Production-ready AWS foundation
A multi-account AWS landing zone with sane networking, IAM boundaries and guardrails from the first commit.
The problem
Most AWS environments start as a single account with broad permissions and grow organically until nobody can explain the access boundaries. This lab builds the foundation the right way from the start: multiple accounts, least-privilege IAM, and network segmentation defined as code.
Architecture
- AWS Organizations with separate accounts for production, staging and shared tooling
- Hub-and-spoke VPC design with a shared services VPC for CI/CD and observability tooling
- IAM permission boundaries scoped per account, with federated access instead of long-lived keys
- Centralized logging account receiving CloudTrail and VPC flow logs from every account
Technologies
Design decisions
Separate AWS accounts per environment rather than a single account with tagging
Account-level isolation is a much stronger security and blast-radius boundary than tags, and it makes cost allocation trivial.
Federated SSO instead of IAM users with long-lived access keys
Removes standing credentials that can leak, and centralizes access review to one place.
Lessons learned
- Getting account structure right before workloads exist is far cheaper than restructuring later
- Centralized logging pays for itself the first time you need to investigate unexpected access
Working through something similar?
This lab reflects our own reference work, not a client engagement — but the approach transfers directly.
Start a technical conversation