AWS recommends that organizations set up a Landing Zone before building or migrating any production workloads in AWS. There are some optional features and add-ons, but the core of the Landing Zone includes the following components and services:

A Multi Account Organization helps separate billable AWS accounts and services across business units, teams, or individual users.

Control Tower lets organizations provision new AWS accounts quickly with configurable templates and lets administrators ensure accounts follow company policies and best-practices.

A Networking Account Transit Gateway connects your Amazon Virtual Private Clouds (VPCs) and on-premises networks through a central hub.

IAM Identity Center lets admins centralize user access management and provide a single location to access accounts and applications.

Service Control Policies manage the security and permissions that are available to your organization's AWS accounts.

Amazon GuardDuty monitors for malicious activity and anomalous behavior to protect AWS accounts, workloads, and data.

AWS CloudTrail enables operational and risk auditing, governance, and compliance of AWS accounts.

AWS Config helps assess, audit, and evaluate the configurations and relationships of AWS resources.

AWS Security Hub automates best practice checks, aggregates alerts, and supports automated remediation.

The Keyrus Rapid Landing Zone creates a well-architected Landing Zone incorporating all these services, allowing organizations to migrate or build production workloads in AWS while following AWS best practices.

We know that there is no “one size fits all” for anything in the world of cloud, so each engagement starts with a short discovery around workloads, mission, staff, and culture to ensure that your Landing Zone is suited to your business and preferences.