Multi-account landing zone
Separating production from everything else.
- 2024
- Platform
- Terraform · AWS Organizations · IAM · VPC
3
Isolated environments
0
Shared IAM users remaining
1 module
Networking, applied per account
the problem
Placeholder. Development and production shared one account and one VPC. A misapplied change could reach anything, and least privilege was impossible to express.
what I built
Split the estate into separate accounts under AWS Organizations with service control policies.
Built a reusable network module — VPC, subnets, routing — applied identically per environment.
Replaced shared IAM users with role assumption from a single identity account.
architecture
Resources, by tier
Organisation
+aws_organizations_organization
+aws_organizations_policy
Identity
+aws_iam_role.assume
+aws_iam_policy
Network
+aws_vpc
+aws_subnet
+aws_route_table
next project