Case file SS-02
AWS landing-zone modernisation
Replacing an inherited AWS foundation with an OpenTofu-defined landing zone built for controlled identity, networking and application migration.
- Livelanding-zone foundation shipped so far
- IaC-firstreviewed, repeatable account and network changes
The brief
Modernising the application estate required a dependable AWS foundation first. The inherited environment needed clearer ownership, repeatable infrastructure changes and network boundaries suitable for container workloads and private data services.
This is an anonymised account of an active engagement. It excludes the organisation’s identity, product names and sensitive architecture while retaining the decisions that make the work useful.
Foundation before migration
The landing zone is defined in OpenTofu so account, identity and networking changes can be reviewed in the same way as application code. That creates an inspectable source of truth and removes the console as the normal delivery path.
The design establishes explicit boundaries for workloads, shared services and data connectivity. IAM access is kept deliberate, network routes are made visible in code, and deployment conventions give later ECS services a consistent place to land.
Delivery sequence
The work was ordered to reduce dependency risk:
- codify the existing foundation and identify unmanaged assumptions;
- establish identity and network boundaries;
- prove private connectivity for the data tier;
- give container workloads a repeatable deployment path; and
- move services incrementally rather than coupling the foundation change to one large release.
Shipped so far
The OpenTofu landing-zone foundation is live and the private network path needed by the modernisation programme has been established. Application migration continues on top of that base.
The value is operational as much as architectural: changes are proposed, reviewed and reproducible; the next workload inherits known controls instead of inventing its own cloud footprint.