Decide how people sign in, once, for every cloud account.
Everyone reaches the cloud through your existing company login with a second factor, not through separate usernames created inside each cloud account. When someone leaves, closing their company account closes their cloud access too.
Why it is expensive later
Every script and habit built on logins made inside the cloud has to be found and moved later, usually during an audit or an incident. The longer it runs, the less anyone knows which logins still work.
What good looks like
One sign-in source, access given to groups rather than to named people, a second factor for everyone, and two locked-away emergency accounts with a tested procedure.
In each cloudAWS IAM Identity Center · Microsoft Entra ID · Google Cloud Identity, or the identity provider you already use.
Red flagengineers share one administrator login, or people who left still have cloud access.
No passwords sitting in code.
Your deployment pipeline and your applications need access too. Decide now that they get short-lived access tied to who they are, instead of permanent keys pasted into settings files and pipeline secrets.
Why it is expensive later
A permanent key gets copied. Once it sits in five code repositories, two laptops and a vendor's tool, changing it breaks things, so nobody changes it.
What good looks like
Pipelines swap a short-lived token for access limited to one repository and one environment. Applications use the cloud's built-in identity. Any key that remains has an owner and an expiry date.
In each cloudAWS IAM roles with OIDC federation · Azure managed identities and workload identity federation · Google Cloud workload identity federation.
Red flagthe plan says "we will keep the keys in the pipeline for now."
Reserve your network addresses before anything uses them.
Every cloud network needs a block of private addresses. If two networks use the same block, they cannot talk to each other, or to your office, without awkward workarounds.
Why it is expensive later
Changing addresses means rebuilding the network and everything running on it. It is a common reason a "simple" link to a new office, an acquired company or a second cloud turns into a project.
What good looks like
One written plan that sets aside separate, non-overlapping ranges for each environment, region and cloud, with room to grow and no clash with your offices or data centres.
In each cloudVPCs in AWS and Google Cloud · virtual networks in Azure. The rule is the same everywhere.
Red flagevery team accepted whatever range the setup screen suggested.
Decide where traffic goes and how names are found.
Decide whether systems connect through one central hub or straight to each other, where traffic leaves for the internet, and how a server in the cloud finds a name that lives in your office, and the other way round. Name lookup is what DNS does.
Why it is expensive later
Once applications depend on particular routes and names, adding a central checkpoint for outbound traffic or fixing name lookups means touching every application at the same time.
What good looks like
A shared hub with one controlled way out to the internet, private connections to the cloud's own services, and one written path for name lookups between cloud and office.
In each cloudAWS Transit Gateway and Route 53 Resolver · Azure hub networks or Virtual WAN with Azure DNS Private Resolver · Google Cloud Shared VPC and Cloud DNS.
Red flagnobody can say where internet traffic leaves, or name lookups only work from some machines.
Decide the layers once. Every workload inherits them.
Keep a record nobody on the project can delete.
The cloud keeps a record of who did what. Turn it on for every account from day one, and send it to a separate place that the people running the systems cannot switch off or erase.
Why it is expensive later
History you did not collect cannot be recovered. When a customer questionnaire, an auditor or an incident asks who changed something in March, the answer is either in the log or it is gone.
What good looks like
Activity logging switched on across the whole organization by default, stored centrally in a separate account with restricted access, kept for a period someone actually agreed to.
In each cloudAWS CloudTrail organization trail into a log archive account · Azure activity logs into a central Log Analytics workspace · Google Cloud aggregated log sinks at the organization level.
Red flagthe logs live inside the same account they are supposed to watch.
Turn on the built-in alarms and name who answers them.
Each cloud has built-in threat detection and settings checks you can switch on. The switch is the easy part. The decision is who reads the alerts, and how fast.
Why it is expensive later
Switched on late, the first scan reports hundreds of problems at once and the team learns to ignore them. Switched on early, each new problem shows up while it is small and one person's to fix.
What good looks like
Detection on in every account automatically, including new ones, alerts sent to a named person or rotation, and an agreed response time for the serious ones.
In each cloudAmazon GuardDuty and AWS Security Hub · Microsoft Defender for Cloud · Google Security Command Center.
Red flagalerts go to a shared inbox that nobody owns.
Separate production from everything else, by design.
Each cloud divides your estate into containers: accounts in AWS, subscriptions in Azure, projects in Google Cloud, grouped into folders. Decide the shape before anything lives in it: which systems and environments get their own container, and how they are grouped.
Why it is expensive later
Moving a live system into a different container is a migration. Permissions, billing and rules all hang off this shape, so a poor one follows you everywhere.
What good looks like
Production kept apart from testing and development, shared services such as network, logs and security in their own homes, and new containers created from a template, not by hand.
In each cloudAWS Organizations accounts and organizational units · Azure management groups and subscriptions · Google Cloud folders and projects.
Red flagproduction and experiments share one account "to keep it simple."
Make a few things impossible, not just discouraged.
Some rules should never depend on someone remembering them: no storage open to the public without approval, only the regions you operate in, and logging that cannot be switched off. The cloud can enforce rules like these for every account at once.
Why it is expensive later
Rules added after teams have built things break those things. Exceptions pile up and the rule quietly stops meaning anything.
What good looks like
A short list of organization-wide rules applied from the top of the structure, tested before rollout, with a written way to ask for an exception.
In each cloudAWS service control policies · Azure Policy · Google Cloud Organization Policy.
Red flagthe security standard is a document, and nothing in the cloud checks it.
Build everything from code, so it can be rebuilt.
Networks, permissions and servers are written down as code, reviewed like any other change, and applied by an automated pipeline. Clicking around the cloud console is for looking, not for changing production.
Why it is expensive later
A foundation built by hand cannot be copied, reviewed or rebuilt with confidence. Turning it into code afterwards means working out what someone clicked a year ago.
What good looks like
The foundation and the workloads defined in code with peer review, the pipeline as the only thing allowed to change production, and alerts when the live setup drifts from the code.
In each cloudTerraform or OpenTofu work across all three · AWS CloudFormation · Azure Bicep · Google Cloud Infrastructure Manager.
Red flag"we will write the code once it is working."
Give every line of the bill an owner before the first bill.
Decide how everything is labelled, who owns each account's spending, and what alert fires when spending jumps.
Why it is expensive later
Unlabelled resources are hard to trace back to a team. The first surprise bill becomes a week of detective work and an awkward conversation with finance or the board.
What good looks like
Required labels for owner, environment and cost centre, a budget alert on every account, and one named owner per account who reviews spending each month.
In each cloudAWS cost allocation tags and AWS Budgets · Azure tags and Cost Management budgets · Google Cloud labels and billing budgets.
Red flagfinance sees one cloud invoice and nobody can split it by team.
Build, fix or stop.
Want your foundation plan reviewed?
Send us the plan, or what you have built so far. We check it against these decisions for the clouds you actually use and hand you a written list of what to settle, in order. One scope, fixed fee, quoted in 48 hours. No discovery call.
Get a fixed quoteIf you are too early for a project, the form says so, and you get thirty minutes of architecture advice instead.