Glossary
Landing zone
A reusable cloud foundation-accounts or subscriptions, identity, network, logging and policy-so new workloads inherit security and FinOps defaults instead of reinventing them.
In AWS this usually means Organizations, SCPs and account vending; in Azure, management groups and Policy; in GCP, folders and organisation policies. Stratoworks° implements landing zones with Terraform and documents them for your platform team to own.
A landing zone is not a compliance certificate. It is the control plane auditors and engineers both inspect when asking whether guardrails are real.
Without a landing zone, every project reinvents access, regions, logging and cost tags. Auditors and insurers notice that inconsistency before application code.
For mid-market teams a landing zone is a bounded project, not an enterprise programme: fewer accounts, proportional controls, the same discipline. Terraform (or equivalent IaC) keeps the baseline repeatable across AWS, Azure and GCP.
FAQ
Landing zone vs account?
An account hosts workloads; a landing zone is the pattern and shared services those accounts plug into.