Infinitech Multi-Cloud Landing Zone Accelerator
One request and control model for AWS, Azure, OCI, and Google Cloud
Infinitech LLC · October 2026
Each cloud has its own vending process
- Acquisitions, regional rules, and provider-specific services create separate environments.
- Each provider gets its own account-creation path, so ownership, logging, and region controls differ.
- Reviewers cannot get the same answer to the same control question in every cloud.
- Platform engineers maintain duplicated pipelines instead of improving one.
The recurring finding
A new account, subscription, compartment, or project exists without one or more of:
- a named owner and cost center;
- approved-region limits;
- centralized audit logs;
- encryption defaults;
- a policy review before creation.
Posture tools catch many of these after deployment. IMCLZ prevents the common ones at plan time and keeps the native detective tools.
Architecture
How a request becomes a governed scope
- An engineer adds one YAML request: owner, cost center, classification, region, logging destination.
- CI generates provider Terraform and rejects hand edits that drift from the generator.
- A read-only identity produces a saved plan.
- Five OPA rules reject missing tags, missing encryption, disallowed regions, public object storage, and missing logging.
- A separate write identity applies the exact plan that passed, verified by checksum.
- Nightly refresh-only plans open a drift issue for the named owner.
Native guardrails stay on
| AWS | Azure | OCI | Google Cloud |
|---|---|---|---|
| Organizations and SCPs | Subscription and Azure Policy | Compartment and IAM policies | Project and Organization Policy |
| Config, GuardDuty, Security Hub | Defender for Cloud and diagnostics | Cloud Guard and Security Zones | Security Command Center |
| Central S3 logs with KMS | Log Analytics | OCI Logging | Central Cloud Storage logs |
The request and reporting model is the same everywhere. Each provider still uses its own controls.
What the runs showed
- Five live workload cycles across all four providers proved apply, inventory, required-tag coverage, native-posture collection, OPA traces, and empty workload state after cleanup.
- A deliberately unsafe plan was rejected by policy before any cloud write. The corrected plan passed.
- One retained run selected 26 governed resources, and 26 of 26 carried the required business tags.
- In the retained nightly run, every generated provider workspace was clean.
The walkthrough is at infinitechplatforms.com. Evidence is in the public evidence repository, release v0.1.2.
What is measured, and what is not yet
| Item | Status |
|---|---|
| Apply, inventory, tags, posture, teardown | Proven in five live cycles |
| First-attempt vending, including review | One pilot run each: OCI 2:07, Google Cloud 5:18, AWS 10:40; Azure not yet measured |
| Provider billing, five demo cycles | USD 0.60 across four clouds, about USD 0.12 per cycle |
| Compliance mapping (OSCAL, NIST 800-53) | Roadmap; not implemented |
Pilot figures are not service levels or a customer cost estimate. IMCLZ produces evidence for your reviewers. It is not an audit, certification, or authorization.
Customer-owned delivery
- A pinned IMCLZ release is imported into your private GitHub repository.
- You own the repository, configuration, Terraform state, logs, cloud resources, and your extensions.
- CI uses short-lived GitHub OIDC credentials; Infinitech keeps no standing access after handoff.
- Upgrades arrive as reviewable pull requests from a tested release.
- One repository vends many scopes. A new account does not get its own repository.
The Foundation engagement
| Step | Outcome |
|---|---|
| Discovery | Hierarchy, billing, identity provider, regions, logging, and tags agreed |
| Deploy | Pinned release in your repository; separate plan and apply identities |
| Configure | Tagging, logging, five-control policy baseline; primary and secondary cloud |
| Prove | Two reference scopes vended; one reviewed rollback keeping central logs |
| Hand off | Runbook, architecture deck, acceptance evidence, two-hour enablement |
Quoted separately: identity-provider migration, application or data migration, production workload architecture, and audit preparation. Scope and fees are set in a signed statement of work.
Next steps
- Name your primary and secondary reference clouds.
- Inventory billing, organization hierarchy, GitHub, and identity-provider prerequisites.
- Agree the region, tagging, and logging contracts.
- Start Foundation discovery.
Infinitech LLC · hello@infinitechplatforms.com · infinitechplatforms.com