Cloud Landing Zone Setup in India (2026)

One account for everything is convenient for a week and expensive for years. A mistake in a test script can delete a production database, the bill cannot be split by project, and an auditor cannot tell which resources belong to which team.

We separate production, non-production and sandbox at minimum, with a shared services account for logging and networking where the platform supports it.

Human access goes through the identity provider, in groups, with the smallest role that does the job. Administrator rights are activated for a task rather than held permanently. Machine access uses workload identity rather than long-lived keys.

The test is simple: if the person who built the environment left tomorrow, could access still be revoked cleanly? If not, the identity model is decorative.

Workloads should be private unless there is a reason to expose them. That means segmented networks, private access to managed services, egress through a controlled path, and DNS that resolves private endpoints correctly.

NAT and endpoint choices also decide a large share of the monthly bill, which is why they are designed here rather than discovered later.

Policy should prevent the expensive mistake, not email somebody about it. Region restrictions, required tags, blocked instance types and mandatory encryption are all enforceable on every platform.

Guardrails also need an exception process, or teams route around them and the policy becomes theatre.

Control-plane logs, access logs and application logs belong in a central place with retention that matches the business requirement. Default retention is usually too short for an investigation and sometimes too long for the bill.

We set retention by data type and make sure logs are readable by a person, not just stored.

A landing zone includes backup policy: what is protected, how often, how long it is kept and who can restore. The restore path is documented and performed once before handover.

Cross-account or cross-region copies matter for ransomware and for regional failure, and both are decisions rather than defaults.

A tag scheme fails when it has twelve mandatory fields. Three or four are enough: owner, environment, project and cost centre. Enforcement makes the difference between a report and a guess.

The environment should be reproducible from a repository. Manual console changes are how staging and production quietly diverge, and how a rebuild after an incident takes days instead of an hour.

We use the platform-native tooling or Terraform, with state stored securely and changes reviewed like application code.

A single-environment foundation takes two to three weeks. Multi-account structures with identity federation and private connectivity take four to six. The delays come from identity providers, domain ownership and compliance reviews, not from the cloud APIs.

Send the platforms in use, the identity provider, the environments you need, any data residency rule, and who will approve changes to the foundation. The last answer decides how much of the work can be automated.

Read next: cloud services for the wider picture, cloud migration for moving workloads in, or cloud cost optimisation if the existing bill needs a review first.