One governed cloud foundation under 40+ accounts

Every account was its own island

Before this work, each tolling project's AWS environment had been built independently (its own network design, its own security posture, its own way of provisioning a new environment. That meant no consistent audit trail across the platform, security tooling rolled out unevenly, and a new environment taking weeks of manual configuration to stand up. For teams operating tolling infrastructure, that inconsistency is itself a risk.

The brief was to design a single governance model that every account) present and future: would inherit automatically, without slowing engineering teams down or requiring them to understand the underlying plumbing.

A four-layer landing zone, deployed bottom-up

The entire platform was organized into four dependency-ordered Terraform layers, each one only allowed to depend on the layer beneath it. That constraint is what keeps the blast radius of any single change small and the deployment order unambiguous.

Hub-and-spoke, not point-to-point

Every account's VPC attaches to one central Transit Gateway rather than maintaining its own peering relationships and its own path to on-premises systems. A mirrored hub in a secondary region handles disaster recovery, so failover is a routing decision, not a rebuild.

Security and Archive & Migration are kept as a lightweight governance and compliance stack (audit, guardrails, long-term retention) structurally separate from the accounts that actually run workloads. Every account in either group still connects to the same single hub.

To be precise about the path: a public request hits CloudFront first, with a WAF in front of it, then resolves through Route 53 (both the public zone for the domain and the private zones used for internal service discovery) hosted in the Shared Services account. From there it reaches the Transit Gateway in the Networking account and gets distributed to whichever account actually owns the workload, Production included. It's one entry point, not a separate ingress path per account.

A strict, dependency-ordered build sequence

Because every layer depends only on the one below it, the entire platform (or a single new account joining it) follows the same fixed sequence. In practice this turned a bespoke, multi-week onboarding into a repeatable checklist:

Designing so a mistake literally cannot ship

Terraform changes are safe to review but dangerous to run carelessly against 40+ live accounts, so the deployment pipeline was designed to make an unintended apply structurally impossible rather than relying on manual vigilance. Every module inherits one shared pipeline engine instead of copy-pasted YAML, and every run is confined to exactly one module and one environment.

The result: onboarding a brand-new module into this pipeline takes under two minutes of YAML, but no engineer (however new) can accidentally run terraform apply against production by clicking the wrong button.

What changed

Beyond the numbers, the platform stopped depending on any one person's tribal knowledge. A new engineer can read the layer they're touching, trust that everything beneath it is already governed, and ship a change with a pipeline that makes the unsafe path harder than the safe one.