Cloud Landing Zone Starter Kit for Small Teams with Terraform
Build an open infrastructure-as-code kit that gives a small startup or software house a secure cloud foundation on AWS, Azure or Google Cloud in an afternoon: separate environments, SSO and least-privilege roles, a network with public and private subnets, central audit logging, budgets, guardrail policies and a drift and compliance report. An advanced cloud and DevOps final year project.
Advanced
Needs a team, real planning, and a supervisor who knows the area.1 semester · 2 to 3 students
6 to ship
4 optional extrasSuggested stack
What you should ship
- Terraform modules that create separate dev, staging and production accounts, subscriptions or projects under one organisation, with a clear naming and tagging standard
- Identity: single sign-on groups mapped to least-privilege roles per environment, MFA required, and no long-lived keys
- A network module with non-overlapping address ranges, public and private subnets across zones, NAT for outbound traffic and default-deny firewall rules
- Central audit and activity logs shipped to a locked storage location the application teams cannot change
- Budgets and alerts per environment, and guardrail policies that block risky actions such as public buckets or disabling audit logs
- A pipeline that plans on pull requests and applies on merge using OIDC, plus a weekly drift and compliance report against a documented checklist
If you have time left
- Support a second cloud with the same module interface
- An account or project vending form for new teams
- Mapping the compliance report to a published benchmark such as the CIS Benchmarks for your cloud
- Cost anomaly alerts sent to a chat channel
The problem: small teams start in one account with one admin key
Most startups and software houses start their cloud life in a single account or project, with one admin login shared on chat, production next to experiments, no audit trail and no budgets. It works until a key leaks, a developer deletes the wrong database or an invoice arrives that nobody can explain. Fixing the foundation later, with customers on it, is slow and risky.
What already exists and the gap
- AWS Control Tower sets up a multi-account AWS environment with guardrails, and the Azure landing zones in Microsoft's Cloud Adoption Framework do the same for Azure. Both are thorough but sized for enterprises, with many components a five-person team does not need and cannot run.
- On Google Cloud, the enterprise foundations blueprint and the open-source Cloud Foundation Fabric with its FAST stages provide Terraform for production-ready organisations, again designed for larger organisations.
- Consultancies build landing zones for clients, but at consultancy prices.
The gap is a small, readable kit that a team of a few engineers can apply, understand and maintain themselves, with the essentials only and a report that tells them when things drift.
Inspiration
Every cloud provider publishes landing zone guidance, and job posts for cloud engineers in both global companies and software houses ask for exactly these skills: multi-account structure, SSO, networking, logging and guardrails in Terraform. This project turns that guidance into something a small team can adopt.
What you build
Choose one cloud for the core project. Write Terraform modules for the organisation structure, identity, network, logging, budgets and policies, wire them into a pipeline that plans and applies through pull requests, and write a compliance script that checks a live environment against your checklist and produces a short report.
The technically interesting part
Deciding what to leave out. You must find the smallest set of controls that protects a small team: which guardrails block real mistakes without blocking everyday work, how to bootstrap the first admin identity and the Terraform state safely, and how to detect drift when someone changes something by hand.
How you will evaluate it
Time how long it takes to apply the kit to an empty organisation, then run a set of "bad day" tests: try to create a public bucket, disable audit logging, use a long-lived key, or change a network rule by hand. Record which ones the kit blocks, which it detects in the report and which it misses. Ask two or three developers to follow your README and note where they get stuck.
Path to a product
Publish the kit as open source and offer paid setup and yearly reviews to startups and software houses, or build a hosted compliance report on top of it. Teams that must pass customer security questionnaires are the most motivated early users.
Scope warning
Do not rebuild Control Tower. One cloud, a handful of well-chosen controls, a working pipeline and an honest evaluation is a strong project. Test only in an organisation you created for the project.
Learn what you need on Sefism
- Cloud engineering roadmap: pick AWS, Azure or Google Cloud and work through identity, compute, storage, networking, cost and infrastructure as code in order.
- Cloud engineering cheat sheet: the service name map across the three clouds, IAM policy anatomy, budgets, cost traps and Terraform basics in a line or two each.
- DevOps and cloud roadmap: pipelines, remote state and GitOps in more depth.
- Terraform: Up and Running: modules, state and team workflows.
- AWS Well-Architected Framework: the security and cost pillars as a checklist, whichever cloud you choose.
- GitHub Actions Documentation: the OIDC guides so your pipeline never stores a cloud key.
Get help with this idea
The risk with this project is copying an enterprise landing zone and ending up with something too large to finish or explain. Tauseef can help you cut the scope to one semester, choose the cloud and services, and plan an evaluation your supervisor will accept. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.