Managing a project zoo with cloud segmentation and micro-accounts
summary
Company runs a self-service sandbox model that gives each project a full AWS account from a pre-created pool of five AWS accounts, protects data with a deny-by-default egress firewall and an ingress service edge, and exposes only configuration via SSM parameter store so teams own and deploy their workloads. Infrastructure is authored with AWS CDK, VPC tests run in under two minutes, full account boot takes ~35 minutes, currently 16 accounts, 10 VPCs, 7 projects and about two change requests per month.
AI-written summary · about
chapters (8)
- 0:00Introduction to project zoo
- 2:07Initial failures with single account
- 5:17Ownership model shift to service teams
- 6:42Cloud segmentation with micro-accounts
- 9:10Process and implementation details
- 12:19Live demo of account setup
- 19:34Metrics and developer feedback
- 22:03Q&A session
related talks
14mPlatform engineering
32mCreate a cloud-ready environment
32mBuilding an Enterprise Grade Multi Account AWS Environment
51mBuilding a multi-account, multi-runtime service-oriented architecture
57mBest practices for cloud governance at scale
55mBest practices
36mBuilding a Secure AWS Self-Service Platform for Regulated Industries
01h 01mManaging risk in a regulated environment