Cloud Adoption Framework & Landing Zones

CAF = adoption journey methodology. Well-Architected = workload quality review. Both are needed, in sequence.

Cloud Adoption Framework (CAF):
Available from all three major clouds: AWS CAF, Microsoft Cloud Adoption Framework (Azure), Google Cloud Adoption Framework.
Core purpose: guide an organisation through the full cloud adoption lifecycle — from initial strategy to scaled operations.

AWS CAF phases (simplified):
• Envision — define cloud business strategy, outcomes, migration scope, executive alignment
• Align — assess capabilities across 6 perspectives: Business, People, Governance, Platform, Security, Operations. Identify gaps.
• Launch — build landing zone, pilot migrations, iterate on the process
• Scale — run migration waves, optimise, modernise towards cloud-native

CAF perspectives (AWS) — the 6 capability domains:
• Business — ensure cloud investments align to business outcomes
• People — organisational change, skills, operating model transformation
• Governance — risk management, financial governance, compliance
• Platform — architecture principles, cloud platform design
• Security — cloud security posture, controls, compliance requirements
• Operations — cloud operations model, monitoring, ITSM integration

Well-Architected Framework (WAF) — used after workloads are running:
Review any workload against 6 pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimisation, Sustainability.
Produces improvement recommendations, not a migration plan.

Key vocabulary:
• Cloud Adoption Framework (CAF) — structured methodology for the full cloud adoption programme
• Well-Architected Framework (WAF) — workload quality review framework applied to running systems
• CAF perspectives — the 6 organisational capability domains assessed in the Align phase
• Operating model — how an organisation manages its cloud environment day-to-day

Multi-account structure and hub-and-spoke networking are the two most consequential landing zone design decisions.

Multi-account structure — why it matters:

Account type	What lives here
Production	Live customer-facing workloads; strictest guardrails
Non-production	Dev, test, staging — less restrictive, lower cost targets
Shared services	Centralised DNS, Active Directory, Secrets Manager
Security	GuardDuty aggregation, Security Hub, SIEM integration
Log archive	Immutable, append-only log storage. No human write access.

Benefits: blast radius containment (a security incident in dev doesn't affect prod), independent cost tracking, independent compliance scope per account.

Hub-and-spoke network topology:

[On-premises] ←→ [Transit Gateway / Hub VPC]
                          ↓
              ┌──────────────────────┐
         [Prod VPC]  [Dev VPC]  [Shared Services VPC]
         (spoke)     (spoke)    (hub-resident services)

• All traffic between spokes flows through the hub (where security inspection — NGFW, IDS — runs)
• Direct spoke-to-spoke traffic is blocked by default
• Centralised egress: all internet-bound traffic exits through the hub for inspection
• AWS: implemented with Transit Gateway; Azure: with Azure Virtual WAN or Hub VNet

Key vocabulary:
• Multi-account structure — multiple AWS accounts / Azure subscriptions organised in a management hierarchy
• Blast radius — the scope of impact if a security incident or misconfiguration occurs; multi-account limits it
• Hub-and-spoke — network topology with centralised hub for shared services and security inspection
• Transit Gateway — AWS service that connects multiple VPCs and on-premises networks through a central hub

Preventive + detective guardrails form a defence-in-depth security strategy — neither replaces the other.

Preventive guardrails — block before it happens:
• Service Control Policies (SCPs) — AWS Organizations controls that override IAM. Example: "deny all actions in regions outside eu-west-1 and us-east-1"
• Azure Policy — deny deployments that violate policy. Example: "all VMs must use approved OS images"
• Permission boundaries — IAM constructs that cap the maximum permissions a role can have
• Examples of useful preventive guardrails:
— Block creation of public S3 buckets at account level
— Require encryption at rest for all storage services
— Prevent disabling of CloudTrail/logging
— Deny MFA-free IAM user creation

Detective guardrails — alert on violations:
• AWS Config rules — continuously evaluate resource configurations. Alert when drift detected.
• AWS Security Hub / Azure Security Center — aggregated security findings across accounts
• GuardDuty / Microsoft Defender — ML-based threat detection (unusual API calls, credential misuse)
• CloudTrail / Azure Monitor Logs — API call audit trail
• Examples of useful detective guardrails:
— Alert on any root account usage
— Alert on public security group rules for SSH/RDP
— Alert on IAM key age > 90 days
— Alert on unencrypted database instances

Why both?
• Preventive guardrails can't cover every scenario and may be too restrictive for some teams
• Some historical resources predate the guardrails and need detective coverage
• Detective alerts let you understand your security posture even where you chose not to block

Key vocabulary:
• Preventive guardrail — a control that blocks non-compliant actions before they can be executed
• Detective guardrail — a control that identifies and alerts on non-compliant configurations after the fact
• SCP (Service Control Policy) — AWS mechanism for account-level permission boundaries in an organisation
• Drift — when a resource's actual configuration diverges from its desired/compliant state

Operating model transformation is the hardest part of cloud adoption — technology is easy; culture and process change is hard.

The five dimensions of operating model transformation:

1. Skills and capabilities:
• From: server administration, VMware, storage array management
• To: cloud platform skills (AWS Solutions Architect, Azure Administrator), Terraform, Kubernetes
• Action: training programmes, certifications, hiring cloud-native engineers

2. Process changes:
• From: ITSM change requests taking 2 weeks to provision a server
• To: self-service infrastructure via Terraform in minutes, governed by guardrails
• From: manual patching workbooks
• To: automated patching via Systems Manager / Azure Update Manager

3. Team structure:
• Cloud Centre of Excellence (CCoE) — owns cloud standards, landing zone, governance
• Platform engineering team — builds the internal developer platform on top of cloud primitives
• Application teams consume cloud via the platform — they don't manage infrastructure directly

4. Financial management (FinOps):
• From: CapEx budgeting (annual hardware budget, approved by committee)
• To: OpEx management (monthly variable cloud bill, requires real-time cost visibility)
• Chargeback / showback models per team or product

5. Security and compliance posture:
• Shared responsibility model: cloud provider secures the infrastructure; you secure your data and configurations
• Continuous compliance monitoring vs. periodic audits

Key vocabulary:
• Operating model — the set of processes, organisational structures, skills, and tools used to deliver IT services
• Cloud Centre of Excellence (CCoE) — the team that owns cloud strategy, standards, and the landing zone
• Shared responsibility model — the division of security responsibilities between the cloud provider and the customer
• FinOps — the practice of managing cloud financial spend with engineering and finance working together

The solution is layered logging: real-time operational access in-account + centralised immutable archive for compliance and security investigation.

Landing zone logging architecture (best practice):

Application Account (prod)
  ├── CloudWatch Logs → real-time operational use
  └── CloudTrail → API audit trail
         ↓ (continuous export)
Log Archive Account (immutable)
  └── S3 with Object Lock (WORM)
        └── Retention: 7 years
        └── Write: automated export only
        └── Read: Security team (read-only)
        └── Delete: Nobody (Object Lock prevents it)

What goes into centralised logs:
• CloudTrail / Azure Activity Log — all API calls across all accounts; critical for security investigation and audit
• VPC Flow Logs / NSG Flow Logs — network traffic logs for forensics
• DNS query logs — for detecting C2 (command and control) traffic
• Config snapshots — resource configuration history for compliance demonstation

Log archive account governance:
• No human write or delete access — even the security team's accounts can only read
• Object Lock / WORM (Write Once Read Many) — prevents modification or deletion for retention period
• SCP guardrail: SCPs on the log archive account deny all DeleteBucket, PutBucketPolicy actions

Why this matters:
• Insider threat scenario: a compromised admin can delete logs in their own account — they cannot delete the centralised archive
• Compliance: PCI-DSS, SOC 2, ISO 27001 all require tamper-evident log retention
• Incident investigation: security team can investigate any account using centralised logs without needing production account access

Key vocabulary:
• Log archive account — a dedicated, locked-down account for centralised, immutable log retention
• Object Lock (WORM) — storage feature preventing object modification or deletion for a retention period
• CloudTrail — AWS API call audit logging service; must be enabled in every account and region
• Tamper-evident logging — logs stored in a way that makes unauthorised modification detectable

This comment isn't about unit testing, database performance, or CI/CD. It directly references the Cloud Adoption Framework (CAF), a structured approach to cloud adoption. The reviewer is emphasizing the importance of following CAF's guidance on IAM – specifically least privilege and API key rotation – which are critical security components within the framework. The comment highlights that simply writing code isn't enough; it needs to align with a broader strategic approach like the CAF.

This comment isn't about unit testing, database performance, or CI/CD. It directly references the Cloud Adoption Framework (CAF), a structured approach to cloud adoption. The reviewer is emphasizing the importance of following CAF's guidance on IAM – specifically least privilege and API key rotation – which are critical security components within the framework. The comment highlights that simply writing code isn't enough; it needs to align with a broader strategic approach like the CAF.

This comment isn't about unit testing, database performance, or CI/CD. It directly references the Cloud Adoption Framework (CAF), a structured approach to cloud adoption. The reviewer is emphasizing the importance of following CAF's guidance on IAM – specifically least privilege and API key rotation – which are critical security components within the framework. The comment highlights that simply writing code isn't enough; it needs to align with a broader strategic approach like the CAF.

This comment isn't about unit testing, database performance, or CI/CD. It directly references the Cloud Adoption Framework (CAF), a structured approach to cloud adoption. The reviewer is emphasizing the importance of following CAF's guidance on IAM – specifically least privilege and API key rotation – which are critical security components within the framework. The comment highlights that simply writing code isn't enough; it needs to align with a broader strategic approach like the CAF.

The Landing Zone provides a foundational infrastructure that supports multiple workloads and aligns with broader organizational goals. Option B accurately describes the core purpose: establishing a robust and adaptable base for cloud operations, incorporating security, scalability, and manageability – all key tenets of the CAF's 'Design' phase. Options A, C, and D represent narrower focuses or misinterpretations of the Landing Zone's overall strategic value.

Mark's message highlights the importance of comprehensive logging to meet security and compliance needs. Immutable infrastructure combined with centralized logging directly supports auditability and rapid incident response – essential for mitigating risks associated with cloud environments. Options A, C, and D address operational aspects that are secondary to Mark's stated concern regarding security and governance.

The reviewer is advocating for a strong governance element, specifically focusing on access controls and auditing – core components of the CAF's security and compliance guidelines, particularly relevant in regulated industries like financial services. While options A-D represent important aspects of cloud adoption, they don't directly address the immediate concern raised by the review comment regarding security posture.

'Operating model transformation' refers to a holistic change encompassing culture, processes, and technology—a fundamental shift in how the organization delivers value. It goes beyond simply moving applications to the cloud; it involves adopting practices like DevOps, automation, and continuous delivery to support a more agile and efficient operation. Options A-D represent specific technical implementations of the transformation.

The core trade-off is between centralized logging (emphasizing security, auditability, and compliance) and distributed logging (prioritizing operational agility and faster troubleshooting). Centralized logging offers a single source of truth but can hinder rapid debugging, while distributed logging provides localized insights but potentially compromises overall governance and security controls.