AWS Automation
End-to-end automation of AWS account provisioning, networking, and security baselines.
Overview
A multi-account AWS environment for a 200-engineer organisation had grown organically for five years — accounts were provisioned manually, networking was inconsistent, and nobody had full visibility into spend. This engagement automated account creation, applied consistent security guardrails, and rebuilt cost governance from the ground up.
The Challenge
New AWS accounts took 2-3 weeks to provision manually, often missing critical security baselines (CloudTrail, GuardDuty, IAM password policies). Cost allocation was impossible because tagging was inconsistent across teams, and nobody could answer 'which team owns this $40k/month bill?' with confidence.
Approach
- Built an AWS Control Tower + Account Factory pipeline — new accounts provision in under 20 minutes with security guardrails pre-applied
- Implemented Service Control Policies (SCPs) enforcing mandatory tagging at the Organization level — non-compliant resources are blocked at creation
- Automated cost allocation reporting with AWS Cost Explorer APIs feeding a weekly Slack digest per team
- Reserved Instance and Savings Plans purchasing automated via Lambda based on 30-day utilisation trends
- Right-sizing recommendations surfaced automatically using CloudWatch metrics and Compute Optimizer
Technology Stack
Results — Before vs. After
New account provisioning time
Monthly AWS spend
Tagging compliance
Untagged / unattributed spend
Outcome
Monthly AWS spend dropped 36% within the first quarter. Account provisioning went from weeks to minutes. Every dollar of spend is now attributable to a specific team, enabling real FinOps accountability instead of finance guesswork.
Facing a similar challenge in your organisation?
I work with engineering teams and businesses to design, build, and modernise cloud platforms — backed by a network of trusted specialists for execution at any scale.
Get In Touch