A cloud foundation that scales with your teams
Set up a multi-account foundation on AWS, Azure or Google Cloud with guardrails, central logging, identity and account vending, so new teams start safe by default.
Overview
Many companies run everything in one cloud account or subscription. It works at first, then a test script deletes a production resource, a bill cannot be split by team, or an auditor asks who can access what and the answer takes a week to assemble.
We build a landing zone: a structure of accounts, subscriptions or projects with guardrails applied from the top. On AWS that means Organizations, Control Tower and SCPs. On Azure, management groups and Azure Policy. On Google Cloud, the folder hierarchy and organisation policies. Central logging, single sign-on and account vending are included, all defined in code.
Signs you need this
- Production and development resources share one account or subscription
- IAM users with static keys still exist for people
- Audit logs are not collected in a place that workload admins cannot change
- New accounts are created by hand and each one is configured differently
What you get
- Account structure
- An organisational unit, management group or folder layout that separates production, non-production, security and shared services.
- Guardrails
- SCPs, Azure Policy or organisation policies that restrict regions, block disabling of logging and prevent public data exposure.
- Identity and access
- Single sign-on from your identity provider with role-based permission sets and no long-lived user keys.
- Central logging and security
- Organisation-wide audit trails, config history and security findings sent to a locked log archive account.
- Account vending
- A code-driven process that creates a new account with networking, budgets, tags and baseline controls already applied.
- Workload migration plan
- An order for moving existing resources out of the shared account into the new structure.
How the work runs
- 1
Design
1 to 2 weeks
Agree the account structure, guardrails, network model and identity integration with your engineering and security leads.
- 2
Foundation build
2 to 4 weeks
Build the organisation structure, logging, identity and baseline policies in code, starting with policies in audit mode.
- 3
Account vending and networking
1 to 3 weeks
Set up the vending process and shared networking such as Transit Gateway or a hub virtual network.
- 4
Workload moves and enforcement
2 to 6 weeks
Move workloads into their new accounts, then switch policies from audit to enforce.
Timings depend on the size of your estate. The assessment fixes them before any build starts.
What you can check afterwards
- Production and non-production run in separate accounts or subscriptions
- People sign in through single sign-on and no human IAM users with static keys remain
- Audit logs from every account land in an archive that workload admins cannot delete
- A new account can be created with baseline controls through a pull request
Tools we work with
- AWS Organizations
- AWS Control Tower
- AWS IAM Identity Center
- AWS CloudTrail
- AWS Security Hub
- Azure Landing Zones
- Azure Policy
- Microsoft Entra ID
- Google Cloud Resource Manager
- Google Security Command Center
- Terraform
Questions buyers ask
- Can we do this without disrupting what is already running?
- Yes. The new structure is built alongside your existing account, policies start in audit mode, and workloads move in planned steps.
- Do we need Control Tower or can we use Terraform alone?
- Either works. Control Tower gives AWS-managed controls and a console view, while a Terraform-only setup gives more control over every detail. We recommend based on team size and preference.
- What access do you need?
- Management account or tenant root access for the setup period, plus access to your identity provider configuration. We hand back and remove our access at the end.
- Who maintains the landing zone afterwards?
- Your platform or security team, using the code and runbooks we leave. Changes such as new guardrails go through pull requests.
Talk to us about cloud landing zones and governance.
Tell us what you run and where. We reply within one business day with questions or a quote.