Hover a node · click to focus · ←/→ steps
Multi-cloud org → network → identity → Terraform modules. Policy and cost gates sit on every plan (AWS · Azure · GCP).
When you need this
- AI projects spawn ad-hoc cloud accounts
- GPU workloads share identity with uncontrolled SaaS keys
- Need EU regions, private endpoints, and least privilege by default
- Platform wants reusable modules for every AI product team
Prerequisites
- Cloud org structure (AWS OU / Azure MG / GCP folder) decided
- Terraform remote state + CI plan/apply path
- Identity baseline (SSO, SCIM, break-glass)
Tools
Adopt for every production AI account - click-ops accounts fail security review.
Assess for platform teams; less critical for app-only ML teams.
Steps
- 1
Design the AI OU / management group
Separate sandbox, shared services, and prod AI accounts. Enforce region allowlists (e.g. eu-central-1 / europe-west) at SCP / policy level.
- 2
Network and private connectivity
Hub-spoke or landing-zone VNet/VPC with private endpoints to model APIs, vector DBs, and object storage. No public GPU training by default.
- 3
Identity and secrets for AI
Workload identities for training/serving; short-lived credentials. Central secret store for provider keys — apps never hold long-lived keys.
- 4
Module pack for AI teams
Publish Terraform modules: GPU node pool, LiteLLM ingress, vector DB, observability agents, cost tags. Teams compose; platform owns modules.
- 5
Policy and cost gates in CI
OPA/Sentinel or cloud policy-as-code on plans. Infracost on PRs for GPU-capable resources. Block unrestricted egress and missing tags.
Adoption pitfalls
- Copying a generic landing zone with no AI-specific controls
- Teams still create personal cloud accounts for ‘experiments’
- IaC without tag enforcement → FinOps blind spot
Adoption checklist
- AI prod only in approved accounts/regions
- Private endpoints for sensitive data paths
- Module pack documented and versioned
- Plan-time policy + cost check in CI
- Break-glass procedure tested
SEER REAL assessment / sprint
Assessment scores account sprawl, identity, and network exposure for AI. A platform sprint delivers the AI OU + 2–3 modules and moves one team onto them.