IMCLZ Foundation for governed cloud accounts on four providers
Infinitech LLC · Offering brief · October 2026
The problem
When AWS, Azure, OCI, and Google Cloud are each vended through their own path, ownership tags go missing. Some scopes start without central audit logs or region limits. Reviewers get a different answer in each cloud. Engineers maintain four pipelines. Posture tools find these gaps after resources exist. IMCLZ stops those gaps before anything is created and keeps the native tools for what happens afterward.
How IMCLZ works
- Request. An engineer adds one YAML request: owner, cost center, data classification, region, logging destination.
- Generate. CI turns the request into provider-specific Terraform and rejects hand edits that drift from the generator.
- Plan and check. A read-only identity produces a saved plan. Shared OPA policy rejects missing tags, missing encryption, disallowed regions, public object storage, and missing logging.
- Apply. A separate write identity applies the exact plan that passed, verified by checksum, from a protected workflow.
- Operate. Native guardrails stay on (SCPs, Azure Policy, OCI Cloud Guard, Google Cloud Organization Policy). Nightly refresh-only plans open a drift issue for the named owner.
CI uses short-lived GitHub OIDC credentials; the only stored cloud secret is one OCI client secret that Oracle's token exchange requires.
Evidence
| Shown | Detail |
|---|---|
| Live workload cycles | Five live workload cycles across AWS, Azure, OCI, and Google Cloud proved apply, inventory, required-tag coverage, native-posture collection, OPA traces, and empty workload state after cleanup. |
| Prevention before cloud writes | A deliberately unsafe plan was rejected by policy; the corrected plan passed. Recorded in the walkthrough. |
| Tag coverage | One retained run selected 26 governed resources; all 26 carried the required business tags. |
| Pilot vending time | One first-attempt run per provider, including review: OCI 2 min 7 s, Google Cloud 5 min 18 s, AWS 10 min 40 s. Azure not yet measured. |
| Demo cost | Provider billing for all five cycles: USD 0.60 across the four clouds, about USD 0.12 per cycle. |
| Public repository | A public evidence-only repository (release v0.1.2) shows what a customer receives, using synthetic evidence. |
Pilot figures are observations from synthetic demo runs, not service levels or an estimate of your cloud costs.
Who delivers it
Infinitech LLC has delivered cloud platform, automation, and DevSecOps work under contract since 2021.
The Foundation engagement
| Step | Outcome |
|---|---|
| Discovery | Cloud hierarchy, billing ownership, identity provider, approved regions, logging destinations, and tags agreed. |
| Deploy | A pinned IMCLZ release in your own private GitHub repository, with remote state, separate plan and apply identities, and protected workflows. |
| Configure | Shared tagging, logging, and five-control policy baseline; your primary and one secondary cloud. |
| Prove | Two reference scopes vended through the workflow; one reviewed rollback that keeps central logs. |
| Hand off | Operations runbook, architecture deck, acceptance evidence, and a two-hour enablement session. |
You own the repository, configuration, Terraform state, logs, cloud resources, and your extensions. Infinitech keeps no standing credentials after handoff. Upgrades arrive as reviewable pull requests. Platform expansion adds clouds, regions, or control overlays after the Foundation.
Related services
These are scoped and quoted separately, either added to a Foundation or as their own engagement: identity-provider migration, application or data migration, production workload architecture, and audit preparation (mapping IMCLZ evidence to your control framework for your assessor). Infinitech does not perform audits or issue certifications or authorizations; those come from an independent assessor, such as a FedRAMP third-party assessment organization. 24×7 managed operations is not offered.
Next step
Request a discussion at infinitechplatforms.com or hello@infinitechplatforms.com. The first call covers your clouds, hierarchy, and controls. It is not a paid assessment.