- AWS accounts in one organisation
- 8
- Terraform repositories
- 40+
- services on the platform
- ~20
The situation
The platform started in a single legacy AWS account, with .NET, Node.js and Next.js services, payments and Kafka consumers growing side by side. Access was hard to review, and every environment was built a little differently.
What we built
- An AWS Organization defined in code. Separate accounts for each environment plus central identity, networking and shared services, with service control policies that restrict regions and block long-lived IAM users.
- Access through IAM Identity Center. Access is granted through groups only, with a clear escalation ladder from developer to administrator.
- A hub-and-spoke network. Separate Transit Gateways for production and non-production, and tiered subnets for workloads and data.
- A golden module for services. One Terraform module creates a container service with its IAM, security group, autoscaling and alarms, and denies default internet egress. Fourteen service repositories use it.
- Keyless delivery. GitHub Actions authenticates to AWS with OIDC, every change is planned in a pull request, and production applies wait for approval. Each pull request can get its own temporary environment.
- Modernisation. Legacy .NET/IIS applications moved into Windows containers on Amazon ECS with CI/CD.
The result
Onboarding a new service became a configuration change instead of a project, the team ships through one reviewed path, and the same code later made it possible to move the whole platform to a new region quickly.