The true cost of building your own landing zone
A cloud foundation built in-house costs far more than the estimate says. Here is the work nobody scopes, and when building it yourself is still right.
Production engineering, written down.
What production-ready actually means, and what it takes to get there. Specific, technical, and honest about the trade-offs — including the ones that make our own work harder.
Recent posts
SOC 2: what your infrastructure has to produce
An audit is an evidence problem. Here are the evidence sources cloud infrastructure should generate on its own, and why readiness is not certification.
Zero long-lived cloud credentials: OIDC in CI/CD
Static cloud keys in CI are a liability you chose to keep. OIDC federation replaces them with short-lived tokens your pipeline requests per job.
The multi-account landing zone, explained
Account boundaries are the first security control you get and the hardest to add later. Here is what each account in a landing zone is for, and why.
Backups you haven't restored are assumptions
A backup nobody has restored is a hypothesis, not a control. Here is how to run a restore drill and set an RTO and an RPO you can defend.
Subject areas
Eight properties define a production system. These are the ones we write about most.
Architecture
Account boundaries, networks and topology: the decisions that are expensive to change later.
2 posts
Compliance
Controls, evidence and audits, treated as an output of infrastructure rather than a project.
1 post
Reliability
Failure you planned for, recovery you have rehearsed, and the difference between the two.
1 post
Security
Identity, credentials, guardrails and the boundaries that hold when something goes wrong.
1 post
What this blog is
BuiltForProd builds production-grade cloud foundations and the reference architectures that run on them. This blog is where the thinking behind that work is published: the account boundaries, the credential model, the restore drill, the review gate, the evidence an auditor asks for. Every post is written so an engineer can act on it without buying anything.
Where a post uses concrete numbers, they describe a real system — usually the AWS Enterprise Baseline — and they are labeled as such. Where something is a judgment call, it says so. Where we would tell a customer not to do the work yet, we say that too.
Find out what production would take.
Tell us what you are running and what is coming: a funding round, an audit, a first enterprise customer, a migration. We will tell you what we would build, what it costs, and whether we are the right fit.