One forkable Terraform codebase across five AWS accounts: an organization with guardrails, a tamper-resistant audit backbone, centralized-egress networking, and a Kubernetes platform. This page maps the whole thing, then walks the flows that make it work. Nothing stores a long-lived credential.
Layer 0 is the foundation; every layer above depends on the one below. Status is encoded in form: solid is live, amber is the foundation increment, dashed is planned.
Decision log, threat model, and cost dashboard: the evidence the platform works.
A fictional fishing-charter booking SaaS: proof the platform hosts genuine product, not just infrastructure.
GPU capacity and model serving layered onto the cluster for AI/ML workloads.
EKS 1.35 with API access entries, Pod Identity, KMS-encrypted secrets, IMDSv2 + encrypted-EBS spot nodes. ArgoCD delivers the platform by GitOps: Karpenter autoscaling, Prometheus/Grafana, and Kyverno policy all ship as Applications. Rebuildable from code to near-zero idle cost.
The shared spine every workload inherits: identity, an immutable audit trail, org-wide threat detection, CI/CD identity, and centralized-egress networking.
The organization itself: accounts, OUs, guardrail SCPs, the Terraform state backend, and GitHub OIDC. Everything above is built on this.
A GitHub Action never holds an AWS key. It trades a short-lived OIDC token for a role, then hops one more role into the target account. Every step is logged; nothing outlives the run.
No IAM users, no access keys. The only stored value is the state-bucket name, kept as a masked repo secret so the account ID never lands in a public log.
The trust matches repo:owner@<id>/repo@<id>, so a renamed or namespace-reused repo cannot impersonate this one.
The federated role holds no keys; member-account access is a second deliberate assume-role, not a standing grant.
fmt/validate run for any PR with no credentials; the real cloud plan runs only for same-repo PRs.
All five accounts feed a single audit backbone owned by the security account. A workload-account compromise cannot reach or tamper with the evidence, and an SCP stops anyone turning it off.
Separation of duties. Audit data lives in a low-privilege account, separate from where workloads run. The org CloudTrail is defined in the management account (org trails must originate there) but writes only to this bucket.
No workload role, SSO human, or compromised credential can stop CloudTrail or Config, or delete a detector. Only the IaC path is exempt.
Versioned, TLS-only, non-destroyable, and Object-Lock-ready so historical logs cannot be altered or deleted.
Detection services are administered from the security account, keeping the management account minimal.
Workload VPCs carry no NAT. They default-route to a Transit Gateway, which sends egress through one shared VPC. Dev and prod share the path but have no route to each other.
One egress footprint, hard isolation. Centralizing NAT in a single VPC keeps cost and inspection in one place; the TGW route tables ensure dev and prod can reach the internet but never each other.
Every VPC ships flow logs (all traffic) to the security account's KMS-encrypted store, wired into the same audit backbone.
NAT is the largest idle cost. Per-AZ NAT gives HA; a single NAT is a documented dev-cheap option.
Private subnets are sized and tagged for Kubernetes, so the cluster and load balancers discover them with no retagging.
Inside refplatform-dev: modern auth via access entries (no aws-auth configmap), workload identity via Pod Identity (no node-role sharing), encrypted control plane and nodes.
Modern EKS throughout. Identities are granted with access entries instead of the legacy aws-auth ConfigMap, and workloads get least-privilege IAM through Pod Identity rather than sharing the node instance role.
Private access is always on; public is restricted to an admin CIDR and forbidden from being 0.0.0.0/0. Prod goes fully private.
Spot capacity across several instance types, one-click teardown, and standard-support version to avoid the 6x extended-support rate.
ArgoCD app-of-apps drives the platform from Git: Karpenter (spot autoscaling), kube-prometheus-stack (metrics + Grafana), and Kyverno (admission policy) are live increments; Cilium and Backstage are next.
Org SCPs, permission boundaries on every privileged principal, a Config conformance pack attesting the controls, and Kyverno at the admission gate, layered from the org root down to the pod.
SSO for humans, OIDC for CI, Pod Identity for workloads. No IAM users, no access keys, nowhere. Application secrets, where a workload truly needs one, live in Secrets Manager and are fetched over Pod Identity.
Validated org CloudTrail isolated in the security account, an SCP that forbids disabling it, and TLS-only, non-destroyable buckets.
Spot capacity, per-flag paid services, one-click teardown/rebuild, and $50-increment budget alarms. Idle cost trends to near-zero.