Checklist
The day-one foundation checklist
Six yes/no checks for a cloud foundation that passes a customer's security questionnaire in an afternoon instead of a quarter.
I'm starting to see the same setup in a lot of early startups: one AWS account, a shared root login, and an admin key in a CI secret. It works until a customer's security team asks who can reach production data. Then the answer takes a quarter to build. These six checks are the foundation I set up in week one. Each one costs almost nothing on day one and a lot to retrofit after the first enterprise deal.
From the talk: Lean cloud architecture that scales
The six checks
Each yes scores one point.
- 1.We split accounts by job. AWS Organizations with at least four accounts: management (billing only), security and log archive, staging, and production. New accounts go per environment, never per feature.
- 2.Every human signs in through single sign-on with MFA. IAM Identity Center for every login. No IAM users, no shared root, and MFA on for every account.
- 3.The pipeline holds no long-lived keys. GitHub Actions (or any CI) deploys through OIDC federation and gets short-lived credentials per run.
- 4.A policy keeps customer data in one EU region. For example eu-central-1 (Frankfurt) or eu-west-1 (Ireland). A service control policy enforces it, not a team agreement.
- 5.Logs, threat detection, and budgets run everywhere. An organisation-wide CloudTrail trail into the log archive account, GuardDuty in every account, and AWS Budgets alerts on every account.
- 6.All of it lives in code. One Terraform repository with a pipeline and the same review as application code. If it only exists in the console, it doesn't exist at due diligence.
What the score means
| Score | Where we stand |
|---|---|
| 6 | Ready for the first enterprise security questionnaire. |
| 4 to 5 | Close. The gaps aren't equal, though. Some of them are the first thing a buyer's questionnaire asks about. |
| 0 to 3 | I'd fix identity and the pipeline keys first. They close the most risk per day of work. |
The same checks on Azure and Google Cloud
| Check | AWS | Azure | Google Cloud |
|---|---|---|---|
| Accounts split by job | AWS Organizations accounts | Management groups and subscriptions | Resource Manager folders and projects |
| Single sign-on with MFA | IAM Identity Center | Microsoft Entra ID | Cloud Identity or Google Workspace |
| No long-lived pipeline keys | IAM OIDC identity provider | Entra workload identity federation | Workload Identity Federation |
| EU region by policy | Service control policy on aws:RequestedRegion | Azure Policy allowed locations | Organization policy on resource locations |
| Logs, detection, budgets | CloudTrail, GuardDuty, AWS Budgets | Activity log, Defender for Cloud, Cost Management budgets | Cloud Audit Logs, Security Command Center, billing budgets |
| Everything in code | Terraform | Terraform | Terraform |
What I leave out on purpose
I leave out a full landing-zone product, a SIEM, and a dedicated network account. None of them pays back before the first serious enterprise customer. Each one is easy to add once a customer actually asks.
Next step
I highly recommend bringing your score to a thirty-minute call. I'll show which two gaps to fix first, and in what order. Which of the six did your team miss?
Book a callThese takeaways are an engineer's reading of the rules and the tools. I wrote them to help teams decide what to build. They aren't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.
Other takeaways from this talk
Checklist
Five lines to check on your cloud bill
The five lines on an AWS bill where I find waste first, with where to look in Cost Explorer and what to change.
Scorecard
AI workflow payback scorecard
Four questions that tell whether an AI workflow is worth building before anyone picks a model, scored out of eight.
Let's talk.
A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?
Prefer email or phone? hello@netninjas.eu or +31 6 45984313