AWS multi-account · Organizations · Control Tower

Every account
in its place.
Before the auditor asks.

A $35,000 Build for the question every SOC 2 auditor, investor, and acquirer asks: how is production separated from everything else? We design your AWS organization the way AWS recommends, move every account into place, and put in the guardrails every new account inherits.

Book a 15-minute call with Charles See the structure we build Get the PDF brief

Two-week blueprint, $25,000. Six-week build, $35,000, with half the fee invoiced only when the foundation scan passes. One signature, no procurement cycle.

A container terminal at blue hour, steel containers stacked in ordered blocks with clear aisles between them, one amber lamp on a gantry crane.
2
Weeks to the target design and move plan
6
Weeks to every account in its place
13
Checks in the foundation scan, run at weeks one and six
0
Root credentials we ever hold, in any account

Design it, or build it too.
Both fixed price.

Fixed scope, fixed price, one signature.
Both start within two weeks of it.

Two weeks

The Blueprint

$25,000

Book a call about the Blueprint

Your AWS accounts, read from the inside, and the organization they should become. We inventory every account, run the foundation scan, and design the OU tree, the guardrails, and the move plan, in an organization you keep or a new one.

  • Every account inventoried: its owner, root custody, commitments, credits, and what would break if it moved
  • The foundation scan, thirteen checks drawn from AWS’s own multi-account guidance
  • The target OU tree and account map, and the guardrails, identity, logging, network, backup, vending, and tagging designs
  • The policy set as code: what each policy blocks, and who it would affect today
  • The move plan and the risk register, with the path chosen: retrofit or greenfield

Charles’s time: up to 40 hours over the two weeks, about 8 of them live with your team.

Read-only, start to finish. The role sees how your accounts and your organization are configured, not what they store, and you delete it the day we finish.

Guaranteed
Six weeks

The Build

$35,000

Book a call about the Build

The Blueprint in the first two weeks. Then weeks three through five stand up the landing zone, move every account into its place in approved change windows, and put the guardrails in. Week six runs the same scan again and hands it over.

  • Everything in the Blueprint
  • The landing zone set up or upgraded, with the Log Archive and Audit accounts and one organization trail
  • Every in-scope account moved into its target OU and enrolled, in waves, behind pre-flight checks
  • Guardrails every account inherits: SCPs, RCPs, declarative policies, and Control Tower controls, proven first
  • People on single sign-on, and one way to make the next account
  • The week-six re-scan against week one, and the runbooks to keep it there

Charles’s time: up to 110 hours over the six weeks, about 38 of them live with your team.

The guarantee. The second half of the fee is invoiced only when every check of the foundation scan agreed at the week-two readout passes at week six, verified by the same scan run the same way, and every in-scope account is in its target OU. A check you waive in writing counts as passed.

No standing access to anything. Write access in the management account exists only inside change windows you approve, through a role whose own trust policy expires; member accounts change only as code, through your pipeline.

Who this is for

  • A CTO, VP of Engineering, head of platform, or CISO whose production runs on AWS
  • Production, staging, and experiments in one account, a handful of accounts made by hand, or an organization that grew without guardrails
  • A SOC 2 or ISO 27001 audit, a financing, an acquisition, or a payer change on the calendar
  • Budget authority for a fixed-price engagement without a procurement cycle

Who it is not for

  • Teams that want workloads moved or re-platformed between accounts. Accounts move with their resources intact; moving resources is a separate engagement.
  • Estates beyond 50 accounts, or more than one source organization, without a change order
  • Organizations that cannot grant a read-only role in their own accounts. If you cannot grant any management-account access, the Build still runs with your engineer at the keyboard.
The add-on to the security engagement

Already ran the Audit?
The Build, in four weeks.

When our AWS Security, Compliance & Governance Audit has read your organization, its inventory and governance review replace the Blueprint’s discovery. The Build then starts at the design and runs in four weeks, under its own statement of work beside the security engagement’s.

  • The same Build. The same deliverables from the landing zone on, the same thirteen-check scan, and the same gate: half the fee is invoiced only when it passes.
  • One plan for both. The Build’s guardrail week and the Hardening’s criticals and guardrails week land through one Policy Staging rollout, so guardrails ship once.
  • Priced net. The add-on’s fee is already reduced for the work the Audit did; it takes no bundle discount and does not count toward one.
Four weeks

The Build after a Security Audit

$25,000

Book a call about the add-on

For a client that signs the Audit or the Hardening before it or together with it, in the same AWS organization. Week one starts no earlier than the Audit’s sponsor readout.

  1. Week 1
    Scan and design.The Audit’s inventory and governance review are the starting point. The foundation scan runs as the baseline, then the target OU tree and account map, the policy set, the path, the move plan, and the risk register; the readout approves the first change window.
  2. Week 2
    Landing zone and core accounts.Control Tower set up or upgraded, the Security OU with Log Archive and Audit, the organization trail, delegated security services, and IAM Identity Center.
  3. Week 3
    Accounts moved.People on single sign-on first, then the accounts in waves behind their pre-flight checks, each into its target OU, enrolled.
  4. Week 4
    Guardrails, vending, re-scan, and hand over.The baseline policies from Policy Staging, account vending proven on one real account, the same scan as week one, the runbooks, and the handover.

Charles’s time: up to 70 hours over four weeks, about 30 of them live with your team. Beyond that, $450 per hour by written change order.

The same guarantee. Half the fee at signature; the second half is invoiced only when the foundation scan passes at the end of week 4.

The AWS Engagement Bundle

Pair it with another
AWS engagement.

Cost, security, Well-Architected, and multi-account work read the same accounts, so they run well together. Take this engagement with one of the others and each is 10% off; take three or more and each is 15% off, in either shape.

Any two10% off each engagement

Two six-week engagements
$63,000 instead of $70,000
Two two-week diagnostics
$45,000 instead of $50,000

Three or more15% off each engagement

Three six-week engagements
$89,250 instead of $105,000
Three two-week diagnostics
$63,750 instead of $75,000
  • Any mix of shapes. Each engagement can be its two-week diagnostic or its six-week engagement, and the discount applies to whichever you choose. It is set at signature and does not change, unless you cancel an engagement before it starts.
  • One start. One read-only role, one kickoff, and one Pavilion workspace, and the engagements start two weeks apart, so the findings of one inform the next.
  • Every guarantee stands. Each six-week engagement keeps its own half-on-result invoice, and no threshold moves: the cost guarantee stays at $105,000 a year in measured savings.
  • The add-on is already net. The Build after a Security Audit (four weeks, $25,000) is priced for the work the Audit already did, so it takes no bundle discount and does not count toward one.

AWS Cost Analysis & Optimization AWS Security, Compliance & Governance Audit AWS Well-Architected Framework Review The bundle terms

Book a call about the bundle

Take it with you

The brief, as a PDF.

Everything on this page in a document you can hand to the person who signs: scope, weeks, deliverables, price, and terms. It is tagged for screen readers.

Two paths, one gate

Keep the organization you have,
or move into a new one.

Both paths end in the same target organization and pass the same scan. The Blueprint chooses between them, in writing, at the week-two readout.

Retrofit

When
Your organization is sound to keep: the management account runs no workloads, or can be emptied, and its payer relationship and history are staying.
What happens
Control Tower is set up or upgraded in your organization; the missing OUs and core accounts are created; accounts move into their target OUs and are enrolled; guardrails go in through Policy Staging.
What carries over
Billing history, Cost Explorer, commitments, credits, Marketplace agreements, and the support plan, untouched.
The main risk
The blast radius of a new policy in a live organization.

Greenfield

When
Your management account runs production, the organization belongs to someone else (a reseller, a parent, an acquirer), two organizations must become one, or the structure is too tangled to repair in place.
What happens
You create a new management account; Control Tower is set up there; accounts move from the source organization, and standalone accounts are invited, in waves through a Transitional OU into their target OUs.
What carries over
Each account’s resources, quotas, and IAM. Billing history, cost data, budgets, and payer-level agreements stay with the old management account, which usually joins the new organization as a member so its commitments and credits keep applying.
The main risk
Billing, commitments, and organization-scoped dependencies during the move.

Week by week

Because the work has a shape.
The same weeks, every time, which is why it is fixed price.

The Blueprint · two weeks · $25,000
  1. Week 1
    Inventory and scan.The read-only role goes into every account on day one, and into the management account. Every account, OU, policy, delegated administrator, trail, identity assignment, IAM user, commitment, and organization-scoped dependency is inventoried, and the foundation scan runs. Walkthroughs with your platform, identity, and finance leads.
  2. Week 2
    Design and plan.The target OU tree and account map, the guardrails, the identity, logging, network, backup, vending, and tagging designs, the path (retrofit or greenfield), the move plan by wave and change window, and the risk register. A design review with your platform team, then the sponsor readout.
The Build · six weeks · $35,000
  1. Week 1
    Inventory and scan.The Blueprint’s first week. No changes yet. This scan is the baseline the guarantee is measured against.
  2. Week 2
    Design and plan.The Blueprint’s second week. At the readout your sponsor agrees the account map, the scan’s checks, the path, and the change windows for weeks three through five, and approves the first window in writing.
  3. Week 3
    Landing zone and core accounts.AWS Control Tower set up or upgraded in your home Region. The Security OU with the Log Archive and Audit accounts, the organization trail into Log Archive, the security services delegated to Audit, and IAM Identity Center connected to your identity provider.
  4. Week 4
    Accounts moved.People move to single sign-on first, so nobody loses access when an account moves. Then accounts move in waves, a pilot of sandbox and non-production accounts first, each wave behind its pre-flight checks, and each account lands in its target OU, enrolled.
  5. Week 5
    Guardrails, vending, and shared services.The baseline policies and controls, proven in the Policy Staging OU, then attached OU by OU. Account vending through Account Factory or Account Factory for Terraform, proven by vending one real account. Central backup, the network account, and the tag policy where in scope.
  6. Week 6
    Re-scan and hand over.The same scan as week one, run the same way. The operations runbooks, the handover workshop, and the closing readout. Our operator role is deleted, and the re-scan proves it.

Want to walk through these weeks for your own organization?

Book a 15-minute call about these weeks

What you hold at the end.

Every deliverable is an artifact in your repositories or your inbox.
None of them is a promise in a deck.

The Blueprint · seven deliverables
  1. 01
    The inventory.Every account with its OU, owner, root email and MFA custody, support plan, commitments, credits, Marketplace agreements, IAM users and keys, delegated administrators, StackSet instances, resource shares, and the organization conditions that would break in a move.
  2. 02
    The foundation scan.Every check of the thirteen, run read-only against your organization as it is, with the raw results exported and the script you can read.
  3. 03
    The target design.The OU tree, the account map, the core accounts, and the guardrail, identity, logging, network, backup, vending, and tagging designs, each tied to the AWS guidance it follows (the structure, in public) and to every place it departs from it.
  4. 04
    The policy set.The baseline service control policies, resource control policies, declarative policies, tag policy, and Control Tower controls, as code, with what each blocks and who it would affect today.
  5. 05
    The move plan.The path, the waves, the change windows, and for each window its management-account actions, its pre-flight checks, and its rollback.
  6. 06
    The risk register.Billing, commitments, Marketplace, support, quotas, organization-scoped dependencies, root custody, and the policy blast radius, each sized for your organization with its owner and its handling.
  7. 07
    The sponsor readout.A short written document, presented in the closing meeting.
The Build · everything in the Blueprint, then eight more
  1. 08
    The landing zone,set up or upgraded and enrolled, in the Regions you govern, with the Security OU, the Log Archive and Audit accounts, and one organization trail into an archive no application account can alter.
  2. 09
    Every in-scope account in its place,moved into its target OU and enrolled, wave by wave, each wave behind its pre-flight checks and with its rollback ready.
  3. 10
    Guardrails at every OU:the baseline SCPs, RCPs, declarative policies, and Control Tower controls, proven in Policy Staging first and inherited by every account below.
  4. 11
    Identity on single sign-on,through IAM Identity Center and your identity provider, with long-lived IAM users retired from workload accounts and the root users locked down.
  5. 12
    Detection delegated:GuardDuty, Security Hub, IAM Access Analyzer, and the AWS Config aggregator administered from the Audit account, with every new account enrolled automatically.
  6. 13
    One way to make the next account,through Account Factory or Account Factory for Terraform, proven by vending one real account, plus central backup, the network account, and the tag policy where in scope.
  7. 14
    The week-six re-scanagainst week one: same checks, same method. It is the document that decides the second invoice.
  8. 15
    The operations runbooks and the handover workshop,for vending, moving an account, changing a policy, break glass, and suspending an account, and the workshop’s recording.
The gate

Thirteen checks,
run the same way at weeks one and six.

The foundation scan is read-only and runs by a script you can read, through AWS’s own APIs. The checks in scope, and the account map, are agreed at the week-two readout; a check marked “where in scope” counts only when the account map includes it.

  1. MAF-01
    Landing zoneThe landing zone is enrolled, active, and not drifted, with all features on in the organization.
  2. MAF-02
    Accounts placedEvery in-scope account is in its target OU and enrolled.
  3. MAF-03
    Organization trailA multi-Region organization trail, logging with file validation, delivers to a bucket in the Log Archive account.
  4. MAF-04
    Security delegatedGuardDuty, Security Hub, IAM Access Analyzer, and the Config aggregator are administered from the Audit account, with new accounts enrolled automatically.
  5. MAF-05
    IdentityIAM Identity Center is connected to your identity provider, and no workload account has an IAM user with a console password or an active access key, except a written exception.
  6. MAF-06
    RootThe management account’s root user has MFA, centralized root access is on, and member accounts hold no root password or keys without a written reason.
  7. MAF-07
    GuardrailsThe agreed SCPs, RCPs, and declarative policies are attached and inherited by every in-scope account, and their content matches your repository.
  8. MAF-08
    ControlsThe agreed Control Tower controls are enabled on every target OU.
  9. MAF-09
    VendingNew accounts come from Account Factory or Account Factory for Terraform, and one account vended in week five passes MAF-02 to MAF-08 untouched by hand.
  10. MAF-10
    Backup (where in scope)A backup policy is attached, AWS Backup is administered from a delegated account, and copies land in a central vault in a separate account.
  11. MAF-11
    Network (where in scope)Shared networking is owned by the Network account and shared to workload OUs through AWS RAM.
  12. MAF-12
    TaggingThe agreed tag policy is attached and effective, with its compliance report readable from the management account.
  13. MAF-13
    No lingering accessOur operator role and any temporary assignment are gone from the management account.

The guarantee, in one sentence. Every check of the foundation scan agreed at the week-two readout passes at week six, verified by the same scan run the same way, and every in-scope account is in its target OU. A check you waive in writing counts as passed.

The workspace

Pavilion, included.

A pavilion is a structure built for one occasion and handed over when it ends. Every engagement gets one: a private online workspace, set up in week one for your sponsor, your platform team, and us, holding everything the Blueprint and the Build produce and everything they need from you.

The calendar of sessions, with each recording, its transcript, and a summary for the people who were not in the room. The inventory, the account map, the policy set, and the move plan, each a version your sponsor accepts. Every change window’s approval, the decisions with their reasons, and the action items on both sides. At the end, one archive of all of it, which is yours.

There is no multi-account sample yet. The security Hardening sample case study shows the same workspace carrying a six-week engagement from the first session to the last report, told from what that workspace recorded.

See the workspace in the security sample

A glass-and-steel pavilion at blue hour on a still lake, one warm light glowing inside.
What the workspace holds
  • The calendar: every session, change windows included, with its recording, transcript, and summary
  • The documents: the inventory, account map, policy set, and move plan, each version accepted by your sponsor
  • The change windows: each one’s approval, its actions, and its rollback
  • The decisions log: what was decided, by whom, and why
  • The action items and obligations on both sides, with their owners and dates
  • The archive: every document, transcript, and decision, yours to keep

Pavilion is a product of Renkara Media Group, Inc., operated for the engagement and exported to you at its close.

How much of Charles you get.

Fixed price does not mean unbounded.
The cap is in the statement of work, and so is what we need from you.

The Blueprint
Up to 40 hours

Over two weeks. About 8 of them are live with your team; the rest are the inventory, the design, the policy set, and the agents doing the scanning and cross-referencing under Charles’s supervision.

The Build
Up to 110 hours

Over six weeks, roughly 18 hours a week. About 38 of them are live with your team, including every change window: your engineer is on the call whenever the management account changes.

Beyond the cap
$450 per hour

By written change order, agreed before the hour is spent. Remote by default; an on-site day is priced separately.

Scope
  • One target AWS organization of up to 50 accounts, built from one existing organization (retrofit) or from one source organization plus standalone accounts (greenfield)
  • AWS Control Tower in your home Region and the Regions you govern, or Landing Zone Accelerator on AWS where Control Tower cannot be used
  • Policies and account customizations as code in up to two repositories, in the tool you already use: Terraform, CloudFormation, or the CDK
What we need from you
  • The read-only role in every in-scope account and the management account within three business days of signature, from a CloudFormation StackSet we hand you. The clock starts when it exists.
  • A platform lead at least four hours a week, a finance or billing contact in week one, and, in the Build, the management account’s owner in every change window
  • The sponsor available for thirty minutes a week, and in the Build, each change window approved in writing at least two business days ahead
Access

Read-only everywhere.
Write access only in windows you approve.

Setting up Control Tower, creating OUs, and moving and enrolling accounts are management-account actions, and Control Tower’s own setup needs administrator permissions there. So the control is approval and time, not a narrow policy.

The plan names every action.

The move plan lists each change window’s management-account actions, its pre-flight checks, and its rollback. Nothing outside the window’s list is done in it.

You approve each window in writing.

Your sponsor and the management account’s owner approve each window by email at least two business days ahead: up to six windows across weeks three to five, none longer than one business day.

The role is yours, and it expires.

Its trust policy admits only Charles, requires MFA and his named source identity, and carries the window’s start and end dates; sessions last an hour at most. You set the dates, so access outside a window is impossible.

Some things are denied outright.

Closing accounts, deleting the organization, changing payment methods or billing contacts, creating IAM users or access keys, and leaving the organization. Account emails, root credentials, and payment methods stay with you.

Everything is seen.

Every call lands in the organization trail under Charles’s name, and each time the role is assumed, a message goes to your channel.

It ends.

At week six you delete the role, and check MAF-13 in the re-scan proves it is gone. Prefer your engineer at the keyboard? The Build runs the same way in pair-only mode, with longer windows and the same gate.

The risk register

What can go wrong in a move,
and what we do about it.

Every risk here is sized for your organization in the Blueprint, with an owner and a check in each wave’s pre-flight where it applies.

Billing transfer (greenfield)

An account leaving an organization needs its own support plan, contact details, and payment method, and cost history stays with the old payer. Your finance contact joins in week one, cost data is archived first, and moves land at a month boundary where the split matters.

Savings Plans and Reserved Instances

Commitments belong to the account that bought them and cannot move. The plan moves owners and users together, at a month boundary, or brings the old management account in as a member. We never buy, sell, or exchange a commitment.

Marketplace and support

Private offers and Business or Enterprise Support follow the payer. Every agreement is listed, each vendor asked to re-issue its offer, and the target support plan is in place before the first move.

Organization-scoped dependencies

Policies that name your organization ID, resource shares, delegated administrators, and StackSets can break when an account moves. The pre-flight scan finds every one, and the target is added beside the source before any wave.

Root email and MFA custody

A root email on a departed employee’s mailbox blocks recovery and blocks a move. Every root email moves to an alias you control, the management account’s root gets two hardware keys in separate custody, and we never hold a root credential.

The policy blast radius

A deny at the top applies to every account below it at once. Every policy is proven in Policy Staging, then attached OU by OU, never at the root on its first day, each with a break-glass exception; detaching it is the rollback.

The rooms Charles leads.

Every meeting is on the calendar before week one.
Nothing else is asked of your engineers except the reviews and the pairing.

The Blueprint · about 8 live hours
  • Kickoff60 minutes

    Sponsor, platform, security, and identity leads. Scope, access, the dates your auditors or investors care about, and what happens in the two weeks.

  • Organization walkthrough90 minutes, platform team

    The accounts, who owns each one, how they were made, and how a change reaches production, told by the people who run them.

  • Identity interview60 minutes

    With whoever owns identity: how people reach each account today, where root email and MFA live, and who can grant access.

  • Billing and commitments45 minutes, finance contact

    Savings Plans, Reserved Instances, credits, Marketplace agreements, the support plan, and invoicing: what a move must not disturb.

  • Design review90 minutes, end of week two

    The OU tree, the account map, the policy set, and the move plan with the platform team, before the sponsor sees them.

  • Sponsor readout60 minutes, end of week two

    The target design, the path, the risks, and what six weeks would build.

The Build · about 38 live hours

Weeks one and two are the Blueprint’s: the kickoff, the walkthrough, the identity interview, the billing session, and the design review. Then:

  • Sponsor check-in30 minutes, weekly

    Accounts moved, checks passing, what is next, and what is blocked.

  • Change windowsup to six, weeks three through five, none longer than one business day

    Live with the management account’s owner on the call: only the actions the move plan names for that window, each with its pre-flight check and its rollback.

  • Pairing60 to 90 minutes, two or three times a week

    With your platform lead on the account baselines, the policies, and the vending pipeline, as code. This is where the teaching actually happens.

  • Office hours45 minutes, twice a week

    Drop-in, weeks three through six.

  • Week sixabout 5 hours across the week

    The re-scan review, a 2-hour handover workshop with the runbooks, and the closing sponsor readout.

The tools of the engagement.

Nothing exotic, and nothing you have to buy.
Everything the engagement produces is recorded, transcribed, and left with you.

The access

The read-only role

A role in every account and in the management account, from a CloudFormation StackSet we hand you before kickoff, carrying AWS’s SecurityAudit and ViewOnlyAccess policies and nothing else. It sees how your organization is configured, not what it stores. You delete it the day we finish.

The Build’s change windows

The operator role

A role you create in the management account from a template you read first. Its trust policy admits only Charles, requires MFA, and carries the window’s dates, so access outside an approved window is impossible rather than merely forbidden. Explicit denies cover closing accounts, billing, and IAM users.

The instruments

AWS Control Tower and AWS Organizations

The landing zone, the OUs, the controls, and the policies are AWS’s own, in your organization. Where Control Tower cannot be used, Landing Zone Accelerator on AWS takes its place, named in the Blueprint.

Where the code lands

Your repositories and pipeline

Policies, account baselines, and vending live in your repositories, through Account Factory for Terraform, Customizations for Control Tower, or Landing Zone Accelerator, merged through your pull requests. We never hold write access to a member account.

Meetings, recorded

Zoom

Every session, change windows included, is held on Zoom and recorded with your permission, with Zoom’s transcripts and recaps delivered alongside each recording.

The workspace

Pavilion

Set up for your engagement in week one: the calendar, every recording with its transcript and summary, the account map and move plan your sponsor approves, each window’s approval, the decisions, and the action items, in one place you keep afterward.

How this differs from the security engagement

The Audit reviews your organization.
This builds the one it should be.

The AWS Security, Compliance & Governance Audit finds and verifies what is exposed in your accounts, and its governance review describes your organization as it is. This engagement designs the organization those accounts belong in, moves every account into it, and proves the structure with its own scan. They fit together, and they share an access setup.

Vantalect Security Audit & Hardening

Findings found, verified, and closed

Every account and enabled region scanned against the CIS and AWS benchmarks, every finding verified by hand, mapped to your compliance framework, and the criticals closed as code.

  • The governance review describes the account structure, policies, and provisioning as they are
  • Fixes land inside the accounts you have, through your pull requests
  • Its gate is every critical finding closed by week six
  • Read-only in the Audit; no management-account write access in either shape
Vantalect Multi-Account Foundation

The organization designed, built, and proven

The OU tree, the core accounts, the guardrails, identity, logging, and vending AWS recommends, built in an organization you keep or a new one, with every account moved into its place.

  • Designs the target organization and every account’s place in it
  • Moves accounts between OUs, or between organizations, in approved change windows
  • Its gate is the thirteen-check foundation scan passing at week six
  • Time-boxed write access in the management account only, through a role that expires
Primary objective
Security Audit & Hardening Find, verify, and close the security gaps in the accounts you have
Multi-Account Foundation Put every account in the structure AWS recommends, with guardrails every new account inherits
What changes
Security Audit & Hardening Configuration inside your accounts, as code
Multi-Account Foundation The organization itself: OUs, core accounts, account placement, policies, and vending
Verification
Security Audit & Hardening CIS and AWS benchmark scans, every finding verified by hand
Multi-Account Foundation The foundation scan’s thirteen checks, read-only, by a script you can read
Access
Security Audit & Hardening Read-only roles; fixes only through your pipeline
Multi-Account Foundation Read-only roles, plus a management-account role that exists only inside approved change windows
Guarantee
Security Audit & Hardening Every critical finding closed by week six
Multi-Account Foundation Every agreed check passing at week six, every account in its target OU; half the $35,000 fee rides on it
Already ran the Audit?

Then skip the Blueprint: The Build after a Security Audit.

After our AWS Security, Compliance & Governance Audit, its governance review replaces the Blueprint’s discovery, so the Build runs in four weeks for $25,000. How the add-on works.

The receipts

The same structure, built for regulated companies in pharma, healthcare, and financial services.
Client names withheld per NDA.

6×
multi-account governance builds with Organizations, Control Tower, and service control policies
See it on the site
2×
self-service account provisioning, account requests through Terraform and a ticket, so nobody makes an account by hand
See it on the site
100+
AWS accounts inventoried every night for compliance, with automated remediation, in under an hour, for a pharmaceutical company
See it on the site
3
professional- and specialty-level AWS certifications: Solutions Architect, DevOps Engineer, and Security — Specialty, held by the person who does the work
See it on the site

Who does the work

Charles Sieg. AWS Certified Solutions Architect — Professional, DevOps Engineer — Professional, and Security — Specialty. Cloud architect and platform engineer for Fortune 1000 clients across healthcare, pharma, and financial services, with six multi-account governance builds on AWS Organizations and Control Tower behind him. Both engagements are delivered by Charles personally, inside your accounts, with your engineers.

Questions a CTO asks first

Retrofit or a new organization: how do we know?

The Blueprint decides, in writing, at the week-two readout. Keep the organization you have when its management account runs no workloads, its payer is staying, and its history is worth keeping. Move into a new one when the management account runs production, the organization belongs to someone else, or two must become one. Both paths pass the same scan.

Do we have to use AWS Control Tower?

It is the default, because it is AWS’s own landing zone and it governs the accounts you vend next. Where it cannot be used, such as a Region it does not govern that you need, the Blueprint names the equivalent, Landing Zone Accelerator on AWS or Organizations policies managed as code, and the scan checks that instead.

Will moving accounts break production?

An account moves with its resources intact, but some things depend on the organization it is in: policies that name the organization ID, resource shares, delegated administrators, and StackSets. The pre-flight scan finds each one before its wave, the fix goes in first, and every wave has a rollback. Production moves only after a pilot wave of sandbox and non-production accounts.

What happens to our Savings Plans, Reserved Instances, and credits?

They stay with the account that bought them. In a retrofit nothing changes. In a new organization the plan keeps them applying, usually by bringing the old management account in as a member, and moves land at a month boundary. We never buy, sell, or exchange a commitment.

What access do you need in our management account?

Read-only for the Blueprint. In the Build, a role you create, whose trust policy admits only Charles, requires MFA, and expires at the end of each change window you approve in writing. Closing accounts, billing changes, and creating IAM users are denied outright. You delete the role at week six, and the re-scan proves it.

Do you ever hold root credentials?

No, for any account. Root emails move to aliases on your domain, the management account’s root user gets hardware keys held by two of your officers, and member-account root credentials are removed where you agree.

Will this make us SOC 2 compliant?

Nothing makes you compliant by itself, and we are not your auditor. What you get is the structure auditors expect to see: production in its own accounts under its own policies, one organization trail into an archive no application account can touch, and access through single sign-on. Put it in before a Type 2 observation period starts, and the evidence is clean from day one.

We already ran your Security Audit. Do we pay for the Blueprint?

No. With or after the Audit, The Build after a Security Audit starts at the design and runs in four weeks for $25,000, up to 70 hours, with the same scan and the same guarantee.

How much of Charles’s time do we actually get?

Up to 40 hours in the Blueprint and up to 110 in the Build, with about 8 and 38 of those hours live with your team. The caps are written into the statement of work. Anything beyond them is a written change order at $450 per hour, agreed before the hour is spent.

Do you move our workloads between accounts?

No. Accounts move between OUs and organizations with everything in them intact. Splitting a workload out of a shared account into its own is a separate engagement, and the Blueprint’s account map tells you which ones are worth it.

Can we combine this with another AWS engagement?

Yes. Take it with one of our other AWS engagements and each is 10% off its fee; take three or more and each is 15% off, in either shape. They share one access setup, one kickoff, and one workspace, start two weeks apart, and each keeps its own guarantee.

Three more fixed-price engagements.
Same two shapes, same two prices.

Two weeks and $25,000 for the diagnostic, six weeks and $35,000 for the result.

A hydroelectric turbine hall at night, massive steel casings receding along a polished floor with an amber stripe.
AI-native engineering

Engineering Leverage

Your board asked what the company is getting from Claude Code, and the honest answer is faster autocomplete.

Read the engagement
A canal lock at blue hour, massive steel gates holding back still water, one amber lamp on the lock wall.
AWS cost

AWS Cost Analysis & Optimization

The AWS bill grew faster than the business, and nobody can say who owns which line.

Read the engagement
An air traffic control tower at blue hour, its glass cab glowing amber above rows of blue taxiway lights.
AWS security · compliance · governance

AWS Security, Compliance & Governance Audit

An audit is coming, a customer sent a security questionnaire, or nobody can say for certain who can reach production.

Read the engagement
A wet walkway beneath twin bridge decks at blue hour, rows of massive concrete piers receding over still dark water, lit by one amber lamp.
AWS architecture · Six pillars

AWS Well-Architected Framework Review

A critical production workload has grown under deadline pressure, and nobody has reviewed its reliability, security, performance, and cost together.

Read the engagement
Compare all five engagements

Let's define the result.

Tell us how many accounts, whether you have an organization today, and what prompted the question. You will hear back from Charles within one business day, and the first call is fifteen minutes.

Book a 15-minute call with CharlesOr email charles.sieg@vantalect.com

AWS, Amazon Web Services, AWS Control Tower, AWS Organizations, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. SOC 2 is a registered trademark of the American Institute of Certified Public Accountants. ISO is a registered trademark of the International Organization for Standardization. Terraform is a trademark of HashiCorp, Inc. Zoom is a trademark of Zoom Video Communications, Inc. Vantalect is not affiliated with or endorsed by any of them.