Migration / Foundation
Your cloud is being built on a single account and a credit card.
Someone opened an account for a test, the test worked and it stayed in production. Today development, testing and production share the same space, almost everyone signs in with the same level of access, and nobody can say which spend belongs to what. None of that gets fixed later without moving what's already running.
What breaks when there's no foundation
- A mistake in development can reach production, because they live in the same place and there's no technical boundary between them.
- Nobody can say what an environment, a project or a business line costs, so cloud spend is discussed as a single number nobody knows how to bring down.
- Access is handed out by hand. The day someone leaves the company, shutting off everything they had is an exercise in memory.
- The record of who did what, if it exists, lives in the same place where it happened, which is exactly where it's no use after an incident.
- Every new workload is deployed differently from the last, because there's no template. What was saved on structure gets paid for in operations, every month.
What a landing zone is
- Separation by accounts, not folders. Production, testing, development and shared functions live in separate accounts. The isolation is enforced by the provider; it isn't a convention someone has to remember to respect.
- Control that doesn't depend on discipline. Policies that limit what can be done inside each account, centralized identity with role-based permissions, and activity logs consolidated in a separate place that the people who operate day to day can't reach.
- Written as code from day one. The foundation is deployed from versioned templates, so it can be audited, rebuilt and replicated. What gets documented afterwards never quite matches what was done.
The structure is the same on AWS, Azure and Google Cloud. The service names change, not the decisions.
How we work
Discovery with the people who will live there
Working sessions with infrastructure, security, development and whoever signs off on the spend. A foundation's decisions are business decisions dressed up as technical ones, and they're made only once.
Design decisions in writing before building
How accounts are separated, who can create what, how people sign in, how spend is tagged and how everything connects to what you already have on site. That document is what gets reviewed and debated, not the finished build.
Built as code, module by module
The structure is deployed from versioned templates, and each module is shown working instead of being described.
Nothing is handed over as a black box
The code that built the foundation is the same code it's operated with afterwards, so whoever inherits it doesn't depend on whoever assembled it.
Why what happens next matters
A landing zone without operations erodes within months. Someone creates an account outside the structure because they were in a hurry. A broad permission is opened temporarily and nobody closes it. A workload is deployed without tags and can no longer be attributed.
The foundation isn't something that ends. Reviewing drift against the design, keeping policies current and closing what was opened too wide is an ongoing function, one our team can take on.
Questions
Does it work if I already have workloads running in the cloud?
It's the most common case. The foundation is built alongside, and existing workloads are brought in by order of risk. Nothing has to stop to get started.
Is this the same as a migration?
No. The foundation is the land; the migration is the move. Migrating without a foundation works until you want to separate environments, attribute cost or pass a security review, and then you have to move what's already running.
Do I need a foundation if I'm only deploying one application?
It depends on whether it will be the only one. If there will be a second, the foundation costs less now than later, because later it costs the same plus moving the first one.
Start with the land
A call to see how your cloud is set up today and what's needed before it grows any further.