Gruntwork's AWS Landing Zone and AWS Landing Zone Accelerator (LZA) are two alternatives for standing up a governed, multi-account AWS foundation. The difference is what you own. LZA is a free, AWS-maintained open-source solution that you drive through YAML configuration files, deployed by AWS CodePipeline. Gruntwork takes the best practices that makes up LZA and combines them with infrastructure-as-code best practices and opinionated defaults, delivering a multi-account AWS foundation as OpenTofu/Terraform code you fully own, vended and updated through pull requests.

What each one is

AWS Landing Zone Accelerator (LZA) is an AWS Solution that deploys a multi-account cloud foundation for highly regulated workloads and complex compliance requirements. It is open source (Apache 2.0), maintained by AWS, and built with AWS Cloud Development Kit (CDK) in TypeScript. You configure it through six YAML configuration files, such as accounts-config.yaml and network-config.yaml, and the solution's CDK constructs generate the resources. AWS describes it as a no-code solution across 35+ AWS services. AWS recommends deploying AWS Control Tower as the foundational landing zone and using LZA to extend it.

Gruntwork's AWS Landing Zone takes the best practices behind a governed, multi-account AWS foundation and combines them with infrastructure-as-code best practices and opinionated defaults, delivered as OpenTofu/Terraform code you fully own. It stands up a best-practice multi-account AWS Organizations structure, centralized identity with AWS IAM Identity Center, network security, guardrails, code-driven account vending, and CI/CD for infrastructure. It is built on top of AWS Control Tower, adopting Control Tower fully into OpenTofu/Terraform IaC for account vending.

Gruntwork and AWS Landing Zone Accelerator at a glance

The core difference: code you own vs configuration you supply

Both approaches sit well in version control. LZA stores its configuration files in a Git-compatible repository, so you can branch and review changes there too. The distinction is what flows through the review and who owns it. With LZA, you edit YAML configuration files, and AWS-owned CDK constructs translate them into CloudFormation and deploy them through the AWSAccelerator-Pipeline. With Gruntwork, the resources themselves are OpenTofu/Terraform modules you own, carrying Gruntwork's opinionated defaults and infrastructure-as-code best practices. A pull request contains the actual infrastructure code, and you can read it, extend it, and customize it without waiting on the solution's own release cycle. New AWS accounts are vended by opening a pull request that calls a standard Account Factory module, so every account gets the same baselines and guardrails.

Built on AWS Control Tower

Gruntwork's AWS Landing Zone is not a replacement for AWS Control Tower. It is built on top of it, adopting Control Tower fully into OpenTofu/Terraform IaC for account vending. Gruntwork provides OpenTofu/Terraform modules for AWS Control Tower, so you configure and version your landing zone as code and still use the standard Control Tower console to review account status and SCPs. For how Gruntwork and Control Tower fit together, see Gruntwork and AWS Control Tower.

A proof point at scale

Informa, a global B2B events and publishing group, used Gruntwork's code-driven account vending to cut AWS account provisioning time by more than 90%, from two weeks to just over one day, while unifying over 170 AWS accounts under a centralized governance model.

When to use each

AWS Landing Zone Accelerator

Choose LZA when you want a free, AWS-maintained solution, are comfortable driving your landing zone through YAML configuration files and AWS CodePipeline, and do not need to own or modify the underlying resource code.

Gruntwork

Choose Gruntwork when you want the best practices behind a governed AWS foundation delivered with opinionated defaults as OpenTofu/Terraform code you own, vended and updated through pull requests, with the freedom to customize everything.

Is Gruntwork's AWS Landing Zone a replacement for AWS Landing Zone Accelerator (LZA)?

It is an alternative to it. Both deliver a governed, multi-account AWS foundation, and Gruntwork builds on AWS Control Tower, which AWS recommends as the foundation LZA extends. Gruntwork takes the best practices behind that foundation and combines them with infrastructure-as-code best practices and opinionated defaults, delivered as OpenTofu/Terraform code you own.

Is AWS Landing Zone Accelerator free?

There is no license charge for LZA itself, and it is open source (Apache 2.0), maintained by AWS. You pay only for the AWS services it enables.

What is the main difference between them?

LZA is an AWS CDK solution you configure through YAML files, and AWS owns the constructs that turn those files into resources. Gruntwork delivers the landing zone as OpenTofu/Terraform modules you own and can read, extend, and customize.

Does Gruntwork also use AWS Control Tower?

Yes. Gruntwork's AWS Landing Zone is built on top of AWS Control Tower and adopts it fully into OpenTofu/Terraform IaC for account vending. See Gruntwork and AWS Control Tower for detail.