Cloud & platform · land.awsCI passing

Enterprise AWS Cloud Platform

A Terraform landing zone: the multi-account AWS foundation that application teams deploy onto.

View the code Run it ›_ last push 1 week ago

32Terraform tests on a mocked provider

0Checkov failures (every skip justified inline)

0AWS accounts needed to test it in CI

01 The problem

Once several teams build on AWS, a single account stops working: no blast-radius control, weak audit evidence, network sprawl and long-lived credentials.

02 How it works

Three YAML files
AWS Organizations + guardrail SCPs
Org-wide tamper-resistant logging
GuardDuty + Security Hub
Transit Gateway hub-and-spoke
SSO for people, keyless CI deploys

03 What I built

AWS Organizations with guardrail policies, tamper-resistant org-wide logging, GuardDuty and Security Hub.
A hub-and-spoke Transit Gateway network with address management and prod/non-prod isolation.
Single sign-on for people, keyless deploys for pipelines, all driven by three YAML files.

04 What I learned

Testing infrastructure without an AWS account works with Terraform's mocked provider, as long as policies are built so mocks stay deterministic.

AWS allows only five SCPs per target, and the default FullAWSAccess takes one, so guardrails were merged into a single baseline policy.

05 Known limitations

Every repository documents what it doesn't do yet. The main ones:

Designed and tested, not deployed to a real organization.
Egress is centralized but not inspected; no on-premises connectivity.

06 Stack

TerraformAWS OrganizationsTransit GatewayIPAMCheckovPython

The repository has the design document, operations runbook, full evaluation report and known limitations. All data is synthetic, generated by code in the repository.

run Run it yourself

Every project runs on a laptop: no cloud account and no paid API needed.

git clone https://github.com/codeROCK-IZZY/enterprise-aws-cloud-platform.git
cd enterprise-aws-cloud-platform
pip install -e "tools[dev]"
platformctl validate    # every check on config/ and policies/
platformctl cost        # what the platform costs per month
cd modules/network-hub && terraform init && terraform test