BuiltForProd by Nexstella
Infrastructure you can rebuild and review
Moving a console-built cloud to infrastructure as code means defining accounts, networks and access in files, then moving workloads onto that foundation step by step. BuiltForProd deploys the foundation as code and hands over the source.
01 Sound familiar
Sound familiar?
-
Nobody is sure which settings in the console matter, so nobody dares to tidy them, and every month the list of things not to touch grows a little longer.
-
Staging and production drifted apart long ago. A change that worked in one breaks the other, and the difference only shows up after customers notice.
-
The person who clicked most of it together has moved on, and the only record of why a rule exists is a chat thread from two jobs ago.
Account map
What becomes code when the foundation lands
In the AWS Enterprise Baseline, 14 accounts, 6 VPCs and 11 permission sets are defined in OpenTofu and Terragrunt. Choose an item to see what it replaces in the console.
Accounts
-
Workload accounts
Sandbox, dev, staging and prod come from one template, so they stop drifting apart.
-
Shared accounts
Security, logging, networking and artifacts each get an account with one job.
-
Adding an account
A new account is an entry in a map and a folder, reviewed in a pull request like any change.
Network
-
Hub and spokes
Workload networks connect through a central hub instead of a web of one-off peerings.
-
Separated domains
Production and non-production networks cannot reach each other, by design rather than by habit.
-
Address plan
Address ranges come from one plan, and the pipeline rejects ranges typed in by hand.
Access
-
Permission sets
Roles from read-only to platform admin replace the personal users created over the years.
-
Sign-on
Everyone reaches every account through one sign-on with sessions that expire.
-
No long-lived keys
Pipelines use short-lived roles, so no access key sits in a variable waiting to leak.
Change control
-
Plans on pull requests
Every change shows its expected effect before anyone approves it, so surprises surface in review.
-
Drift checks
Scheduled checks compare the cloud with the code and open an issue when someone edits by hand.
-
Gated production
Production changes wait for the reviewers you name, and the record of who approved stays.
02 A typical situation
What this usually looks like
Say a marketplace company built its cloud in the console while racing to launch. Years later the production network has rules nobody can explain, staging no longer resembles production, and a simple upgrade was postponed again because no one could predict its effect.
We would stand up a foundation in code next to the old setup rather than try to reverse-engineer every click. Workloads would move across one at a time, each with a rollback, and the old resources would be retired once nothing depended on them. Your engineers would review each step, so by the end they know the new setup better than they ever knew the old one.
03 Book a call
Change your cloud without holding your breath
Book a call with BuiltForProd. Sketch what runs where, and an engineer will outline how the move to code would be sequenced.
BuiltForProd by Nexstella: Nexstella's production engineering brand
Want the full picture? Read Cloud foundation.
Also written for you: Multi-account cloud foundation , Kubernetes platform for web apps .
Last updated