Cloud Engineering in Production · Capstone Case Studies
Capstone: A Landing Zone for a Regulated Start-up
A health-tech start-up is moving from one shared account to a production-grade cloud foundation. Design the accounts, identity, guardrails, logging, networking and cost controls.
Scenario
Example company: a 40-person health-tech start-up with one AWS account used for everything: production, staging, developers' experiments and a data science notebook server. Engineers use IAM users with access keys; there are no guardrails; CloudTrail is on only in one region. A hospital customer requires an ISO 27001-style security review in four months, and the company plans an Azure deployment for a customer who mandates it.
Requirements
- Separate production from everything else; patient data only in production.
- No long-lived credentials; MFA everywhere; least privilege.
- Central audit logging that production admins can't tamper with.
- Guardrails that stop the worst mistakes automatically.
- Cost visibility per team and environment.
Deliverables
- Account structure and how workloads move into it.
- Identity and access design.
- Guardrails and security services.
- Logging and monitoring.
- Networking and cost controls, and the Azure equivalent.
Hints
- Accounts are the strongest isolation boundary on AWS.
- Guardrails should be preventive (SCPs) and detective (Config, Security Hub).
- The log archive must be out of reach of the people it audits.
Draft each deliverable before revealing the model answer and rubric.
Further reading: AWS Control Tower · AWS IAM best practices
Deliverables
Account structure and migration.
Model answer
AWS Organizations (via Control Tower) with OUs: Security (log-archive, security-tooling/audit), Infrastructure (network, shared services), Workloads/Prod, Workloads/Non-prod (staging, dev), Sandbox (per-developer accounts with budgets), Data (analytics, de-identified data only). Move workloads service by service into new prod/staging accounts built from Terraform; the old account becomes a decommissioned legacy account once empty.
Rubric
Full marks: separate accounts per environment with security/log accounts and sandboxes; migration incremental with IaC. Deduct for environments separated only by tags or VPCs.
Identity and access design.
Model answer
IAM Identity Center federated with the company IdP (Google Workspace or Entra ID), MFA enforced; permission sets per role (read-only, developer, prod-operator with time-bound elevation, break-glass with alarms). No IAM users; CI via GitHub OIDC roles per repository and environment; workloads via roles (Pod Identity, Lambda roles). Delete all existing access keys after migration.
Rubric
Full marks: SSO+MFA, permission sets, just-in-time elevation for prod, OIDC for CI, roles for workloads, zero access keys.
Guardrails and security services.
Model answer
SCPs: deny leaving the organisation, deny disabling CloudTrail/GuardDuty/Config, deny unused regions, deny creating IAM users and access keys (except break-glass), deny S3 public access changes. Account-level S3 Block Public Access, default EBS encryption, IMDSv2 by default. Detective: GuardDuty, Security Hub with foundational standards, Config conformance packs, IAM Access Analyzer, Macie on prod buckets; findings aggregated in the security account.
Rubric
Full marks: preventive SCPs plus detective services, delegated to a security account.
Logging and monitoring.
Model answer
Organisation CloudTrail (all regions, data events for sensitive buckets) and Config to the log-archive account's S3 bucket with Object Lock and access only for the security team; VPC Flow Logs for prod. Application logs and metrics in each workload account with retention policies, aggregated observability for operations. Alerts for root use, IAM changes, guardrail violations and cost anomalies.
Rubric
Full marks: tamper-resistant central audit logs, flow logs, alerting on high-risk events.
Networking, cost controls, and the Azure equivalent.
Model answer
Networking: VPCs from IPAM, Transit Gateway in the network account, centralised egress with fixed IPs, no internet gateways in data accounts, VPC endpoints for AWS services.
Cost: mandatory tags via default_tags and tag policies, budgets per account, anomaly detection, sandbox budgets with auto-cleanup.
Azure: management groups mirroring the OUs, subscriptions per environment, Entra ID with Conditional Access and PIM, Azure Policy initiatives as guardrails, Defender for Cloud, Activity Logs to a locked Log Analytics/storage account, hub-spoke or Virtual WAN networking, Cost Management budgets.
Rubric
Full marks: complete networking and cost design plus a faithful mapping to Azure constructs.
Open in the app to mark lessons complete, take notes and track your progress.