I don’t build landing zones. I get workloads through them.

The landing zone is built and the first real workload still isn’t in production. What eats the calendar isn’t technology. It’s approval to open the accounts, a directory group that doesn’t carry the permissions the estate assumed, networking back to the on-prem data centers, SAML that won’t federate against the new accounts. And a review board that wants the diagram in the right colors before it will start picking at the architecture.

None of that construction is wrong. An account per environment, the corporate directory into Okta, every role request approved by your leadership and by the account owner, least-privilege roles vended per environment, no account-admin in production — that is why nobody takes prod down from a laptop. Nobody wrote the path through it.

I have been the tenant, not the architect. Moving an acquired business onto AWS inside Cigna’s estate, my first workload crossed ten stations — account approval through the game-day tests — and took over a year, almost none of it code. Once the path existed a project crossed in about six weeks. I took eight through it.

⤢

Fig. 01 · pinch or scroll to zoom · drag to pan

Close

+ − Fit

The platform team’s golden Terraform modules were often the blocker. I sent PRs — Lambda, S3, EC2. It was a lot easier submitting PRs than begging the owning team to make the changes themselves. That is most of this work — clearing the blocker myself instead of filing a ticket about it.

For a director or platform lead whose estate is standing and whose teams still can’t ship into it. Not a landing-zone design — I’ve never built one, and both estates I worked in were built before I got there. This is planned work: one workload through the gauntlet is a carve like any other. If production is down tonight, that’s production recovery.