Cloud and infrastructure, move by move.

what happened

A media company's cloud team created accounts and subscriptions by hand, so each one arrived with different settings and new environments were a long wait. Logs lived in each account, guardrails were written in a wiki rather than enforced, and the Azure side still depended on Blueprints and the archived enterprise-scale module. We designed the organizational unit and management group hierarchy around environments and risk, federated access through Entra ID, and built central logging, security tooling and a hub network as code. Account Factory for Terraform on AWS and a subscription vending module on Azure now create environments from a pull request. Existing accounts were enrolled with guardrails in audit mode first, and Blueprint assignments were converted to deployment stacks.

what the client got

• New environments come from a pull requestTeams request an account or subscription with owner, cost center and environment in a pull request, and vending applies the same baseline customizations every time.
• Guardrails are enforced, not documentedService control policies and Azure Policy deny effects apply by level of the hierarchy, and each control ran in audit mode against existing accounts before enforcement.
• Logs are in one placeWe set up organization-wide CloudTrail and activity log export into a central log archive. An incident no longer starts with asking each team for access.

Read the full case study