Generate the AWS account structure and network foundation before the first workload migrates.
The landing zone determines the ceiling for every migration that follows
Account structure, network topology, guardrails, and compliance controls set in the landing zone either enable or constrain every workload migration that follows.
An AWS account structure designed without knowing the workload compliance tiers, network isolation requirements, and team ownership boundaries will require significant redesign as migration waves proceed.
VPC CIDR conflicts, missing Transit Gateway peering, and insufficient subnet capacity discovered during wave two create rework that delays the entire program.
Service Control Policies, Config rules, and CloudTrail configuration are most effective when applied to an account before workloads arrive — not patched onto an account already carrying production traffic.
Design the landing zone from the estate map and compliance assessment. saasups generates an AWS landing zone blueprint — account structure, OU design, VPC topology, and network capacity — derived from the estate dependency map, compliance tier data, and team ownership boundaries identified in the assessment.
Generate Service Control Policies from compliance requirements. Compliance constraints identified in the risk assessment — PCI scope boundaries, data residency requirements, HIPAA isolation controls — are translated into Service Control Policies and AWS Config rules that are ready for deployment before the first workload migrates.
Produce a landing zone that scales across the full migration program. The saasups landing zone blueprint is designed for the complete estate — not just the first migration wave — so account and network capacity, OU structure, and guardrail coverage scale with the program without requiring architectural redesign.
Landing zone design built from estate and compliance data
Estate-derived account and OU structure
AWS account structure and Organizational Unit design are generated from compliance tier data, team ownership boundaries, and workload isolation requirements identified in the estate assessment — not from a generic multi-account template.
Network topology and capacity planning
VPC design, subnet allocation, CIDR planning, and Transit Gateway topology are derived from the estate dependency map — accounting for every inter-workload connection and ensuring network capacity for the full migration program.
Compliance guardrail generation
Service Control Policies, AWS Config rules, and CloudTrail configuration are generated from compliance assessment output — ready for deployment before the first workload migrates.
Landing zone IaC output
The landing zone blueprint is delivered as Terraform or CloudFormation — Account Factory for Terraform (AFT) compatible — so it is deployable rather than presentable.
How saasups landing zone design works
saasups derives landing zone requirements from three upstream assessment outputs: the estate dependency map, the compliance risk assessment, and the 7 R's scored roadmap. The dependency map provides inter-workload network connectivity requirements and team ownership boundaries. The compliance assessment provides workload compliance tiers, data residency constraints, and isolation requirements. The scored roadmap provides the total workload count and distribution across migration waves.
Account structure and OU design are generated from compliance tier groupings and team ownership boundaries. Workloads in PCI scope, HIPAA scope, or with specific data residency requirements are assigned to dedicated accounts with appropriate isolation controls. Team ownership boundaries inform OU structure so account-level cost attribution and permission boundaries align with organizational structure.
Network topology — VPC design, subnet allocation, Transit Gateway peering, and CIDR block planning — is derived from the dependency map. Every inter-workload connection that crosses a network boundary in the on-premises estate is accounted for in the AWS network design. Compliance guardrails — Service Control Policies, Config rules, and CloudTrail configuration — are generated from the compliance assessment output and applied at the appropriate OU level.
Frequently asked questions
Yes. The landing zone blueprint saasups generates is designed for deployment via AWS Control Tower, with Account Factory for Terraform (AFT) compatible IaC output. For organizations already using Control Tower, saasups generates the customizations required to extend the existing foundation for the migration program.