AWS at scale, without click-ops
More than 40 accounts, each with its own drift, access paths, and audit evidence. The work was to make them behave like one system without freezing the teams that use them.
- ALB → app tier in two availability zones → RDS primary and replica.
- Security groups chained: ALB → app → database.
Constraint
Every account stays up and stays secure, and can prove it when an auditor asks. No snowflakes, no bespoke exceptions.
Approach
Terraform and Ansible for repeatable provisioning. Control Tower guardrails for the boundaries. AWS Config and FTR reviews to produce evidence instead of assurances.
OutcomeOne operating model across 40+ accounts, and 100% compliance with AWS Premier Partner requirements.