Owner: Cloud Engineering · Primary: AWS · Secondary: Azure · Review Cycle: Quarterly
The organisation operates a hybrid multi-cloud strategy. AWS is the primary public cloud for net-new workloads. Azure is used for Microsoft-aligned services (M365, Entra ID, Azure DevOps) and as a secondary disaster recovery target. All cloud activity is governed through a Landing Zone framework that enforces security, tagging, and cost controls from day one.
AWS Organizations
├── Root
│ ├── Management Account (billing, Control Tower)
│ ├── Security OU
│ │ ├── Log Archive Account (CloudTrail, Config, VPC flow logs)
│ │ └── Security Tooling Acc (GuardDuty, Security Hub, Inspector)
│ ├── Infrastructure OU
│ │ ├── Network Account (Transit Gateway, DNS, Direct Connect)
│ │ └── Shared Services Acc (shared AMIs, ECR, Secrets Manager)
│ ├── Workloads OU
│ │ ├── Production OU
│ │ │ └── [App Accounts] (1 account per application / BU)
│ │ └── NonProduction OU
│ │ └── [Dev/Test Accs]
│ └── Sandbox OU
│ └── [Engineer Sandbox Accs]
Follows the Microsoft Azure Landing Zone (CAF) reference architecture:
All cloud resources must carry the following tags. Resources without mandatory tags are flagged by AWS Config / Azure Policy and escalated weekly.
| Tag Key | Example Value | Purpose |
|---|---|---|
env |
prod / nonprod / sandbox |
Environment |
application |
crm-platform |
Application or workload name |
owner |
platform-eng@company.com |
Team email for chargeback |
cost-centre |
CC-1042 |
Finance chargeback code |
tier |
1 / 2 / 3 |
Availability tier |
data-classification |
internal / confidential |
Data sensitivity |
New AWS accounts are provisioned via the Account Factory (Service Catalog) within 1 business day. Azure subscriptions via the Subscription Vending pipeline in Azure DevOps. Manual account creation is not permitted.
Cloud service adoption follows a traffic-light model reviewed quarterly by the Cloud Architecture Board:
| Status | Meaning |
|---|---|
| 🟢 Approved | Approved for use without additional review |
| 🟡 Conditionally Approved | Approved with specific configuration requirements |
| 🔴 Prohibited | Not permitted; contact Architecture for alternatives |
Examples of prohibited services: AWS IAM Access Keys (use IAM Roles / IRSA), public S3 buckets, unencrypted RDS instances.
The full service catalogue is maintained in Confluence: Cloud > Approved Services Register.
Every AWS account has a monthly budget configured. Alerts fire at 80% (warning) and 100% (critical) of budget. Critical alerts page the account owner via PagerDuty.
Automated tooling (scheduled Lambda + Azure Automation) terminates:
| Control | AWS Implementation | Azure Implementation |
|---|---|---|
| Identity | IAM Identity Centre (SSO) | Entra ID + PIM |
| Encryption at rest | KMS (customer managed keys) | Azure Key Vault |
| Encryption in transit | TLS 1.2 minimum enforced by SCP | Azure Policy |
| Secrets management | AWS Secrets Manager | Azure Key Vault |
| Vulnerability scanning | Amazon Inspector | Microsoft Defender for Cloud |
| SIEM integration | CloudTrail → Sentinel | Diagnostic Logs → Sentinel |