Context
A large international retail group runs on a multicloud Azure and Google Cloud foundation: about 900 applications, more than 90 Azure subscriptions, hundreds of resource groups, thousands of Google Cloud projects.
Challenge
Delivering a new cloud environment took several weeks. The common foundation also had to hold as the environment grew: a readable hierarchy, privileges granted as narrowly as possible, governance rules applied the same way everywhere.
What I did
My role: DevOps engineer, then cloud architect, in the 8-person team in charge of the landing zone (2021–2024), then Tech Lead of the Architecture team since February 2024.
- A tracked request and approval process: a request portal, FinOps and Architecture approvals.
- Shared Terraform modules (DNS, Application Gateway…), reused by every product team.
- Azure Policy guardrails, FinOps included: allowed VM families and disk types.
- Access governance: Entra ID PIM, least-privilege AKS RBAC; on Google Cloud, tag bindings, IAM conditions and Organization Policies.
Outcome
Delivering a cloud environment went from several weeks to 72 hours, thanks to the tracked request process and the shared Terraform modules. Every product team reuses these modules.
Stack
- Azure
- GCP
- Terraform
- Azure Policy
- Entra ID
- PIM
- Application Gateway