Landing zones without the landing zone team
AWS Landing Zone Accelerator alternative
with no pipeline to run
It holds a baseline steady. We govern what each account does with it.
Landing Zone Accelerator on AWS (LZA) is an open-source CDK solution you deploy into your own accounts and then operate. RosettaHub is operated for you, adds the cost governance and self-service LZA leaves out, and works alongside it if you already run it.
What Landing Zone Accelerator is good at
It is built for the most heavily regulated estates on AWS, and it does that job well.
Network and security as code
Transit Gateway, Network Firewall, security services, Config rules and Security Hub across 35 or more AWS services, from one configuration.
Regulated Regions
GovCloud and the US Secret and Top Secret Regions, with conformance packs mapped to specific regulatory frameworks.
A baseline that holds
It deploys a known-good state and watches for divergence from it, which is the right behaviour for a security and network baseline.
Three differences that matter
You operate LZA. We operate RosettaHub.
The pipelines run in your accounts, so configuration errors, failed runs, version upgrades and CDK bootstrap collisions are yours. The solution is free; the pipeline infrastructure and the staff time are not.
LZA treats change as drift. We treat change as the mechanism.
LZA has no way to express a policy that should change when an account exhausts its budget, because that would be drift. RosettaHub governs what accounts are doing, and acts on it.
Cost governance is absent
Across 35 or more services there is no cost capability and no FinOps account. RosettaHub adds a dedicated FinOps account, budgets that are enforced, and cost allocated by person and project.
Control Tower, Landing Zone Accelerator and RosettaHub
They are not rivals. AWS recommends running Landing Zone Accelerator on top of Control Tower, and RosettaHub runs alongside either or both, adding the cost governance and self-service neither covers.
| Control Tower | Landing Zone Accelerator | RosettaHub | |
|---|---|---|---|
| Operated by | AWS, as a managed service; you choose the settings | You | RosettaHub |
| Configured through | The console: landing zone settings, organisational units and controls | YAML configuration and a CDK pipeline | Budgets, roles and quotas |
| What it configures | The organisation, organisational units, log archive and audit accounts, IAM Identity Center, and preventive, detective and proactive controls | The landing zone baseline across 35 or more AWS services: networking (Transit Gateway, Network Firewall), security services, Config rules, Security Hub | Accounts, budgets, roles and policies over every AWS service, with which services, Regions, instance types and AI models each role may use |
| What users get | Accounts from Account Factory | Accounts | Federated access to the AWS console and CLI within those rules, plus self-service: machines, virtual desktops, Kubernetes, HPC and big data clusters, storage, and your own CloudFormation or Terraform |
| Reacts to account state | Detects drift; you repair it | No: change is drift | Yes: change is the mechanism |
| Cost governance | Not covered | Not covered | Budgets per account and project, enforced, with a dedicated FinOps account |
| GovCloud and secret Regions | GovCloud (US) Regions | Yes | No |
| Clouds | AWS | AWS | AWS, Azure, Google Cloud, and more |
If you already run it,
keep it
The common shape is Control Tower as the foundation, Landing Zone Accelerator for network and security depth where regulation demands it, and RosettaHub for cost governance, per-user account vending, self-service and the clouds beyond AWS.
Bring your existing log archive and audit accounts by account number, and the FinOps account is the only one added.
Common questions
Is there an alternative to AWS Landing Zone Accelerator?
For network and security depth as code, GovCloud or the secret Regions, Landing Zone Accelerator is built for exactly that. If what you need is a governed multi-account estate with cost enforcement, continuous compliance and self-service, and no team to operate a CDK pipeline, RosettaHub is the alternative. It also works alongside Landing Zone Accelerator if you already run it.
Landing Zone Accelerator or Control Tower: which do I need?
AWS recommends running Landing Zone Accelerator on top of Control Tower rather than instead of it. Control Tower is the foundation and the controls catalogue; Landing Zone Accelerator adds network and security depth as code for heavily regulated estates. You operate both, and neither covers cost.
Does Landing Zone Accelerator cost anything?
AWS charges nothing for the solution itself. You pay for the pipeline infrastructure and the AWS services it deploys, and for the people who keep the configuration correct, handle failed pipeline runs and carry out upgrades.
Can RosettaHub run alongside Landing Zone Accelerator?
Yes. Bring your existing log archive and audit accounts by account number and the FinOps account is the only one added. Landing Zone Accelerator keeps holding the security and network baseline steady, and RosettaHub governs what each account does with it.