Cloud accounts without the theatre
Landing zones are useful. Slideware about landing zones is not. A walk through one estate we actually run.
A landing zone is a set of accounts, networks, and policies. It is not a transformation programme. When we walk an estate, we start with the bill, the identity graph, and the last three incidents — not with a reference architecture printed in landscape.
Harbor Ops had seventeen accounts and one person who understood the peering. We collapsed the unused ones, named the rest, and put the diagram in the same repo as the Terraform.
The theatre is optional. The runbook is not. If the on-call engineer cannot say which account holds production data, the cloud work is unfinished.