Production, staging and a test server nobody remembers launching all sit in one AWS account, the auditor has asked who can delete the CloudTrail logs, and someone has proposed a landing zone. AWS publishes what its own version costs before you put anything in it: the Landing Zone Accelerator sample, deployed on Control Tower, is $430.22 a month in N. Virginia "with no activity or workloads".
When CloudSpinx designs an AWS landing zone for a team in Kenya, the home region on the table is Cape Town, Ireland or Frankfurt rather than Virginia. So we priced every line of AWS's table again from its own price files, keeping AWS's dimensions and changing only the region; four lines that do not reproduce from those dimensions were scaled by their unit price instead. Cape Town comes to $493.43 a month for AWS's sample landing zone with nothing running in it, $5,921 a year. Ireland is $444.93 and Frankfurt $473.54.
Where the $493 goes
The biggest slice is not what a buyer means by a landing zone, which is separate accounts, logs nobody can delete and guardrails. Region is not the driver either. $208.97 of the Cape Town figure costs exactly the same in Virginia, Ireland and Frankfurt, because CloudTrail, Config, KMS, Security Hub and five smaller lines carry one price in all four regions. Of the $63.21 Cape Town adds over Virginia, $46.18 is network.
AWS's line next to ours, USD a month, on-demand list prices:
line Virginia (AWS) Cape Town
VPC network 175.35 221.53
CloudTrail 99.00 99.00
KMS 44.56 44.56
Security Hub 30.00 30.00
Config 23.00 23.00
CloudWatch 15.71 20.02
Kinesis 11.22 17.96
GuardDuty 11.52 14.16
Firehose 4.66 7.46
CodeBuild 6.00 6.00
S3 2.79 3.33
Route 53 3.00 3.00
Macie 1.60 1.60
CodePipeline 1.00 1.00
Secrets Manager 0.81 0.81
total 430.22 493.43Is Control Tower free?
Control Tower itself is. AWS's pricing page says it carries no charge of its own and you pay for the services it turns on. Those bill by the item, which is why an empty Control Tower landing zone looks cheap and a busy one does not.
AWS Config charges $0.003 for every configuration item it records and $0.001 per rule evaluation for the first 100,000, in all four regions. An item is a resource changing. AWS's own Control Tower page warns that ephemeral workloads can push the Config bill up, so a cluster that adds and drops nodes all day, or a CI system that builds and tears down test stacks, is where to look first when that line grows.
CloudTrail delivers the first copy of management events free and charges $2.00 per 100,000 for every copy after it. That rate turns the sample's 4.7 million paid events into $94 of its $99 line. Control Tower's documentation also warns that a trail you built outside it, running alongside its own, can mean paying for a second copy of every management event, so an account that already has a trail should retire it or fold it in at setup.
Keys are the fixed cost. A customer managed KMS key is $1 a month in any region, the sample creates 43 of them, and its configuration turns on default EBS encryption with a customer managed key in every account it makes.
The network you may not have yet
The largest line in the sample has nothing to do with audit. In Cape Town a Transit Gateway costs $0.06 per attachment-hour, so the sample's two attachments are $87.72 a month with almost no traffic on them. AWS's own description of it is the router that attaches multiple VPCs and hybrid connections in one place. One VPC per environment, no office link and no shared endpoints VPC gives it nothing to route.
The 14 interface endpoints are the bigger half. Each bills $0.01309 an hour in Cape Town for every Availability Zone it sits in, $9.56 a month apiece, so the sample's 14 in one zone come to $133.81. One zone is a sandbox setting. The same 14 across two zones for production run $267.56 a month in hourly charges alone. S3 and DynamoDB also come as gateway endpoints, and AWS charges nothing for those.
We add the Transit Gateway on the day a second VPC has to reach the first, or an office or data center joins over VPN or Direct Connect at NBO1. Interface endpoints go in one service at a time, when a private subnet actually calls that service. Neither is wrong. Both bill by the hour whether anything crosses them or not.
Already paying for an Accelerator deployment? Paste the Transit Gateway and VPC endpoint rows from one month of Cost Explorer, grouped by usage type, into "Anything we should know?" on the cloud scoping form, and we will show how much of the network line is hourly charge against the bytes that actually crossed it. Free, and it commits you to nothing.
Pick the Control Tower home region once
Control Tower builds part of the landing zone in a home region, and AWS is blunt about it in the Control Tower region guide: after you have selected a home Region, you cannot change it. Cape Town is on the supported list. It is also an opt-in region, disabled by default on a new account, so it has to be enabled before anything can run there.
The UAE and Bahrain are on the list as well. Both have had an open event on AWS's Health Dashboard since March 2026: AWS has asked customers to migrate out of the UAE region, told Bahrain customers to recover in other regions, and says data held only in Bahrain cannot be restored. A home region you can never move should not be either of them.
Cape Town costs more on compute too: our count of AWS's Cape Town prices found every on-demand Linux instance type dearer than in Ireland, by a median of 19%. What it buys is the nearest AWS region we measured from Nairobi that we would build on. Where your workloads run, and where a regulator or a client contract wants the logs kept, decides the home region. The $48.50 a month between Cape Town and Ireland in this repricing should not.
The five accounts we create first
For a small team our starting shape is five accounts. A management account holds the organization and the bill and runs nothing else. A log archive account receives the trail and the Config record, and almost nobody can sign in to it. An audit account carries the security tooling. Production and non-production each get a workload account. That is five of the ten accounts AWS Organizations allows by default (AWS notes a new organization can start below ten, and the quota can be raised), and it answers the auditor: the logs sit where the people who run production cannot reach them.
The Accelerator's sample adds two more core accounts, a network account for the Transit Gateway and a shared services account for things like a directory. Both wait for the same trigger as the Transit Gateway.
We build all of it as code in your repository, so the account plan is a file your team can read and change. It is the shape of the Google Cloud estate on our case studies page: 8 projects as code, 4 cloned environments and 0 static cloud keys.
Resources already running in the old account do not have to be rebuilt to come under that code. They can be imported in batches, and Control Tower can enroll the old account itself as a workload account rather than leave it outside.
AWS describes the full Accelerator as a foundation for highly regulated workloads and complex compliance requirements, and recommends Control Tower as the base with the Accelerator on top. A bank, a payments platform or any team whose examiner asks for inspection between VPCs is who that sample suits, and the inspection itself comes on top: the $493 has no firewall line. A team whose entire AWS bill is under $493 a month is not, because the empty sample would more than double it, and one application run by two engineers needs MFA on the root user and a trail long before it needs any of this.
Between those two, send us four things through the scoping form or on WhatsApp at +254 713 403 044: how many AWS accounts you run and what lives in each, how many VPCs, whether an office or data center has to connect, and the region you would make home. Add a month of Cost Explorer grouped by usage type, with usage quantity, if you have one. You get back the account plan, which of the sample's lines you need now and which can wait, and a monthly estimate for the foundation in that region, priced from your volumes where your bill shows them and at unit rates where it does not.