Control Tower + Terraform module catalogue rolled out across 5 business units in 11 weeks, with codified guardrails that passed a SOC2 Type II audit with zero infrastructure findings.
Following an acquisition spree, the client had inherited five distinct AWS estates — each built by a different vendor, each with its own naming conventions, IAM patterns, and security gaps. A SOC2 Type II audit was 14 weeks out, and the auditors had already flagged inconsistent baseline controls as a likely showstopper.
The team needed three things simultaneously:
Manual remediation was out — they'd already tried it and it didn't scale. Everything had to be Terraform-managed, version-controlled, and auditable.
We designed the landing zone around AWS Control Tower for org-level guardrails, with a Terraform module catalogue layered on top for account-level baselines. A self-service vending portal let BUs request new accounts that came pre-wired with SOC2 controls in under 20 minutes.
OU hierarchy, account naming, tagging strategy, Control Tower setup, baseline SCPs.
Weeks 1–320+ Terraform modules: VPC, IAM, encryption, logging, network egress. CI validation + tfsec scanning.
Weeks 3–6Service Catalog + Step Functions-backed account vending — request → approval → provisioned in 18 min.
Weeks 6–9Migrated 5 BUs into the new org via account-import. Training, runbooks, and audit evidence package.
Weeks 9–11AWS Organization (root) │ ┌────────────────────┼────────────────────┐ ▼ ▼ ▼ Foundation OU Workloads OU Sandbox OU │ │ │ ┌───┴────┐ ┌──────┼──────┐ ┌─┴─┐ ▼ ▼ ▼ ▼ ▼ ▼ ▼ Log Audit BU-1 BU-2 BU-3 Dev Lab Archive prod· prod· prod· stg· stg· stg· dev dev dev Every account inherits: ├─ SCPs (no root, no public S3, region restriction) ├─ CloudTrail → central Log Archive ├─ Config rules (SOC2 baseline pack) ├─ GuardDuty + Security Hub aggregation └─ VPC + Transit Gateway attachment
| Metric | Before | After | Δ |
|---|---|---|---|
| Account provisioning time | ~7 days | 18 minutes | −99.8% |
| SOC2 infra audit findings | 11 expected | 0 | Clean pass |
| Drift incidents / month | ~30 | 1.2 | −96% |
| Public S3 buckets (org-wide) | 14 | 0 | −100% |
| MFA enforcement coverage | 62% | 100% | +38 pts |
| Cross-account access tickets | ~80 / month | ~6 / month | −92% |
SOC2, HIPAA, PCI — we've shipped landing zones for all three. Let's talk about your control catalog.
Start a conversation