REGIONus-gov-west-1 · us-gov-east-1 BASELINEFIPS 140-3 · TLS 1.3 SCOPEIL2 · IL4 · IL5-ready

For government / 01 · Cloud

Federal cloud, built right the first time.

Multi-account AWS GovCloud landing zones with security-control inheritance, IaC-only operations, and a path to confidential compute. We architect infrastructure that passes A&A on the first review — IL2, IL4, and IL5-ready.

Scope an engagement ← All practice areas

Multi-account

Landing zone · LZA-aligned

100% IaC

Terraform · all of prod

Hourly

Drift detected · auto-PR'd

TGW · IPv6

Transit Gateway dual-stack

Reference architecture

Multi-account org.
Centralized everything.

An AWS Organization at the root denies destructive actions org-wide and owns the inheritance chain. Dedicated log-archive, security, network, and shared-services accounts feed every workload OU — and workload accounts cannot disable the guardrails the org delegates them. SCPs from root, Config rules from security, routes from network.

What we build

Six core capabilities.

Org-level to confidential compute.

Landing zones

LZA-aligned multi-account org — SCPs deny destructive actions in prod.

The centralized logging account is the only place CloudTrail and Config write to. Org-wide CloudTrail, log-archive S3 with Object Lock (WORM), AWS Config conformance packs (FedRAMP Moderate / NIST 800-53), and GuardDuty + Security Hub findings aggregated to the security account. Service Catalog products ship vetted, pre-approved patterns.

Organizations · SCPsControl TowerConfig ConformanceObject Lock WORMService Catalog

Infrastructure as code

100% of prod is Terraform. No click-ops, ever.

State in S3 + DynamoDB lock per account. The module library is internal-only — never github.com/… direct refs. OpenTofu-compatible, pinned providers, checksum-verified. tflint + checkov + tfsec + terraform-compliance run in CI. Drift detection runs hourly and auto-opens an MR with the diff; Atlantis-style PR-driven applies sit behind a manual approval gate.

Terraform 1.9+OpenTofucheckov / tfsecDrift detectionPacker

Network architecture

Transit Gateway hub in the network account; workload VPCs attach as spokes.

No public IPs in prod unless explicitly approved. VPC endpoints for every supported service. IPv6 dual-stack from day one — no NAT tax for outbound. Route 53 Resolver rules + IPAM keep CIDRs non-overlapping. FIPS 140-3 VPC endpoints, TLS 1.3 minimum, and AWS Network Firewall with managed Suricata rule groups.

Transit GatewayPrivateLinkNetwork FirewallRoute 53 ResolverIPAM · IPv6

Identity & access

IAM Identity Center as the front door — no long-lived access keys in prod, period.

Permission sets are Terraform-managed. Break-glass roles require ticket + dual-approval. STS session limits + ABAC tags scoped to OU. SCPs deny iam:CreateAccessKey in workload accounts. Access Analyzer findings are tracked as POA&Ms automatically, and CI federates via OIDC — no static deploy keys.

IAM Identity CenterKeycloak (RHBK)PIV / CACABACOIDC federation

Multi-region resilience and disaster recovery

Resilience & DR

Active-active where the workload supports it, warm-standby where it doesn't.

Backup vaults locked with vault-lock immutability. Restore is tested quarterly with a real game-day, not a runbook. AWS Backup org policy with cross-region copy, RDS / Aurora global cluster at 1-min RPO across regions, Route 53 ARC for health-check-first failover, and scheduled chaos engineering with aws-fis.

AWS Backup · vault-lockAurora globalRoute 53 ARCaws-fis chaos

RPO ≤ 5 minRTO ≤ 15 minRestore tested quarterly

Confidential compute

Nitro Enclaves for attested, isolated execution — KMS key material never leaves the enclave.

The foundation for FedRAMP High and IL5 trajectories. Nitro Enclaves with KMS attestation-based grants, EC2 with NitroTPM + UEFI Secure Boot for cleared baselines, Outposts & Snowball Edge for tactical / disconnected scope, and Wavelength + Local Zones evaluated for edge AI inference.

Nitro EnclavesNitroTPMOutpostsSnowball EdgeIL5 trajectory

The stack we operate

Real tools, no buzzwords.

Gov + commercial · prod = 100% IaC.

Cloud & org

Gov + commercial, centralized governance.

AWS GovCloud (US)AWS CommercialAzure GovOrganizations · SCPsControl TowerService CatalogAudit Manager

IaC & compute

Prod is 100% Terraform; compute spans serverless to Nitro.

Terraform 1.9+OpenTofuPackerCDK (TS)EKSLambdaECS FargateEC2 · NitroNitro Enclaves

Networking & identity

Hub-and-spoke, PIV-capable identity.

Transit GatewayPrivateLinkNetwork FirewallRoute 53 ResolverIPAM · IPv6IAM Identity CenterKeycloak (RHBK)PIV / CAC

Data & observability

Immutable storage, open-standard telemetry.

Aurora (PG / MySQL)S3 · Object LockDynamoDBEFS · FSxCloudWatchGrafana (AMG)Prometheus (AMP)OpenTelemetry

Tech radar · Q2

Where we're investing.

Adopt · trial · assess.

Adopt

In prod now.

IPv6 dual-stack — no more NAT tax, cleaner outbound posture. OIDC federation to CI — zero static keys in GitLab. S3 Object Lock WORM — immutable audit logs. FIPS 140-3 endpoints — cipher-suite hygiene by default.

Trial

Piloting · select workloads.

Nitro Enclaves — attested, isolated execution for crypto. Aurora DSQL — active-active SQL across regions. EKS Pod Identity — IRSA without the boilerplate. Karpenter on Graviton — 40% cost cut on the stateless tier.

Assess

Watching · not yet GA.

Bedrock GovCloudPost-quantum KMSConfidential containers · SEV-SNPWavelength edge zones

New engagement

Federal-grade work. Real architecture.

A free consultation. Tell us the program, the boundary, and where you are in the A&A process — we'll come back with an architecture and a fixed quote.

Get a quote ← All practice areas

Email[email protected]

Phone(801) 917-4617

LocationUtah · Mountain Time

ResponseWithin 24 hours