Gruntwork's AWS Landing Zone and AWS Landing Zone Accelerator (LZA) are two alternatives for standing up a governed, multi-account AWS foundation. The difference is what you own. LZA is a free, AWS-maintained open-source solution that you drive through YAML configuration files, deployed by AWS CodePipeline. Gruntwork delivers the same kind of landing zone as OpenTofu/Terraform code you fully own, vended and updated through pull requests.
What each one is
AWS Landing Zone Accelerator (LZA) is an AWS Solution that deploys a multi-account cloud foundation for highly regulated workloads and complex compliance requirements. It is open source (Apache 2.0), maintained by AWS, and built with AWS Cloud Development Kit (CDK) in TypeScript. You configure it through six YAML configuration files, such as accounts-config.yaml and network-config.yaml, and the solution's CDK constructs generate the resources. AWS describes it as a no-code solution across 35+ AWS services. AWS recommends deploying AWS Control Tower as the foundational landing zone and using LZA to extend it.
Gruntwork's AWS Landing Zone is an opinionated, end-to-end landing zone delivered as OpenTofu/Terraform code you fully own. It stands up a best-practice multi-account AWS Organizations structure, centralized identity with AWS IAM Identity Center, network security, guardrails, code-driven account vending, and CI/CD for infrastructure. It is built on top of AWS Control Tower, adopting Control Tower fully into OpenTofu/Terraform IaC for account vending.
Gruntwork and AWS Landing Zone Accelerator at a glance
| Capability | Gruntwork AWS Landing Zone | AWS Landing Zone Accelerator (LZA) |
|---|---|---|
| Relationship to Control Tower | Built on top of Control Tower, adopting it fully into OpenTofu/Terraform IaC for account vending | AWS recommends Control Tower as the foundational landing zone, with LZA layered on to extend it |
| How you define it | OpenTofu/Terraform modules you own and can read | YAML configuration files consumed by an AWS CDK solution written in TypeScript |
| Account vending | Open a pull request that calls a standard OpenTofu/Terraform module | Add an account entry to accounts-config.yaml; the pipeline invokes account creation |
| Deployment engine | CI/CD pipeline for your landing zone, running OpenTofu/Terraform | AWS CodePipeline (AWSAccelerator-Pipeline) running the CDK app via AWS CloudFormation |
| Code ownership | You own 100% of the code and can customize it | Open source (Apache 2.0), AWS-maintained; you customize through configuration files |
The core difference: code you own vs configuration you supply
Both approaches sit well in version control. LZA stores its configuration files in a Git-compatible repository, so you can branch and review changes there too. The distinction is what flows through the review and who owns it. With LZA, you edit YAML configuration files, and AWS-owned CDK constructs translate them into CloudFormation and deploy them through the AWSAccelerator-Pipeline. With Gruntwork, the resources themselves are OpenTofu/Terraform modules you own. A pull request contains the actual infrastructure code, and you can read it, extend it, and customize it without waiting on the solution's own release cycle. New AWS accounts are vended by opening a pull request that calls a standard Account Factory module, so every account gets the same baselines and guardrails.
Built on AWS Control Tower
Gruntwork's AWS Landing Zone is not a replacement for AWS Control Tower. It is built on top of it, adopting Control Tower fully into OpenTofu/Terraform IaC for account vending. Gruntwork provides OpenTofu/Terraform modules for AWS Control Tower, so you configure and version your landing zone as code and still use the standard Control Tower console to review account status and SCPs. For how Gruntwork and Control Tower fit together, see Gruntwork and AWS Control Tower.
A proof point at scale
Informa, a global B2B events and publishing group, used Gruntwork's code-driven account vending to cut AWS account provisioning time by more than 90%, from two weeks to just over one day, while unifying over 170 AWS accounts under a centralized governance model.
When to use each
AWS Landing Zone Accelerator
Choose LZA when you want a free, AWS-maintained solution, are comfortable driving your landing zone through YAML configuration files and AWS CodePipeline, and do not need to own or modify the underlying resource code.
Gruntwork
Choose Gruntwork when you want your entire landing zone as OpenTofu/Terraform code you own, vended and updated through pull requests, with the freedom to customize everything.
Is Gruntwork's AWS Landing Zone a replacement for AWS Landing Zone Accelerator (LZA)?
It is an alternative to it. Gruntwork builds on AWS Control Tower, and AWS recommends Control Tower as the foundation LZA extends, so both deliver a governed, multi-account AWS foundation. Gruntwork delivers that foundation as OpenTofu/Terraform code you own.
Is AWS Landing Zone Accelerator free?
There is no license charge for LZA itself, and it is open source (Apache 2.0), maintained by AWS. You pay only for the AWS services it enables.
What is the main difference between them?
LZA is an AWS CDK solution you configure through YAML files, and AWS owns the constructs that turn those files into resources. Gruntwork delivers the landing zone as OpenTofu/Terraform modules you own and can read, extend, and customize.
Does Gruntwork also use AWS Control Tower?
Yes. Gruntwork's AWS Landing Zone is built on top of AWS Control Tower and adopts it fully into OpenTofu/Terraform IaC for account vending. See Gruntwork and AWS Control Tower for detail.
