Designing fully-automated AWS multi-account infrastructure using Terraform with governance, policy-as-code, and centralized IAM boundaries

This paper presented a framework for designing a fully automated AWS multi-account infrastructure architecture using Terraform, integrated with governance mechanisms such as policy-as-code enforcement and centralized Identity and Access Management (IAM) permission boundaries. The proposed framework addresses key challenges associated with large-scale cloud environments, including configuration inconsistencies, governance enforcement difficulties, and security risks caused by excessive access permissions. By leveraging Infrastructure as Code (IaC), the framework enables automated and repeatable infrastructure deployments across multiple AWS accounts. The integration of policy-as-code validation within CI/CD pipelines ensures that infrastructure configurations comply with predefined security and governance standards before deployment. In addition, centralized IAM permission boundaries strengthen access control mechanisms and enforce least-privilege policies across development and operations teams. The evaluation demonstrates that combining automation, governance, and centralized identity management improves infrastructure consistency, enhances security enforcement, and reduces operational complexity in enterprise cloud environments. Overall, the proposed framework provides organizations with a scalable and secure infrastructure management model aligned with modern DevOps and cloud governance practices.

[1]     M. Fowler, "Infrastructure as Code: Managing Servers in the Cloud," O’Reilly Media, 2016. [2]     HashiCorp, "Terraform Documentation," HashiCorp Inc., 2024. [Online]. Available: https://developer.hashicorp.com/terraform. [3]     Amazon Web Services, "AWS Well-Architected Framework," AWS Whitepaper, 2023. [4]     Amazon Web Services, "AWS Organizations User Guide," AWS Documentation, 2024. [5]     Amazon Web Services, "AWS Identity and Access Management (IAM) Best Practices," AWS Security Documentation, 2023. [6]     Amazon Web Services, "Service Control Policies in AWS Organizations," AWS Documentation, 2023. [7]     Open Policy Agent (OPA), "Policy-as-Code for Cloud Infrastructure," CNCF Documentation, 2023. [8]     HashiCorp, "Terraform Sentinel Policy as Code Framework," HashiCorp Documentation, 2023. [9]     Amazon Web Services, "AWS Multi-Account Strategy Best Practices," AWS Whitepaper, 2022. [10]   S. Newman, "Building Microservices: Designing Fine-Grained Systems," O’Reilly Media, 2015.