Cloud Landing Zone Patterns: Azure & AWS Reference Architectures

Repeatable landing zone designs for enterprises operating at scale on Azure and AWS, built for autonomous team provisioning.

Covers the hub-and-spoke network topology, subscription vending machine pattern (Terraform + Service Catalog), identity and access management for multi-account environments, policy-as-code enforcement with Azure Policy and AWS SCP, egress control, private endpoint strategy, and the operating model for platform teams managing landing zones. Includes Terraform module structure and CI/CD pipeline templates.

EDITION · Q2 2023 · 44 PAGES

CLOUD ARCHITECTURE

Cloud Landing Zone Patterns

CELESDEV Solutions · celesdev.com

Executive Summary

Scalable cloud foundations without bottlenecks

Landing zones are the foundation everything else runs on. A poorly designed landing zone creates years of remediation work — retrofitting network controls, re-platforming identity, and migrating workloads between subscription structures. Getting it right at the start is orders of magnitude cheaper than fixing it later.

This document synthesises landing zone design from eleven cloud adoption programmes, covering greenfield designs and brownfield migrations from on-premises data centre environments.

1

Hub-and-spoke is still the right network topology

Despite Virtual WAN and AWS Transit Gateway evolution, hub-and-spoke with centralised egress and inspection remains the most auditable, cost-effective topology for enterprises with compliance requirements.

2

Subscription vending eliminates provisioning queues

Self-service subscription provisioning via Terraform Service Catalog reduces new environment lead time from 3–6 weeks (manual) to 20 minutes, with policy guardrails applied automatically.

3

Design identity for Day 2 from Day 0

Privileged Identity Management, just-in-time access, and workload identity federation (eliminating long-lived credentials) are cheaper to build in than to retrofit into production environments.

4

Policy-as-code must cover data residency from the start

Deny effects for non-compliant regions, storage encryption, and public endpoint creation prevent violations that trigger audit findings and require expensive remediation campaigns.

Reference Architecture

Landing Zone Layer Model

Enterprise Landing Zone Stack

Management · Billing · Governance · Audit Logs

Connectivity · Hub VNet · Firewall · DNS · VPN

Identity · Entra ID · PIM · Workload Identity

Platform · Subscription Vending · Policy Engine

Workload Subscriptions · Dev / Staging / Prod

Author: CELESDEV Solutions — Cloud & Platform Practice.

Applicable contexts: Enterprises migrating 50+ workloads to cloud; organisations with regulatory requirements (GDPR data residency, financial services data sovereignty); multi-team cloud adoption programmes.

Full document includes Terraform module structure for Azure and AWS landing zones, Azure Policy initiative JSON, and a brownfield migration sequencing guide.

CELESDEV Solutions | celesdev.com | business@celesdev.com

2 of 3 - Executive Summary

Cloud Landing Zone Patterns

CELESDEV Solutions | celesdev.com

Security Controls by Layer

Defence-in-depth control mapping

LAYER	AZURE CONTROL	AWS CONTROL
Identity	Entra ID + PIM + Conditional Access	IAM Identity Center + Permission Sets
Network	Azure Firewall + NSG + Private Endpoints	Security Groups + Transit Gateway + VPC
Data	Azure Policy + CMK + Purview	AWS Config + KMS + Macie
Workload	Defender for Cloud + Sentinel	GuardDuty + Security Hub + Inspector
Compliance	Policy Initiatives + Guest Config	SCP + Config Rules + Audit Manager

Key principle: No single control layer is sufficient. Compensating controls at each layer ensure that a failure or misconfiguration in one layer does not result in a direct path to sensitive data or workloads.

Brownfield Migration Sequencing

On-premises to landing zone in three phases

PHASE 1 - FOUNDATION (weeks 1-8)

Deploy management group hierarchy, hub network, firewall, and identity foundation. Configure Azure Policy baseline. Stand up monitoring and logging pipeline. No workloads migrate yet.

PHASE 2 - PILOT (weeks 9-16)

Migrate 2-3 non-critical workloads using the subscription vending machine. Validate connectivity, DNS, and policy enforcement. Capture remediation patterns and update runbooks.

PHASE 3 - SCALE (weeks 17+)

Accelerate migration using proven patterns. Retire on-premises infrastructure progressively. Enable self-service subscription provisioning for product teams. Transition to steady-state platform operations.

Brownfield migrations take 6-18 months depending on workload count and compliance requirements. Phased sequencing reduces risk; big-bang cutovers are not advised for regulated environments.

CELESDEV Solutions | celesdev.com | business@celesdev.com

3 of 3 - Technical Reference