Their engineers were ready to build. What they needed first was an AWS foundation that wouldn't let anything go wrong.

The client

A startup with an in-house engineering team building on AWS. What they didn't have — and didn't want to hire for — was a cloud platform team to stand up the account structure, governance, and security posture underneath the product.

The challenge

Giving a team of engineers keys to a raw AWS account is how startups end up with surprise six-figure bills, resources scattered across regions, and an audit trail that doesn't exist. They needed:

1. A multi-account structure with real separation between production and everything else.
2. Guardrails that make expensive mistakes impossible — not just discouraged.
3. Sign-in through the identity provider the team already used, not another set of credentials.
4. An audit and compliance posture that would hold up later, set up correctly from day one.

What we did

In two weeks, we delivered a complete AWS landing zone — entirely as Terraform, owned by the client:

• New AWS Organization with organizational units and member accounts separating production from non-production.
• Service Control Policies that lock regions, deny expensive services, and prevent anyone — including admins — from tampering with the guardrails themselves.
• Per-account budgets with alerts and a hard stop: runaway spend gets cut off, not just reported.
• Single sign-on federated to the identity provider the team already used — every engineer signs in with the account they already have, MFA included, and no static credentials anywhere in the environment.
• Self-service IAM for engineers, wrapped in mandatory permission boundaries — the team moves fast without waiting on an admin, and can't exceed the guardrails.
• Organization-wide audit logging and threat detection, with compliance-grade immutable log retention — SOC 2-ready from the start.
• Every guardrail validated live before handover — tested for correct denial and for absence of over-restriction, with the cost-control path rehearsed end to end.
• Written runbooks — bootstrap, operations, and day-to-day — plus a formal handoff and clean teardown of our own access.

Outcomes

• Engineers self-serve safely. No ticket queue, no bottleneck — and no way to exceed the guardrails.
• Runaway-bill insurance. Budget hard-stops and expensive-service denies cap the worst case.
• SSO on day one. No new credentials to manage; access mirrors the directory they already run.
• The client owns everything. Infrastructure as code, documented, reproducible — no vendor lock-in to us, and none of our credentials left behind.