Back to ProjectsCloud & IaC
AWS Landing Zone (Terraform)
Enterprise-scale multi-account AWS environment using AWS Organizations, Control Tower, and Terraform. Automated account vending with SCPs and security guardrails.
- Accounts
- 50+
- Provision Time
- 15 min
- CIS Compliance
- 100%
- Cost Visibility
- 100%
Accounts
Provision Time
CIS Compliance
Cost Visibility
Project Overview
Designed and implemented an enterprise AWS Landing Zone for a 50+ account environment. Used AWS Control Tower for baseline governance, with custom SCPs enforcing encryption-at-rest, region restrictions, and mandatory tagging across all accounts. A Terraform account vending module provisions new accounts with correct IAM roles, VPCs, security baselines, and centralised logging within 15 minutes of a PR approval. AWS Config rules monitor compliance continuously and report to Security Hub.
Key Achievements
- Manages 50+ AWS accounts with consistent, auditable security baselines
- New account provisioning automated from days down to 15 minutes
- 100% CIS AWS Benchmark compliance score via automated AWS Config rules
- Centralised CloudTrail and Security Hub findings across all accounts