All guides

Production AI Radar

How to build AI landing zones with Terraform

Account structure, network, identity, and IaC guardrails so AI workloads land in a governed, EU-ready foundation — not a sandbox that became production.

AdoptPlatform & DevEx18 min
AI landing zone

Hover a node · click to focus · ←/→ steps

Multi-cloud org → network → identity → Terraform modules. Policy and cost gates sit on every plan (AWS · Azure · GCP).

When you need this

  • AI projects spawn ad-hoc cloud accounts
  • GPU workloads share identity with uncontrolled SaaS keys
  • Need EU regions, private endpoints, and least privilege by default
  • Platform wants reusable modules for every AI product team

Prerequisites

  • Cloud org structure (AWS OU / Azure MG / GCP folder) decided
  • Terraform remote state + CI plan/apply path
  • Identity baseline (SSO, SCIM, break-glass)

Tools

Steps

  1. 1

    Design the AI OU / management group

    Separate sandbox, shared services, and prod AI accounts. Enforce region allowlists (e.g. eu-central-1 / europe-west) at SCP / policy level.

  2. 2

    Network and private connectivity

    Hub-spoke or landing-zone VNet/VPC with private endpoints to model APIs, vector DBs, and object storage. No public GPU training by default.

  3. 3

    Identity and secrets for AI

    Workload identities for training/serving; short-lived credentials. Central secret store for provider keys — apps never hold long-lived keys.

  4. 4

    Module pack for AI teams

    Publish Terraform modules: GPU node pool, LiteLLM ingress, vector DB, observability agents, cost tags. Teams compose; platform owns modules.

  5. 5

    Policy and cost gates in CI

    OPA/Sentinel or cloud policy-as-code on plans. Infracost on PRs for GPU-capable resources. Block unrestricted egress and missing tags.

Adoption pitfalls

  • Copying a generic landing zone with no AI-specific controls
  • Teams still create personal cloud accounts for ‘experiments’
  • IaC without tag enforcement → FinOps blind spot

Adoption checklist

  • AI prod only in approved accounts/regions
  • Private endpoints for sensitive data paths
  • Module pack documented and versioned
  • Plan-time policy + cost check in CI
  • Break-glass procedure tested

SEER REAL assessment / sprint

Assessment scores account sprawl, identity, and network exposure for AI. A platform sprint delivers the AI OU + 2–3 modules and moves one team onto them.

Related radar blips