Build the foundations once, properly, so every workload lands somewhere safe.
We design and build your cloud landing zone: the account, subscription or project structure, identity, networking, guardrails and logging that every workload sits on. We add reference architectures for SAP and other key systems, so teams can deploy quickly without reinventing security or breaking governance.
Why the landing zone comes first
When teams start deploying into a single cloud account or subscription without a plan, problems build up quickly: unclear ownership, open networks, inconsistent access and no central view of costs or security. Fixing that later means moving live workloads. A landing zone sets the structure and rules before migration starts, so new workloads, including SAP, arrive in an environment that is already secure, governed and ready to scale.
Isolation and ownership
Separating workloads into their own accounts, subscriptions or projects limits the impact of mistakes and makes ownership and billing clear.
Guardrails, not gatekeepers
Policies enforced by the platform stop risky changes automatically, so teams can move quickly without a manual approval for every change.
Connectivity planned up front
Private links to your offices, data centres and SAP systems need address planning and routing that are hard to change later.
Audit and security from day one
Central logging and security monitoring should be in place before the first production workload, not added after an incident.
What we do
We design the landing zone with your security, network and finance teams, then build it as code.
Resource hierarchy
We design the structure of accounts and organisational units on AWS, management groups and subscriptions on Azure, or folders and projects on Google Cloud. It reflects your business units, environments and cost ownership.
Identity and access
We connect the cloud to your identity provider for single sign-on and set role-based access with least privilege. Break-glass and privileged access are designed and documented.
Network design
We build a hub-and-spoke or similar topology with IP address planning, private connectivity to on-premise and controlled internet access. We plan the links to RISE with SAP and SAP BTP where relevant.
Guardrails and policy
We apply preventive and detective controls using each cloud's native policy services. Typical controls cover allowed regions, encryption, public access and mandatory tagging.
Logging, security and cost visibility
We centralise audit logs and security findings in dedicated accounts or subscriptions. Tagging and budgets give finance a clear view of spend by team and application.
Reference architectures
We provide approved patterns for SAP, web applications, data platforms and file services. Teams deploy from these patterns rather than starting from a blank page.
How it works
- 1
Requirements and design workshops
We gather security, compliance, network, identity and cost requirements. We agree naming, tagging and the resource hierarchy.
1 to 2 weeks - 2
Architecture design
We document the landing zone design and the reference architectures for priority workloads, including SAP. Your teams review and approve it.
2 weeks - 3
Build as code
We deploy the landing zone using infrastructure as code and the provider's native landing zone tooling. Everything is version controlled and repeatable.
2 to 4 weeks - 4
Test and hand over
We test guardrails, access and connectivity, then deploy a pilot workload. We hand over runbooks and train your platform team.
1 to 2 weeks
Landing zone building blocks on each cloud
We build with each provider's native services so the landing zone stays supported and up to date.
| Need | AWS | Microsoft Azure | Google Cloud |
|---|---|---|---|
| Resource hierarchy | AWS Organizations, organisational units and accounts | Management groups and subscriptions | Resource Manager organisation, folders and projects |
| Landing zone setup | AWS Control Tower, Landing Zone Accelerator on AWS | Azure landing zone accelerators | Google Cloud Setup, enterprise foundations blueprint |
| Guardrails | Service control policies, resource control policies, AWS Control Tower controls | Azure Policy | Organization Policy Service |
| Workforce identity | AWS IAM Identity Center | Microsoft Entra ID | Cloud Identity |
| Hub networking | AWS Transit Gateway | Azure Virtual WAN or hub-and-spoke virtual networks | Shared VPC, Network Connectivity Center |
| Private link to on-premise | AWS Direct Connect, AWS Site-to-Site VPN | Azure ExpressRoute, Azure VPN Gateway | Cloud Interconnect, Cloud VPN |
| Central logging and security | AWS CloudTrail, AWS Security Hub | Azure Monitor, Microsoft Defender for Cloud | Cloud Logging, Security Command Center |
Landing zones for SAP
How SAP fits into the landing zone depends on who runs it. Under RISE with SAP, SAP owns and manages the hyperscaler account that hosts your SAP Cloud ERP Private systems, so your landing zone provides the private connectivity, identity and the separate accounts, subscriptions or projects where your own extensions, integrations and data platforms run. If you run S/4HANA or ECC yourself on AWS, Azure or Google Cloud, the SAP systems sit inside your landing zone and we design dedicated SAP workload zones for production, non-production and disaster recovery.
- RISE with SAP: we design the connection from your network to the SAP-managed environment, such as a customer-managed intermediary project on Google Cloud.
- Self-managed SAP: we build separate SAP production and non-production zones with subnets for application and database tiers.
- We follow provider SAP guidance, such as the SAP Lens for the AWS Well-Architected Framework and SAP Deployment Automation Framework on Azure.
- We plan private connectivity between SAP BTP and your SAP systems so integration traffic avoids the public internet.
© 2026 Mawkish Technologies. This guide, its diagrams and illustrations are protected by copyright. You’re welcome to learn from it and to quote it with credit and a link. Reproducing it, by hand or through AI, and publishing it as your own is not allowed. Read our copyright notice
Deliverables
- Landing zone design document with resource hierarchy and naming standards
- Network design with IP address plan and connectivity diagrams
- Identity and access model with role definitions
- Guardrail and policy catalogue
- Landing zone deployed as version-controlled code
- Reference architectures for SAP and priority workloads
Frequently asked
We already have a cloud account in use. Can you still build a landing zone?
Yes. We design the target structure and then bring existing accounts or subscriptions into it, or move workloads across in a planned way. AWS Control Tower, for example, can enrol existing accounts into a new landing zone.
Do we need a landing zone for RISE with SAP?
SAP manages the infrastructure that hosts RISE with SAP, but you still need a secure place for connectivity, identity and your own extensions. A smaller landing zone covering those needs is usually enough.
Can you build landing zones on more than one cloud?
Yes. We design each one with the same principles for identity, naming, tagging and security, using each cloud's native services. This keeps a multi-cloud estate consistent and easier to govern.
Will our teams be able to manage it after you leave?
Yes. The landing zone is delivered as code with documentation and runbooks, and we train your platform team. We can also run it for you under a managed service.
How do you handle data residency for Sri Lanka?
There is no AWS, Azure or Google Cloud region in Sri Lanka, so we use guardrails to restrict deployments to the regions you approve, such as those in India or Singapore. This supports your data protection obligations.
Often paired with this
Plan your move with people who know SAP.
One working session with our cloud and SAP architects. You leave with the options, the risks and a first plan.
- Your landscape reviewed
- The right cloud and region
- A first roadmap
Sources
- What is AWS Control Tower
- Azure landing zone overview
- Azure landing zone design areas
- Google Cloud landing zone design
- Google Cloud enterprise foundations blueprint
- RISE with SAP on AWS
- RISE with SAP on Google Cloud
- SAP Lens for the AWS Well-Architected Framework
- SAP Deployment Automation Framework on Azure
The Venridge Ladder is our shorthand for looking after the details nobody sees in Landing Zone & Architecture Design.
AWS, Microsoft Azure, Google Cloud and SAP are trademarks of their respective owners.