FOUNDATIONS TRACK · RELEASING DECEMBER 2026
Cloud Building Blocks 201: Landing Zones and Reference Designs
How each of the four major clouds is laid out for a regulated workload: the landing zone, the common designs built on it, and where the evidence lives.
All coursesOpens December 2026
You will get the most from it if you are…
- Governance, risk and compliance professionals who have taken Cloud Building Blocks 101
- Assessors and auditors preparing to review a cloud estate on AWS, Azure, Google Cloud or Oracle Cloud
- Security and compliance leads inheriting a multi-cloud estate after a merger or acquisition
- System owners who need to say what their workload inherits from the platform beneath it
What it covers.
- 01What a landing zone isThe six elements every provider's foundation shares, and why it is a layer of inheritance
- 02The AWS landing zoneOrganizations, control policies, Control Tower and its version 4.0 changes, the Landing Zone Accelerator
- 03The Azure landing zoneManagement groups, subscriptions, Azure Policy, platform and workload landing zones
- 04The Google Cloud foundationOrganization, folders and projects, organization policies, the enterprise foundations blueprint, Shared VPC, Assured Workloads
- 05The Oracle Cloud landing zoneTenancy, compartments and policies, the Core and Operating Entities landing zones, Security Zones and Cloud Guard
- 06Reference design: three-tier and LAMPThe web application on each cloud, where the boundary goes, and what each tier inherits
- 07Reference design: containers and serverlessManaged Kubernetes and event-driven functions, and how the evidence changes shape
- 08Government regions and FedRAMP scopeEach provider's route to FedRAMP in 2026, and five checks for reading a scope list
- 09The evidence mapWhere access, logging, encryption, configuration and backup evidence lives on each cloud; recap and Monday
9 short lessons, part by part.
What a landing zone is
- The foundation under every workload
- Define a landing zone and name its six common elements across all four major clouds
- Distinguish preventive guardrails from detective guardrails, and say why the difference matters to evidence
- Explain why the landing zone is a third layer of inheritance between the provider and the workload, and how it shapes the boundary
Job aid: What a landing zone is: a one-page guide
The AWS landing zone
- Organizations, Control Tower and the shared accounts
- Describe how AWS Organizations groups accounts into organizational units and what service control policies and resource control policies can and cannot do
- Explain what AWS Control Tower adds: a landing zone, controls, shared accounts and account vending, and how version 4.0 changed the defaults
- Place Landing Zone Accelerator on AWS and Transit Gateway in the picture, and list the evidence to ask for
Job aid: The AWS landing zone: a one-page guide
The Azure landing zone
- Management groups, subscriptions and Azure Policy
- Describe the Azure hierarchy of tenant, management groups, subscriptions and resource groups, and how Azure Policy and role assignments inherit down it
- Explain the Cloud Adoption Framework's platform landing zone and workload landing zones, and name the reference management groups
- Recognize the two network topologies and the current accelerator names, and list the evidence to ask for
Job aid: The Azure landing zone: a one-page guide
The Google Cloud foundation
- Organization, folders, projects and the foundations blueprint
- Describe the Google Cloud hierarchy of organization, folders and projects, and how IAM and organization policies inherit down it
- Outline the enterprise foundations blueprint's folders, central projects, logging and Shared VPC design
- Explain where Assured Workloads fits, and list the evidence to ask for
Job aid: The Google Cloud foundation: a one-page guide
The Oracle Cloud landing zone
- Tenancy, compartments, policies and the OCI landing zones
- Describe the OCI hierarchy of tenancy and nested compartments, and how IAM policies are written and inherited
- Name the current OCI landing zone offerings, the Core Landing Zone and the Operating Entities Landing Zone, and what they replaced
- Distinguish Security Zones from Cloud Guard as evidence, and list what to ask for
Job aid: The Oracle Cloud landing zone: a one-page guide
Reference design: three-tier and LAMP
- The three-tier web application and the LAMP stack
- Describe the three tiers of a web application and the common pieces around them, with each provider's names
- Explain how a LAMP stack fits the pattern, on virtual machines or with a managed database
- Draw the boundary for a three-tier system in a landing zone, and say what each tier inherits as the service model changes
Job aid: Three-tier and LAMP reference designs: a one-page guide
Reference design: containers and serverless
- A managed Kubernetes platform and an event-driven serverless application
- Describe a managed Kubernetes reference design and its pieces on each of the four clouds
- Describe an event-driven serverless design and its pieces on each cloud
- Explain what changes for evidence when workloads are short-lived, and list what to ask for instead
Job aid: Containers and serverless reference designs: a one-page guide
Government regions and FedRAMP scope
- Government regions, and how to read a scope list
- Describe how each of the four providers offers FedRAMP-certified environments as of October 2026
- Read a provider's per-service scope list using five checks
- Explain why a provider's certification never authorizes a customer's system, and where the customer's own work begins
Job aid: Government regions and FedRAMP scope: a one-page guide
The evidence map
- Where the evidence lives, cloud by cloud
- Name where the evidence for access, logging, encryption, configuration and backup lives on each of the four clouds
- Prefer evidence exported from the system of record, dated and repeatable, over screenshots and statements
- Build a one-page evidence map for an estate, and plan the first steps on Monday
Job aid: The evidence map: a one-page guide
How it is delivered.
- Narrated lessons in short parts you can take one at a time
- A one-page job aid for each lesson
- A short check at the end of each lesson
- A lens for your role: security, cloud architecture or compliance
The courses open in December 2026.
Narration is AI-generated (OpenAI's Cedar voice). The courses teach preparation and method; they certify no one, grant no approval or authorization, and do not stand in for your assessor, auditor or regulator.