[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-landing-zone::en":3,"gloss-cluster-landing-zone::en":23,"gloss-next-landing-zone::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"landing-zone","cloud","Landing Zone","A landing zone is the prepared baseline a new workload is deployed into: the account or project structure, the network layout, the identity and permission scheme, the logging destinations, and the guardrails that constrain what can be built. The point is that these decisions are made once, centrally, and inherited, instead of being re-litigated by every team that needs somewhere to put a service. Without one, the pattern is familiar. The first team sets things up sensibly for itself. The second team copies most of it and changes the parts it found inconvenient. By the fifth, nobody can answer a simple question about where logs go or who can reach what, and the security review happens after the systems already exist, which makes it a negotiation rather than a design. A landing zone converts that into a default that is easier to accept than to bypass. The failure mode is the opposite extreme, and it is common enough to plan against. A baseline that forbids too much, or that takes weeks to get an exception from, does not stop teams from shipping; it teaches them to ship somewhere else — a personal account, an unmanaged corner of an existing one, a vendor's platform bought on a card. The zone then measures a shrinking fraction of what the company actually runs, while looking healthy. So the useful design question is not how strict the guardrails should be but how fast the exception path is, and whether the people who own the baseline can see what is being built outside it. A landing zone with a two-day exception route and honest coverage reporting beats a stricter one that everybody has learned to avoid. The baseline also needs an owner and a review date, because a zone is a snapshot of what the organisation believed about identity, network and logging on the day it was written. Left alone for two years it becomes the thing new teams work around rather than the thing they inherit, and the drift is silent because nothing breaks.","A landing zone is the prepared baseline new workloads deploy into — accounts, network, identity, logging. Why the exception path decides if it works.",null,[11,14,17,20],{"slug":12,"name":13},"audit-log","Audit Log (Audit Trail)",{"slug":15,"name":16},"immutable-infrastructure","Immutable Infrastructure",{"slug":18,"name":19},"infrastructure-drift","Infrastructure Drift",{"slug":21,"name":22},"vpc","Virtual Private Cloud (VPC)",[24,28,32,35,38,41,45,48,51,54,57,60],{"slug":25,"category":5,"name":26,"updated_at":27},"air-gapped-deployment","Air-Gapped Deployment","2026-09-09T03:30:02+00:00",{"slug":29,"category":5,"name":30,"updated_at":31},"autoscaling","Autoscaling","2026-09-08T21:32:36+00:00",{"slug":33,"category":5,"name":34,"updated_at":31},"availability-zone","Availability Zone (AZ)",{"slug":36,"category":5,"name":37,"updated_at":31},"block-storage","Block Storage",{"slug":39,"category":5,"name":40,"updated_at":27},"bring-your-own-cloud","Bring Your Own Cloud (BYOC)",{"slug":42,"category":5,"name":43,"updated_at":44},"budget-alert","Budget Alert","2026-09-08T21:32:37+00:00",{"slug":46,"category":5,"name":47,"updated_at":27},"change-freeze","Change Freeze",{"slug":49,"category":5,"name":50,"updated_at":27},"control-plane","Control Plane and Data Plane",{"slug":52,"category":5,"name":53,"updated_at":44},"cost-allocation-tag","Cost Allocation Tag",{"slug":55,"category":5,"name":56,"updated_at":44},"cost-chargeback","Cost Chargeback",{"slug":58,"category":5,"name":59,"updated_at":44},"cost-observability","Cost Observability",{"slug":61,"category":5,"name":62,"updated_at":31},"disaster-recovery","Disaster Recovery"]