AWS Landing Zone versus AWS Control Tower
Tags: aws, security, governance
Published: 2021-01-26 12:16:41

---
title: AWS Landing Zone versus AWS Control Tower
published: true
date: 2020-04-20 07:00:00 UTC
tags: #aws #security #governance
canonical_url: https://globaldatanet.com/blog/aws-landing-zone-versus-aws-control-tower
---

What is the difference between AWS Landing Zones and AWS Control Tower? Customised Solution or Managed Service?!


AWS Landing Zone and AWS Control Tower help set up and govern a new, secure, multi-account AWS environment based on AWS best practices. Both consist of core accounts and resources which will implement a initial security baseline. </br>
The following table compares the managed service (AWS Control Tower) with the solution (AWS Landing Zone).

#### Update:
🚨 AWS Control Tower allows existing organizations to set up a landing zone. 

</br>

| Feature                  | ![AWS LandingZone](https://dev-to-uploads.s3.amazonaws.com/i/49dhqeg8sajb28576rwj.png)  | ![AWS Control Tower](https://dev-to-uploads.s3.amazonaws.com/i/j8uqf3f495ukf5ld41c2.png)| 
|-------------------------|:-----:|:-----:|
| Delivery mechanism | [CloudFormation](https://s3.amazonaws.com/solutions-reference/aws-landing-zone/latest/aws-landing-zone-initiation.template) or [Terraform](https://registry.terraform.io/modules/MitocGroup/landing-zone/aws/0.2.4) |AWS managed service |
| Architectural support | Fully customizable and owned by customer |[Customizable via Solution](https://aws.amazon.com/de/solutions/customizations-for-aws-control-tower/) + AWS recommend best practices with managed blueprints and guardrails |
| Account structure  | Complete flexibility for customer-defined account structure ![AWS LandingZone Architecture](https://dev-to-uploads.s3.amazonaws.com/i/87dqaqjac44rscf0ylyh.png) | Two non-configurable core accounts, no SS, no Amazon VPC in core ![AWS ControlTower Architecture](https://dev-to-uploads.s3.amazonaws.com/i/qqr16e2odyyhvlnclbgb.png)|
|Federated access|AWS SSO, AWS-Managed Microsoft AD or Active Directory Connector|Preconfigured with AWS SSO (AD or SSO Directory?) and integrated with third-party SSO providers|
| Operations  |Extensible capabilities to manage the most complex and advanced environments | Simple setup and management for reduced operational overhead|
|Automated account creation|✅ [Account Vending Machine](https://github.com/aws-samples/aws-account-vending-machine)|✅|
|Member account region support (VPC)|✅ All regions are supported[^1]| ➖ </br> **North-Virginia** (us-east-1), **Ohio** (us-east-2), </br>  **Oregon** (us-west-2), **Irland** (eu-west-1), </br> **Sydney** (ap-southeast-2) [^2]|
|General region support|✅ All regions are supported| ➖ </br> **North-Virginia** (us-east-1), **Ohio** (us-east-2), </br>  **Oregon** (us-west-2), **Irland** (eu-west-1), </br> **Sydney** (ap-southeast-2)|
|Use existing AWS Organization |✅| ✅|
|Use existing SSO environment |✅| ❌|
|Use existing AWS Service Catalog environment|✅| ❌|
|New or Existing Security Hub environment|✅ [Multiaccount Scripts](https://github.com/awslabs/aws-securityhub-multiaccount-scripts)|✅|
</br>

[^1]: Member accounts could be provisioned in every region no matter where the Account Vending Machine is deployed. </br> ⚠️You just need to take care that your CloudFormation templates & Lambdas are available in the requested region. 
[^2]: AWS Control Tower could provision new Accounts (Network baseline) into the following regions: **North-Virginia** (us-east-1), **Ohio** (us-east-2), **Oregon** (us-west-2), **Irland** (eu-west-1) and **Sydney** (ap-southeast-2).

### References

#### AWS Landing Zone

- [📚 Implementation Guide](http://www.awslandingzone.com/guides/aws-landing-zone-implementation-guide.pdf)
- [📚 Developers Guide](http://www.awslandingzone.com/guides/aws-landing-zone-developer-guide.pdf)
- [📚 User Guide](http://www.awslandingzone.com/guides/aws-landing-zone-user-guide.pdf)
- [📚 Upgrade Guide](http://www.awslandingzone.com/guides/aws-landing-zone-upgrade-guide.pdf)
- [📺 Videos](https://www.youtube.com/user/AmazonWebServices/search?query=aws+landing+zone)
- 🧰 **Solutions**
- - [🔧 Account Vending Machine](https://github.com/aws-samples/aws-account-vending-machine)
- - [🔧 Security Hub Multiaccount Scripts](https://github.com/awslabs/aws-securityhub-multiaccount-scripts)
  
#### AWS Control Tower 
- [📚 User Guide](https://docs.aws.amazon.com/controltower/latest/userguide/controltower-ug.pdf)
- [📚 Pricing](https://aws.amazon.com/de/controltower/pricing/)
- [🎓 Labs](https://controltower.aws-management.tools/)
- [📺 Videos](https://www.youtube.com/user/AmazonWebServices/search?query=aws+control+tower)
- 🧰 **Solutions**
- - [🔧 Customizations for AWS Control Tower](https://aws.amazon.com/de/solutions/customizations-for-aws-control-tower/)
- - [🔧 Enabling guardrails in new AWS Regions the AWS Control Tower supports](https://aws.amazon.com/de/blogs/field-notes/enabling-guardrails-in-new-aws-regions-the-aws-control-tower-supports/)


### Which one should I choose?

❓Are you new two AWS? </br>
❗️Use **AWS Control Tower** </br></br>
❓Do you need a configurable landing zone with full customization and control over every part? </br>
❗️Use **AWS Landing Zone**