Cloud Landing Zone Diagram

flowchart TB
  root["Organisation Root<br/><i>policy: deny unapproved regions</i>"]

  subgraph plat["Platform"]
    direction TB
    ident["Identity<br/><i>directory, privileged access</i>"]
    conn["Connectivity<br/><i>hub VNet/VPC, firewall, DNS, VPN</i>"]
    mgmt["Management<br/><i>logs, backup, monitoring</i>"]
  end

  subgraph land["Landing Zones"]
    direction TB
    subgraph corp["Corporate"]
      p1["Prod A<br/><i>spoke</i>"]
      n1["Non-Prod A<br/><i>spoke</i>"]
    end
    subgraph online["Internet-Facing"]
      p2["Prod B<br/><i>spoke</i>"]
      n2["Non-Prod B<br/><i>spoke</i>"]
    end
  end

  sandbox["Sandbox<br/><i>spend cap, no connectivity, auto-expire</i>"]
  decom["Decommissioned<br/><i>deny all</i>"]

  root --> plat
  root --> land
  root --> sandbox
  root --> decom
  conn --- p1
  conn --- n1
  conn --- p2
  conn --- n2
  mgmt -.->|"diagnostics forwarded"| land
  ident -.->|"roles and groups"| land

What it is

The scaffolding that exists before any workload does: the account or subscription hierarchy, the network hub and spokes, where identity lives, where logs go, and which policies are inherited by which branch of the tree. It is an architecture of containers and rules rather than of components.

The two boxes people forget are sandbox and decommissioned. Both prevent a recurring category of mess.

When you produce it

Before the first production workload lands, and it is genuinely hard to retrofit — re-parenting live subscriptions and re-addressing networks is a programme, not a change. Revisit it when a new regulatory boundary appears, such as a market with data residency rules.

Who reads it

The platform team who build it. Security, who care about the policy inheritance and the egress path. Every application team, who need to know which zone they land in and what they get for free. Auditors, who read it as the control boundary.

What good looks like

• Policy is shown at the level it is applied, so inheritance is visible.
• The network hub, the egress point and the DNS authority are unambiguous.
• Non-production is a separate container, not a tag.
• Sandbox has an expiry and a spend cap on the diagram.
• Address space allocation is recorded, even if in a companion table.

Common mistakes

• One subscription per environment across all applications. The blast radius and the quota contention both become shared.
• No decommissioning path. Accounts accumulate, and each one is an unmonitored attack surface.
• Policy drawn as a note rather than attached to a container. Then nobody can tell what a new workload actually inherits.