Skip to content

Public Cloud Landing Zones: AWS vs Google Cloud vs Alibaba Cloud vs Tencent Cloud

Summary

How the four public clouds covered in this knowledge base build an enterprise landing zone: the account hierarchy, preventive guardrails, the packaged landing-zone service or blueprint, workforce identity, transit networking, audit, and IaC. All four follow the same shape (a management root, core accounts for logs, security and networking, and workload accounts grouped by environment), but the names, limits and policy semantics differ. Facts come from the refreshed topic pages: AWS, GCP, Alibaba Cloud and Tencent Cloud (2026-09-25). Cross-cloud operating patterns are in Multi-Cloud Governance.

Quick Reference

Dimension AWS Google Cloud Alibaba Cloud Tencent Cloud
Footprint 39 Regions, 123 AZs (2026-06) 43 regions, 130 zones (2026-09) 31 regions, 107 AZs (2026-09-23) 23 regions, 66 AZs (2026-08-18)
Account hierarchy AWS Organizations: root, OUs, accounts Resource Manager: organization, folders, projects Resource Directory: Root folder, folders, member accounts Tencent Cloud Organization (TCO): root department, departments, member accounts
Hierarchy depth OUs nest 5 levels under the root Folders nest 10 levels below the organization Folders nest 5 levels below Root TBD (not documented on the topic page)
Preventive guardrails SCPs (principals), RCPs (resources), declarative policies (EC2, VPC, EBS config) Organization Policy constraints (legacy and managed), IAM deny policies Control policies TCO service control policies (SCPs), tag policies
Landing-zone service AWS Control Tower, landing zone 4.0 (2025-11-17) Google Cloud Setup (console-guided) Agentic Cloud Governance Center (renamed 2026-06-24) Control Center (landing zone and account factory)
Code-first accelerator Landing Zone Accelerator 1.15.5, Account Factory for Terraform (AFT) Cloud Foundation Fabric FAST v58.0.0; terraform-example-foundation v6.0.0 Terraform (alicloud_governance_account) or ROS tencentcloud-landing-zone-booster Terraform modules
Workforce SSO IAM Identity Center Cloud Identity / Workforce Identity Federation CloudSSO TCO Identity Center (SAML 2.0, SCIM)
Per-account IAM IAM Cloud IAM RAM Cloud Access Management (CAM)
Virtual network VPC (regional) with zonal subnets VPC (global) with regional subnets VPC with zonal vSwitches VPC with subnets in AZs
Transit hub Transit Gateway (regional) and Cloud WAN (global) Network Connectivity Center CEN with Transit Routers Cloud Connect Network (CCN)
Dedicated line Direct Connect Cloud Interconnect (incl. Cross-Cloud Interconnect) Express Connect (VBR, Express Connect Router) Direct Connect
Network firewall AWS Network Firewall Cloud NGFW (Essentials, Standard, Enterprise) Cloud Firewall Cloud Firewall (CFW)
API audit CloudTrail Cloud Audit Logs ActionTrail CloudAudit
Config compliance AWS Config Security Command Center, Cloud Asset Inventory Cloud Config Config
Terraform provider hashicorp/aws 6.66.0 (2026-09-21) hashicorp/google 8.3.0 (2026-09-15) aliyun/alicloud 1.293.0 (2026-09-17) tencentcloudstack/tencentcloud 1.83.33 (2026-09-21)
Native IaC CloudFormation, AWS CDK Infrastructure Manager Resource Orchestration Service (ROS) Not covered on the topic page

Account Hierarchy and Guardrail Attachment Points

Each cloud has one root per organization, nested grouping nodes, and account-like leaves. Guardrails attach to the root, a grouping node or a leaf and are inherited downward.

flowchart TB
    subgraph AWS["AWS"]
        A1["Organization root<br/>(management account)"] --> A2["OUs, up to 5 levels"]
        A2 --> A3["Member accounts"]
        A4["SCP + RCP +<br/>declarative policies"] -.-> A2
    end
    subgraph GCP["Google Cloud"]
        G1["Organization node"] --> G2["Folders, up to 10 levels"]
        G2 --> G3["Projects"]
        G4["Organization Policy +<br/>hierarchical firewall policy"] -.-> G2
    end
    subgraph ALI["Alibaba Cloud"]
        L1["Resource Directory Root<br/>(management account)"] --> L2["Folders, up to 5 levels"]
        L2 --> L3["Member accounts"]
        L4["Control policies"] -.-> L2
    end
    subgraph TC["Tencent Cloud"]
        T1["TCO root department<br/>(management account)"] --> T2["Departments"]
        T2 --> T3["Member accounts"]
        T4["TCO SCPs +<br/>tag policies"] -.-> T2
    end

Guardrail Semantics

The guardrail engines look alike but behave differently. Read these rows before porting a policy from one cloud to another.

Aspect AWS Google Cloud Alibaba Cloud Tencent Cloud
Policy types SCP caps IAM principals; RCP caps access to resources, including by external principals; declarative policies enforce EC2, VPC and EBS configuration Constraints on resource configuration (for example gcp.resourceLocations, iam.disableServiceAccountKeyCreation); managed constraints support dry run and Policy Simulator Control policies cap what identities in member accounts can do SCPs cap what CAM can grant in member accounts; tag policies standardize tags
Default attachment FullAWSAccess (and RCPFullAWSAccess) on every node Security baseline constraints enforced on organizations created on or after 2024-05-03 Not documented on the topic page System FullAccess policy on the root, every department and every member
Evaluation Filters only, never grant; do not affect the management account or service-linked roles Inherited down the hierarchy; evaluation order is on the GCP explanation Effect scope All (includes the member's root identity) or RAM (RAM users and roles only) Allow needed at every level from root to member; a deny at any level is inherited and cannot be overridden; never grant
Published limits 10 SCPs per node, 10,240 characters per SCP (raised in 2026-05) 300 direct child folders per parent; one organization per Cloud Identity or Workspace account Policy document up to 4,096 characters TBD (not documented on the topic page)

Landing-Zone Services and Blueprints

Aspect AWS Google Cloud Alibaba Cloud Tencent Cloud
Managed service Control Tower: preventive (SCP, RCP, declarative), detective (Config rules) and proactive (CloudFormation Hooks) controls; Account Factory. No extra charge beyond underlying services Google Cloud Setup: console-guided foundation that can export Terraform Agentic Cloud Governance Center: setup wizard, account factory with baselines, guardrails, governance maturity checks (including AI workloads since 2026) Control Center: organization structure, core accounts, finance policies, security rules, compliance auditing, account factory with baselines
Recent change Landing zone 4.0: optional Config, CloudTrail, SecurityRoles and Backup integrations; no mandatory OU layout; controls-only option terraform-example-foundation v6.0.0 moved to one common VPC Service Controls perimeter; v5.0.0 removed Jenkins support Renamed from Cloud Governance Center on 2026-06-24 Terraform support for account-factory baselines since provider 1.82.44 (2025-12-10)
Code-first path LZA (runs on Control Tower), AFT, Customizations for Control Tower Fabric FAST (staged: bootstrap, resource management, security, networking, project factory) or the CFT-based enterprise foundations blueprint; both fork-and-own Terraform or ROS; the service itself orchestrates through an IaC service Terraform tencentcloud resources or the landing-zone-booster modules
Core accounts in the reference layout Management, Log Archive, Audit (Security OU), Network, workload accounts Organization node, Shared VPC host projects, security and logging projects, service projects Management, Log Archive, Security, Network, Shared Services, workload accounts Management, log archive, security, network, workload accounts by department

Networking in the Landing Zone

Aspect AWS Google Cloud Alibaba Cloud Tencent Cloud
Hub pattern Network account owns Transit Gateway or Cloud WAN, Network Firewall and Direct Connect Shared VPC host project owns the VPC, Cloud NAT and Interconnect; NCC for transitive routing between many VPCs Network account owns CEN and Transit Routers; workload VPCs attach across accounts (VpcOwnerId) Network account owns CCN and the Direct Connect gateway; workload VPCs attach across accounts
Sharing model Resource Access Manager (RAM) Shared VPC (networkUser on subnets) Cross-account TR attachment after RAM/CEN authorization TCO resource sharing (share units, for example VPC subnets)
Documented hub limits and pricing 5,000 attachments per TGW; up to 100 Gbps per VPC attachment per AZ; $0.02/GB data processing (us-east-1) Cloud NGFW Standard $0.0193/GiB; Enterprise $1.75 per endpoint-hour plus $0.0193/GiB Up to 1,000 VPCs per Enterprise TR per region (unverified, 2026-04); inter-region by bandwidth plan or data transfer First 5 Gbps same-region free; cross-region billed on the monthly 95th percentile; Platinum, Gold and Silver tiers
Data perimeter RCPs and declarative policies (for example VPC Block Public Access) VPC Service Controls perimeters Not covered as a separate service on the topic page Not covered as a separate service on the topic page

Which One Should I Pick?

Most enterprises do not pick one: they pick a primary cloud and add a second for a region or a market. The flowchart covers the primary choice.

flowchart TD
    START["Where must workloads and users be?"] --> Q1{"Mainland China<br/>in scope?"}
    Q1 -->|"Yes"| Q2{"Gaming, media, WeChat<br/>ecosystem, finance zones?"}
    Q2 -->|"Yes"| TC["Tencent Cloud<br/>(China-site account, ICP filing)"]
    Q2 -->|"No, broadest China regions,<br/>PolarDB, Qwen"| ALI["Alibaba Cloud<br/>(aliyun.com account, ICP filing)"]
    Q1 -->|"No"| Q3{"Southeast Asia focus with<br/>a China leg later?"}
    Q3 -->|"Yes"| ALI
    Q3 -->|"No, global"| Q4{"Broad service catalogue, several org<br/>policy types (SCP, RCP, declarative),<br/>managed landing zone?"}
    Q4 -->|"Yes"| AWS["AWS<br/>Control Tower + LZA"]
    Q4 -->|"No, global VPC, data and AI,<br/>folder hierarchy, Terraform-first"| GCP["Google Cloud<br/>Fabric FAST or foundation blueprint"]
    TC --> MC["Two or more clouds:<br/>see Multi-Cloud Governance"]
    ALI --> MC
If you need Lean toward
A managed landing zone with preventive, detective and proactive controls from one catalogue AWS Control Tower (plus LZA for code-first customization)
A Terraform-first, fork-and-own foundation and a global VPC Google Cloud with Fabric FAST or terraform-example-foundation
Mainland China coverage with a packaged landing zone and account factory Alibaba Cloud Agentic Cloud Governance Center or Tencent Cloud Control Center
China plus Southeast Asia over one provider backbone Alibaba Cloud (six Southeast Asian regions, CEN into mainland China) or Tencent Cloud (Singapore, Jakarta, Bangkok, Johor)
The same guardrail intent across several of these clouds Policy as code in Git enforced per cloud (Multi-Cloud Governance)

Separate sites, partitions and accounts

Alibaba Cloud (alibabacloud.com vs aliyun.com) and Tencent Cloud (tencentcloud.com vs cloud.tencent.com) run separate international and mainland-China sites with separate accounts, contracts and pricing; China regions need a local entity and ICP filing. AWS partitions (aws, aws-cn, aws-us-gov and the European Sovereign Cloud) are separate too: IAM principals, Organizations and most cross-account features do not span them. Plan one landing zone per site or partition.

Service Mapping

The closest equivalents for the services a landing zone touches. Equivalence is approximate, not feature parity. The full mappings are in the Alibaba Cloud and Tencent Cloud references.

Category AWS Google Cloud Alibaba Cloud Tencent Cloud
Organization Organizations Resource Manager Resource Directory TCO
Guardrails SCP, RCP Organization Policy Control policies TCO SCPs
Landing zone Control Tower Google Cloud Setup, FAST blueprints Agentic Cloud Governance Center Control Center
Workforce SSO IAM Identity Center Workforce Identity Federation CloudSSO TCO Identity Center
IAM IAM + STS Cloud IAM RAM + STS CAM
Audit log CloudTrail Cloud Audit Logs ActionTrail CloudAudit
Config compliance AWS Config Cloud Asset Inventory, Security Command Center Cloud Config Config
Threat detection and posture GuardDuty + Security Hub Security Command Center Security Center Cloud Security Center
Transit hub Transit Gateway / Cloud WAN Network Connectivity Center CEN + Transit Router CCN
Dedicated line Direct Connect Cloud Interconnect Express Connect Direct Connect
Network firewall Network Firewall Cloud NGFW Cloud Firewall Cloud Firewall (CFW)
DDoS Shield Cloud Armor Anti-DDoS Anti-DDoS
Key management KMS Cloud KMS KMS KMS
Logs CloudWatch Logs Cloud Logging Simple Log Service (SLS) Cloud Log Service (CLS)
Managed Kubernetes EKS GKE ACK TKE

Sources

Facts come from the vault topic pages (checked 2026-09-25), which cite primary sources: AWS reference, GCP reference, Alibaba Cloud reference, Tencent Cloud reference, and the landing-zone chapters of the AWS, GCP, Alibaba Cloud and Tencent Cloud explanations.