AWS Landing Zone Accelerator¶
LZA holds a security and network baseline steady. RosettaHub governs what each account does with it, and gives people self-service on top.
Landing Zone Accelerator on AWS is the other thing people mean by "we already have a landing zone". It is a different kind of tool from Control Tower and worth separating.
LZA is an open-source CDK solution you deploy into your own accounts and then operate. Configuration lives in YAML files in an S3 bucket, an installer pipeline and a core pipeline synthesize and deploy from them, and the result covers 35 or more AWS services: networking including Transit Gateway and Network Firewall, security services, Config rules, Security Hub. AWS recommends running it on top of Control Tower rather than instead of it, and it expects Control Tower's three mandatory accounts to exist.
It is genuinely strong at things we do not attempt. If you need GovCloud or the US Secret and Top Secret regions, deep network topology as code, or conformance packs mapped to a specific regulatory framework, LZA is built for exactly that and we are not an alternative to it.
Three differences matter if you are weighing the two.
You operate LZA. We operate RosettaHub. The pipelines run in your accounts, so config correctness, failed pipeline runs, version upgrades and CDK bootstrap collisions are yours. AWS is precise that there are no additional charges for the solution, which is true and excludes the pipeline infrastructure and the staff time. That is a reasonable trade for the control it gives you, and it is a real line in a budget.
LZA treats change as drift. We treat change as the mechanism. LZA deploys a known-good state from your configuration and watches for divergence from it, which is the correct behaviour for a security and network baseline. It gives you no way to express a policy that should change when an account exhausts its budget, because from its point of view that would be drift. Governance that reacts to what an account is doing is a different job from governance that holds a configuration steady, and both are worth having.
Cost governance is absent there too. Across 35-plus services and a solution built for the most heavily regulated estates on AWS, there is no cost capability and no FinOps account. That is not an oversight by AWS; it is the scope of what a landing zone is understood to cover, which is why RosettaHub adds a dedicated FinOps account.
| Landing Zone Accelerator | RosettaHub | |
|---|---|---|
| Operated by | You | RosettaHub |
| Configured through | YAML config and a CDK pipeline | Budgets, roles and quotas |
| What it configures | The landing zone baseline across 35+ AWS services: networking (Transit Gateway, Network Firewall), security services, Config rules, Security Hub | Accounts, budgets, roles and policies over every AWS service, with which services, Regions, instance types and AI models each role may use |
| What users get | Accounts | Federated access to the full AWS console and CLI within those rules, plus self-service through RosettaCloud: machines, virtual desktops, Kubernetes, HPC and big data clusters, storage, networking, and your own CloudFormation or Terraform |
| GovCloud, secret regions | — | |
| Reacts to account state | — | |
| Cost governance | — | |
| Clouds | AWS | AWS, Azure, Google Cloud and Alibaba Cloud |
These stack rather than compete
The common shape is Control Tower as the foundation, LZA for network and security depth where the regulatory requirement demands it, and RosettaHub for cost governance, per-user account vending, self-service and the clouds beyond AWS. Bring your existing log archive and audit accounts by ID and the FinOps account is the only one we add.