A landing zone is not a folder of Terraform. It is the operating agreement between engineering, security, and finance about how cloud spend and blast radius are controlled. When tagging, budgets, and account structure are treated as day-two chores, the bill becomes mysterious even while applications “work.”
This guide covers what must exist before the first production workload on AWS, Azure, or GCP-style estates—and how Calystron sequences FinOps visibility with identity and network baselines for mid-market teams.
What a landing zone actually is
Infrastructure as code is necessary but not sufficient. A landing zone encodes who can create what, where workloads live, how identity is federated, how costs are attributed, and how blast radius is limited when something fails.
Account structure, identity federation, and mandatory tags should exist before the first production workload. Retrofitting cost allocation after months of growth is more expensive than doing it once—both in engineering time and in finance trust.
What must exist before production
- Account or subscription structure that mirrors org ownership
- Federated identity with least-privilege roles—not long-lived shared keys
- Mandatory tags for cost center, environment, and owner
- Budgets with alerts that someone actually receives and acts on
- Network and security baselines that match your risk profile
A minimal tagging contract
Tags are a contract, not decoration. Enforce them at provision time where the platform allows, and reject unmarked production resources in review.
HCLtags = { cost_center = "ops" environment = "prod" owner = "platform" }
Account structure that finance can read
Mirror how the business already allocates cost: product lines, shared platform, sandbox. Separate production blast radius from experimentation. Shared services need explicit owners—otherwise every team assumes someone else is watching the bill.
- Define production, non-production, and sandbox boundaries.
- Place shared networking and identity in accounts with platform ownership.
- Attach budgets and anomaly alerts to each cost boundary.
- Review untagged or orphaned spend in a fixed monthly FinOps ritual.
Identity before the first workload
Long-lived access keys and shared consoles are how landing zones rot. Federate identity, use short-lived credentials, and make privileged elevation explicit. Security and FinOps both benefit: you know who changed what when spend spikes.
Pair identity with logging from day one: cloud trail or activity logs in a central account, retention that matches your compliance story, and access for security without giving every engineer permanent admin. When finance asks why a region’s cost jumped, you need both tags and an audit trail—not tribal memory.
If your cloud bill feels mysterious, the architecture is incomplete—even if the applications are running.
Frequently asked questions
What is a cloud landing zone?
A landing zone is the foundational multi-account (or multi-subscription) environment with identity, networking, logging, security baselines, and cost governance so teams can deploy workloads safely. It is an operating model expressed in infrastructure—not only templates.
When should FinOps start relative to migration?
Before the first production workload. Account structure, mandatory tags, and budgets should exist in the landing zone design. Waiting until the first shocking invoice makes attribution and behaviour change harder.
Do we need perfect tagging on day one?
You need a small mandatory set—cost center, environment, owner—enforced for production. Expand tags later. A large optional taxonomy that nobody enforces is worse than a short contract people follow.
How does Calystron approach landing zones?
We align engineering, security, and finance on account structure and tags first, then implement identity federation, baselines, and budgets with rollback-friendly changes. Tooling follows the operating agreement.
Make the bill explainable
Landing zones that finance can trust treat cost attribution as architecture. Build the agreement before production, enforce a minimal tag contract, and review budgets like any other control. Mysterious bills are a design smell.
If you are preparing a cloud migration or cleaning up an inherited estate, Calystron can design a landing zone that security and finance both recognise as complete.