Available on

The AWS CDK Landing Zone: a foundation your team can maintain.

For B2B SaaS startups and scaleups. We build a CIS-compliant, CDK-based landing zone with account isolation, governance, and repeatable provisioning, so your team can stop running AWS Organizations by hand.
Book a live demoSee what's included

Free 30-minute live demo, no commitment. You get a fixed price before any paid work starts.

Deployed to YC-backed clients such as:

Blueprint of the AWS CDK Landing Zone: the management and landing zone accounts, the StackSets they deploy, and the security, observability, FinOps and workload accounts they reach
1 week
Typical deployment window for a production-ready AWS foundation
Minutes
To provision a new secure account once the baseline is in place
A comic of a tall stack of apps and infrastructure balanced on one small, cracked block labeled "your single AWS account that holds everything together"
When the single-account setup runs out

The setup that ships your first release rarely scales cleanly.

A few clicks in the AWS Console are enough to ship the first workload. Then dev, staging, and production start sharing one account, one set of limits, and one set of access patterns, and every new service inherits the blast radius of everything before it.

  1. 01
    A bug in dev can take down production
    Separate accounts per environment contain the blast radius.
  2. 02
    Service quotas become a shared delivery constraint
    Each workload gets its own account limits.
  3. 03
    Nobody can say which team the bill belongs to
    Account boundaries make cost ownership visible.
  4. 04
    Security and compliance turn into manual work
    Guardrails and baselines apply to every account automatically.
  5. 05
    IAM becomes a web of exceptions
    Access follows account boundaries instead of one shared policy set.
Shipped, not theoretical

What changes after the Landing Zone goes live.

The value is not the initial deployment. It is the baseline the team inherits afterward: clean account boundaries, new accounts in minutes, and a foundation that is easy to evolve.

“Before Towards the Cloud, we received a variety of proposals to provision our AWS landing zone. Danny's solution and AWS expertise stood out with comprehensive accelerators, documentation, and clearly articulated design principles. We achieved a perfect security score in days, not months, and TTC's ongoing support has been invaluable.”
Galen Simmons, Founder of Accolade
Galen Simmons
CEO & Founder, Accolade
Read the Accolade case study →
1 week
Typical deployment window for a production-ready AWS foundation
100%
Pass rate on the CIS AWS Foundations Benchmark
Minutes
To provision a new secure account once the baseline is in place
11
Ready-to-deploy StackSets covering security, compliance, cost, and account setup
Inside the landing zone

See the foundation before it lands in your AWS organization.

Opinionated where it matters, adaptable where your team needs room. Review the organization model, security controls, infrastructure code, and built-in guardrails before deciding if the baseline fits.

Multi-Account Architecture

A well-architected AWS Organization with dedicated OUs for security, FinOps, infrastructure, and your development and production workloads, guarded by Service Control Policies attached at the root. A suspended OU locks retired accounts down, and its close-account OU closes them automatically. See how the organization structure is defined in code.
  • Dedicated security, observability, and FinOps accounts
  • Workload isolation per environment
  • Guardrails at the root
No waiting on AWS roadmaps

Yours to run and customize. You decide who maintains it.

With AWS Control Tower, the controls you get are the controls AWS decided to ship. This landing zone is plain AWS CDK with the full source code in your repository, licensed for use across your entire organization, so when your team needs a new account or guardrail, it is a pull request away.

  • The complete CDK codebase lives in your GitHub repository.
  • Add accounts, OUs, and Service Control Policies through pull requests, with the cdk diff posted for review.
  • One organization-wide license: no per-account fees and no proprietary glue.

See how adding an account works →

Merge it, and the pipeline deploys it.

The generated GitHub Actions workflow validates and deploys both phases on every merge to main: the organization in the management account, then the StackSets from the landing zone account. It signs in through OIDC, so no long-lived AWS keys sit in GitHub.

How the pipeline works →

Build it yourself vs us

Build it yourself, or have it running next week.

Your senior engineers can build a landing zone. The question is what it costs the roadmap, and who runs it afterwards.

Building a landing zone in-house compared with the AWS CDK Landing Zone
TopicBuild it in-houseAWS CDK Landing Zone
Time to a working foundation3 to 6 months of a senior engineer, part-timeAbout a week
Audit-ready controlsAnother quarter of hardening for SOC 2 or HIPAACIS AWS Foundations Benchmark controls from day one
Architecture decisionsMade for the first time, under deadlineAlready made on dozens of AWS environments
Your engineersPulled off the product roadmapKeep shipping, with no deployment freeze
Running it afterwardsUpdates, accounts, drift and cost on your teamPackage releases plus support plans from $399/month with security and cost dashboards and engineering hours
OwnershipYour codeYour code too: every line of CDK lives in your repository

The build is the smaller half. After it, the foundation needs security updates, new AWS features, new accounts, drift fixes and a watch on cost, every month. Our support plans cover that operations work, so the foundation stays current without pulling your engineers off the product.

Book a live demoSee the support plans
AWS Landing Zone Deployment

Every control, guardrail, and automation, listed in full.

A CIS-compliant, multi-account AWS foundation built with AWS CDK. We migrate your existing accounts into it, so security guardrails, logging, identity, and account provisioning run as code instead of as manual platform upkeep.

No black boxes: the technical reference shows what each control deploys, and the roadmap shows what ships next.

Book a live demoSupport plans

Deployment is scoped after the free intro call, once we understand your account model, migration constraints, and the remediation your workloads need.

Compliance scores apply to the AWS foundation layer: organization, accounts, networking, and security services. Existing workload infrastructure may need separate remediation.

Security & Compliance14

Security Hub V2
AWS's newest, unified Security Hub runs from a dedicated security account and manages Security Hub CSPM, GuardDuty, Inspector, and Macie for every account. Each service switches on or off in code, so you run the mix you need and don't pay for the rest.
Organization CloudTrail
A single organization-wide trail records activity across every account, including the management account. It runs from a dedicated observability account, and 14 CIS alarms flag high-risk events like root usage and unauthorized API calls.
Centralized Root Access
Member accounts carry no standalone root credentials. Root is managed centrally, so a lost or misused root password can no longer put an account at risk.
Dedicated Observability Account
Trail logs land in KMS-encrypted buckets in their own observability account, away from the workloads they audit, with access logging, retention rules, and an Athena table ready for queries.
Show the other 10
Security Hub Posture Management
Continuously scores every account against the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices, managing the underlying AWS Config setup for you.
GuardDuty Threat Detection
Amazon GuardDuty watches every account around the clock for compromised instances, unauthorized access, and unusual API activity, with findings centralized for your security team.
Vulnerability Scanning
Amazon Inspector continuously scans EC2 instances, container images, Lambda functions, and code repositories for known vulnerabilities across the organization.
Sensitive Data Discovery
Amazon Macie inspects your S3 estate for exposed sensitive data, so accidental exposure is caught before it becomes an incident.
External Access Analysis
An organization-wide IAM Access Analyzer in every Region reports resources shared with principals outside your organization.
Secure Defaults
Every account inherits the same hardening in one step: default VPC removed, EBS encryption on, public S3 access blocked, public sharing of EBS snapshots and SSM documents blocked, default security groups locked down, and a strict password policy applied.
EBS Encryption by Default
Every new EBS volume is encrypted at rest automatically, with nothing for workload teams to configure.
S3 Block Public Access
Account-level public access blocking prevents any bucket or object from being exposed to the internet by mistake.
Strong IAM Password Policy
Enforces minimum length, expiry, reuse prevention, and complexity requirements on every account.
Encrypted Alerting
Security alarms notify one KMS-encrypted SNS topic subscribed to your security contact, so alerts reach the right people without exposing data.

Automated Account Provisioning5

Instant Account Provisioning
New accounts arrive ready to deploy to, with CDK bootstrap, encrypted asset storage, and a container registry already in place, so teams ship on day one.
Alternate Contacts
Security, billing, and operations contacts are set on every account automatically, so AWS notifications always reach the right people.
Marketing Email Opt-Out
New accounts are unsubscribed from AWS marketing email automatically.
Automated Account Closure
Retired accounts are locked down in the suspended OU, and accounts moved to its close-account OU are closed for you, with no manual offboarding steps or forgotten leftovers.
Show the other 1
Default VPC Removal
The default VPC is stripped from every new account and region, so workloads run only in networks you designed.

Operations & Cost Optimizations4

Budget Alerts
Monthly budgets for the whole organization, an OU, or a single account are defined in code and alert your team when actual or forecasted spend crosses the limit.
Cost Optimization Hub
A dedicated FinOps account runs Cost Optimization Hub and Compute Optimizer for the whole organization, ranking rightsizing, idle-resource, and commitment savings in one place.
Organization-Wide Resource Search
AWS Resource Explorer indexes every account and Region, so the FinOps account finds any resource in the organization from one search.
Service Quota Automation
Requests service quota increases in every active Region for your development, production, and security accounts, so limits don't block a launch.

Governance & Deployment6

Configuration Drift Detection
A daily check across the management and landing zone accounts flags anything that has drifted from the version-controlled baseline.
Delegated Administration & Guardrails
Each responsibility runs from its own account: security services from the security account, the organization trail from the observability account, cost tooling from the FinOps account, and StackSets from the landing zone account. SCPs, resource control policies, and tag and backup policies are enabled and governed centrally, keeping day-to-day management out of the management account.
GitHub Actions Pipeline
A secure CI/CD pipeline deploys infrastructure changes through pull requests using OIDC, with a cdk diff on every pull request down to each StackSet change, and no long-lived AWS keys to store or rotate.
AWS IAM Identity Center
We set up single sign-on during the engagement, usually with SCIM provisioning from the identity provider you already use, such as Entra ID, Okta, or Google Workspace.
Show the other 2
AWS Organizations via Code
Accounts, organizational units, and Service Control Policies are defined in AWS CDK, so governance changes go through code review and deploy consistently across the organization.
Multi-Region Support
Pick a primary Region and up to 14 more. StackSets, asset buckets, and the Region guardrail follow that list, so adding or removing a Region is one change in code.
How the deployment runs

Three steps from AWS sprawl to a clean foundation.

The process is intentionally short: agree the account model, deploy the landing zone, then hand over a baseline your team can operate on its own.

  1. Up to 2 hours

    Kickoff and boundary design

    We review the current AWS organization, your compliance targets, and the account model the team needs, then agree access and the rollout plan.

    • Requirements captured
    • Target account model
    • Access and rollout plan
  2. About a week

    Deployment and account migration

    We deploy the landing zone through your pipeline, configure the guardrails, and move existing accounts into the new structure. Your developers keep shipping; there is no freeze window.

    • Landing zone live
    • Guardrails configured
    • Accounts migrated
  3. Right after

    Handover and knowledge transfer

    We walk the team through the codebase, the pipeline, and the security posture, so the foundation stays understandable after we step back.

    • CDK codebase in your repository
    • Pipeline walkthrough
    • Security posture review

Buy it through AWS Marketplace to keep procurement and billing inside your AWS account.

After the foundation is live

Manage it yourself, or let us keep it current

Run the foundation with your own team, or keep us involved for maintenance, security visibility, cost automation, and engineering hours, so your developers ship features instead of platform upkeep.

Support plans start from $399/month once the foundation is live.

Latest releases
  1. An observability account takes over audit logging and security alerts
  2. Budgets in code, safer Region changes, and faster StackSet rollouts
  3. Run your organization trail and security services from the right accounts

Improvements ship as package releases you pull in by bumping two versions. Read the changelog

Platform Maintenance

  • Landing Zone Security Updates
    Included
  • Landing Zone Feature Updates
    Included
  • CDK Construct Library
    Included
  • Feature Roadmap Requests
    Included

Security & Cost Visibility

  • Cloud Security Posture Dashboard
    Not included
  • FinOps Automation (OpenOps)
    Not included

Support & Engineering

  • Support Channel
    GitHub Issues
  • Cloud Engineer Retainer
    Not included
  • CDK Construct Development
    Not included
  • Hands-on Training (Workshops)
    Not included
Not quite the right fit?

Related services, and when to pick them

See all AWS services
AWS Landing Zone FAQ

What teams actually ask
before pulling the trigger

How is this different from AWS Control Tower?

Our Landing Zone is GitOps-first and ships with security and compliance baselines already configured. Control Tower still requires a lot of manual follow-up in the console to achieve the same posture. With our implementation, your infrastructure is version-controlled in CDK, changes flow through pull requests and CI/CD, and every account is compliant from the moment it is provisioned.

How is this different from AWS LZA, OrgFormation, or other third-party tools?

AWS Landing Zone Accelerator and OrgFormation give you primitives. You still need to wire them together, decide on the account model, write the security baselines, set up the deployment pipeline, and maintain it long-term. We deliver the full implementation as AWS CDK, with all of that already done: opinionated account structure, 11 pre-configured StackSets, SCPs, GitHub Actions pipeline, and the compliance evidence to back it up. You skip the integration work and get the full source code, licensed for use across your organization. See what each baseline StackSet deploys in the docs.

Why not have our senior engineers build the Landing Zone ourselves?

You can. The question is how long it takes, how much roadmap time it costs, and whether the result holds up under audit. A landing zone built from scratch is typically a 3 to 6 month project for a senior engineer working part-time, plus another quarter to harden it for SOC 2 or HIPAA. We deliver the same baseline in a week because we have already made the architecture decisions on dozens of AWS environments. Your engineers stay focused on shipping features, and every line of CDK ends up in your repository, yours to customize and extend for your organization.

Do we need to be pursuing SOC 2 for this to be worth it?

No. The compliance scores are a side effect of getting the AWS foundation right, not the reason to build one. Even without an audit on the horizon, the Landing Zone removes account sprawl, centralizes logging and monitoring, automates new account provisioning, and gives you safe defaults for IAM, networking, and S3. Most teams adopt it because their developers were spending too much time fighting infrastructure rather than because of a specific compliance deadline.

What if we want to manage it ourselves or switch consultants later?

The entire CDK codebase lives in your GitHub repository the moment we hand it over, licensed for use across your organization. No proprietary glue, no per-account fees, no vendor lock-in. Any AWS engineer familiar with CDK can pick it up, and the architecture uses standard AWS services everywhere. If our ongoing support stops fitting, you keep the foundation and walk away.

Will this disrupt our existing workloads?

No. We attach the Landing Zone to your existing AWS Organization and migrate accounts into the new structure without downtime. Your workloads keep running while we roll out guardrails gradually. Developers continue building with the tools they already know while the foundation improves around them. The two-phase deployment attaches to your existing organization without disrupting running accounts.

How long does the deployment take?

We start with a kickoff call (up to 2 hours) to gather requirements and discuss access. From there, the core Landing Zone is typically deployed within one week. The final handover and knowledge transfer session follows shortly after, so your team is confident operating it independently.

Do we need to pause development during deployment?

No. Your developers keep shipping while we work in parallel. The Landing Zone is deployed alongside your existing setup, and accounts are migrated without affecting running services. There is no freeze window and no downtime.

What if we need changes after deployment?

The entire Landing Zone is built with native AWS CDK and lives in your GitHub repository. Your team can modify OU structures, Service Control Policies, security controls, and account configurations through pull requests, following the step-by-step guides in the docs. The architecture scales to hundreds of accounts, so it grows with you. If you want our help, our ongoing service tiers include a cloud engineer retainer for exactly this.

How do we know what changed in a new release?

The changelog summarizes each month's releases: new features, improvements, and fixes across the foundation, constructs, and core packages, plus the development activity behind them. When a release is out, you pull it in by bumping two version pins and redeploying, following the update guide. Breaking changes and migration steps come to you directly with the release they affect.

What happens if something goes wrong after handover?

If you are on one of our ongoing service tiers, we are available via Slack or GitHub Issues depending on your plan. If you chose to self-manage, you still own the full codebase and documentation. Any AWS engineer familiar with CDK can troubleshoot and resolve issues. The Landing Zone uses standard AWS services, so there is nothing proprietary that could block you.

What does the pricing look like?

Every environment is different, so the deployment is priced after the live demo, once we understand your account model, migration constraints, security controls, and how much workload remediation the move needs. You get one fixed quote before any work starts. Optional ongoing support starts from $399/month after the foundation is live. See the support comparison for the tier breakdown.

See it live

Book a live demo

We look at your AWS setup, then show you the landing zone live: account isolation, guardrails and automation, before anything touches your AWS.

You talk to Danny Steenman, the engineer who does the work. Pick a time below and he confirms it by email.

  • Free 30-minute demo, no commitment
  • Live walkthrough of the landing zone
  • Pricing scoped to your setup after the demo