.
- 2
Turn on logging before anything else. Audit logs you did not enable cannot be reconstructed. Configure them to a separate, restricted account on day one so logs survive compromise of the workload account.
- 3
Apply guardrails as policy, not documentation. Region restrictions, encryption requirements, and public-access prevention should be enforced by policy. Written standards without enforcement are advisory, and advisory controls do not survive deadline pressure.
What's inside
Here's a preview. Unlock the free download to get all 5 sections (4 more below).
Related templates
More free templates IT teams use alongside this one.
Cloud & FinOps
Get templateCloud Tagging Policy & Schema
Untagged cloud resources make cost attribution guesswork and orphaned resources invisible. Tagging only works if it is enforced at creation. Retrofitting tags across thousands of resources is a project nobody finishes.
IT Policies
Get templateAccess Control Policy Template
Access control policies state least privilege and then leave the mechanics unspecified, which is where it breaks down. This one fixes the approval route, the review cadence, and the privileged-access rules explicitly.
Cloud & FinOps
Get templateCloud Migration Readiness Assessment
Migrations overrun because the assessment covered infrastructure and skipped the two things that actually cause delay: undocumented application dependencies and a team that has never operated the target platform.
Frequently asked questions
What is a cloud landing zone?
+
The baseline account structure, identity, network, logging, and policy guardrails established before workloads arrive. It exists so every workload inherits a known-good foundation rather than each team inventing their own.
Why separate production into its own cloud account?
+
Account boundaries are the strongest isolation available: they limit blast radius, simplify access control, and make cost attribution straightforward. Restructuring after production workloads exist means migrating resources, which is why it should be decided up front.
What should be configured before the first workload?
+
Audit logging to a separate restricted account, identity federation with MFA, network segmentation and address planning, mandatory tagging, encryption and public-access guardrails as enforced policy, and budget alerts.