AWS & Azure Enterprise Landing Zones: Infrastructure as Code

When enterprise organizations transition from single-cloud pilots to multi-region cloud adoption, ad-hoc resource creation leads to security vulnerabilities, unmanaged sprawl, and massive cost overruns.

An Enterprise Landing Zone provides a multi-account, compliant target environment structured according to AWS Control Tower / Cloud Adoption Framework (CAF) and Azure Enterprise-Scale Landing Zone guidelines.

---

Architecture Topology: Hub-and-Spoke Mesh

                     +---------------------------+

                     |   Central Transit Hub     |

                     |  AWS Transit Gateway /    |

                     |  Azure Virtual WAN Hub    |

                     +-------------+-------------+

                                   |

            +----------------------+----------------------+

            |                                             |

+-----------v-----------+                     +-----------v-----------+

| Shared Services Spoke |                     | Production App Spoke  |

| - CI/CD Runners       |                     | - Private AKS / EKS   |

| - Internal DNS        |                     | - Isolated Subnets    |

| - Key Vaults          |                     | - No Public IPs       |

+-----------------------+                     +-----------------------+

---

Core Guardrail Enforcement Code

Using Terraform and Azure Policy / AWS SCPs, we mandate that no compute instance can expose a public IP directly:

# AWS Service Control Policy (SCP) - Deny Unapproved Public Subnets Creation

resource "aws_organizations_policy" "deny_public_ip_exposure" {

  name        = "EpiFive-Deny-Public-IP"

  description = "Prevents creation of public EC2 instances outside boundary subnets"



  content = JSONencode({

    Version = "2012-10-17"

    Statement = [

      {

        Sid       = "DenyPublicIPInAppSpoke"

        Effect    = "Deny"

        Action    = ["ec2:RunInstances"]

        Resource  = "arn:aws:ec2:*:*:instance/*"

        Condition = {

          Bool = {

            "ec2:AssociatePublicIpAddress" = "true"

          }

        }

      }

    ]

  })

}

---

Business Value Delivered

For a recent financial technology enterprise client:

• Environment Provisioning Time: Reduced from 6 weeks to 22 minutes via automated GitOps pipelines.
• Security Compliance Audit: Achieved 100% automated CIS AWS Benchmark v1.4 compliance out of the box.
• Cost Reduction: Automated tag policy enforcement identified $340,000/year in unattached EBS volumes and idle dev instances.