“Enterprise cloud environments shouldn’t be built manually by exchanging tickets. They should be stamped out by a modular, automated software factory.”

Executive Summary

In early 2024, as Associate Director at Kyndryl, I led the architectural overhaul for onboarding multiple enterprise banking clients onto Microsoft Azure.

The existing deployment model relied on fragmented manual tickets between network, security, and cloud operations teams. I architected an automated DevSecFinOps Factory using Terraform, Azure Landing Zones, and GitHub Actions, cutting environment provisioning turnaround from 4 weeks to 4 hours.

---

The Challenge

Onboarding ten distinct financial institutions required strict isolation and regulatory compliance (PCI-DSS, GDPR).

• Manual Ticket Bottlenecks: Provisioning a single landing zone required 4 weeks of cross-team ticket exchanges.
• Cost Overruns: Lack of automated tagging resulted in untracked orphan resources and ballooning cloud bills.
• Security Drift: Unstandardized Network Security Groups (NSGs) exposed storage accounts to public internet access.

[!IMPORTANT] Unenforced cloud compliance creates massive technical debt. Without automated Policy as Code guardrails, security vulnerabilities bypass manual review processes.

---

The Solution

We established a standardized Hub-and-Spoke Architecture managed via modular Infrastructure as Code (IaC) pipelines.

Technology Stack

• Cloud Infrastructure: Microsoft Azure (Enterprise Scale Landing Zones)
• Container Orchestration: Azure Red Hat OpenShift (ARO)
• Traffic & Load Balancing: VMware Avi (NSX Advanced Load Balancer)
• Network Security: Palo Alto NVA Clusters (Active/Active in Transit Hub)
• Automation & Guardrails: Terraform, GitHub Actions, Checkov, Infracost

Technical Architecture

The “Hub” (Shared Services VNet) houses central security inspection appliances and ExpressRoute gateways. Each client environment is instantiated as an isolated “Spoke” VNet via automated CI/CD pipelines.

1. Static Analysis (SecOps): Every pull request triggers Checkov to scan Terraform code for exposed endpoints or unencrypted storage buckets.
2. Cost Estimation (FinOps): Infracost parses the Terraform execution plan, posting automated cost delta comments on the GitHub PR before merge.
3. Automated Deployment: Merges to main execute terraform apply using remote Azure Blob Storage state locking.

[!NOTE] FinOps Tagging Guardrails: Azure Policy enforcement blocks the creation of any resource lacking Owner, CostCenter, and Environment tags.

# # Azure Policy as Code - Enforce Mandatory Tags
resource "azurerm_policy_assignment" "enforce_tags" {
  name                 = "enforce-cost-center-tag"
  scope                = azurerm_resource_group.client_spoke.id
  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/1e30110a..."

  parameters = <<PARAMETERS
{
  "tagName": { "value": "CostCenter" }
}
PARAMETERS
}

DevSecFinOps Pipeline Flow

graph LR
    PR[Developer PR] -->|Trigger| Pipeline[GitHub Actions]
    
    subgraph "Automated Quality & Compliance Gates"
    Pipeline -->|Security Scan| Checkov[Checkov Static Analysis]
    Pipeline -->|Cost Delta| Infracost[Infracost Estimation]
    end
    
    Checkov -->|Pass| Apply[Terraform Apply]
    Infracost -->|Pass| Apply
    Apply -->|Provision| LandingZone[Azure Hub-and-Spoke]

---

Business Impact

• Provisioning Speed: Reduced client onboarding time from 4 weeks to 4 hours.
• Cost Reduction: Automated FinOps tagging identified and eliminated 30% of cloud waste (orphaned disks and unattached Public IPs) within the first month.
• Zero Configuration Drift: Enforced 100% compliance across 10+ banking client landing zones.

---

The Verdict

Key Takeaway

Embed Security and FinOps Directly into CI/CD Pipelines.

Do not leave security or cost management to post-deployment audits. Embedding Policy as Code (Checkov/Infracost) into GitHub Actions guarantees that every deployed landing zone is compliant and cost-optimized by default.