Cloud Landing Zone: A Blueprint for Cloud Environments

Why it exists

Without a plan, cloud adoption becomes chaotic. Different teams build in different ways, leading to security holes, compliance risks, and duplicated effort. A landing zone provides a standardized starting point to prevent this chaos and ensure consistency, security, and operational efficiency from day one.

The mental model

A landing zone is like a master-planned community. The developer first lays down the core infrastructure: roads (networking), a power grid (identity management), and security patrols (governance policies). This is the "platform landing zone." Then, individual homes or businesses can be built on prepared lots ("application landing zones"), knowing they can securely connect to all the shared utilities.

How it works

A landing zone architecture is modular and separates concerns into two main parts. First, the Platform Landing Zone provides shared services like identity, connectivity, and management to all applications. It's managed by a central team to improve efficiency. Second, Application Landing Zones are pre-provisioned environments containing the resources for a single workload. Application teams deploy their apps here, inheriting security and governance from the platform. This structure is implemented using a cloud provider's hierarchy tools, like Azure Management Groups, to organize subscriptions and apply policies consistently.

When to use it

Use a landing zone when you need to manage a cloud environment at scale, especially in large organizations with multiple teams. It's critical for enforcing security and compliance standards uniformly, improving operational efficiency by centralizing common services, and providing a repeatable, automated way to provision new environments for application teams.

When not to use it

For a very small project or a single team with a limited number of applications, a full-blown landing zone can be overkill. The overhead of setting up and maintaining the separate platform and application zones may outweigh the benefits if you don't need to scale or manage complex compliance requirements.

One canonical example

A typical Azure Landing Zone uses a management group hierarchy. A top-level "Platform" management group contains subscriptions for shared services: a "Connectivity" subscription for the hub network, an "Identity" subscription for directory services, and a "Management" subscription for monitoring. Sibling management groups like "Corp" or "Online" then contain the application landing zones, which are individual subscriptions where development teams deploy their actual workloads.