Platform foundations and landing zone standardisation

The challenge

A multi-business-unit organisation was migrating workloads to cloud, but each team was provisioning infrastructure independently. There was no consistent account structure, no shared networking model and no standardised approach to identity or logging. Security reviews were bottlenecking every deployment because reviewers had no baseline to audit against.

The platform team had attempted to build a landing zone using vendor reference architectures, but adoption was low. Teams found the constraints too rigid and the onboarding process too slow. The result was shadow infrastructure — teams bypassing the platform entirely to meet delivery deadlines.

What we did

Phase 1 — Discovery and baseline. We audited the existing cloud estate across all business units, cataloguing account structures, networking configurations, identity providers and logging gaps. We interviewed eight delivery teams to understand their friction points with the existing platform.

Phase 2 — Landing zone design. We designed a multi-account landing zone with opinionated defaults for networking, identity federation, logging and guardrails. Critically, we built escape hatches — documented processes for teams that needed to deviate from defaults with appropriate approval.

Phase 3 — IaC module library. We built a library of composable infrastructure-as-code modules covering compute, databases, networking and observability. Each module embedded security controls, tagging standards and cost allocation tags by default.

Phase 4 — Onboarding and adoption. We designed a self-service onboarding workflow that provisioned a complete environment — accounts, networking, CI/CD pipelines and monitoring — in under 30 minutes. We ran workshops with each delivery team and provided embedded support during their first deployment.

Measurable results

The landing zone became the default path for all new workloads. Security reviews moved from weeks to hours because reviewers could audit against known baselines. Shadow infrastructure effectively stopped because the platform was faster than going around it.