How would you design a multi-account cloud landing zone for a company with 20 product teams?
What the interviewer wants to hear
- Use AWS Organizations or equivalent with OUs per environment and function
- Separate accounts for security, logging, networking and workloads
- Central identity with SSO and permission sets
- Guardrails using SCPs, config rules and policy as code
- Centralized networking with transit gateway and shared services
- Account vending automation, tagging and cost allocation
Model answer
I would use AWS Organizations, often with Control Tower, and treat the account as the main security and billing boundary. The structure has OUs such as Security, Infrastructure, Workloads split into Prod and Non-Prod, and Sandbox. Core accounts include a log archive account receiving organization-wide CloudTrail and Config, a security tooling account for GuardDuty and Security Hub as delegated admin, and a network account owning the transit gateway, egress and DNS. Each product team gets separate dev, staging and prod accounts, created by an automated account vending pipeline with baseline Terraform, budgets and tags. People log in through IAM Identity Center connected to the corporate IdP, using permission sets instead of IAM users. SCPs act as guardrails, for example denying unused regions, disabling CloudTrail changes and root usage. The trade-off is more accounts to manage, but blast radius, cost tracking and autonomy are much better.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Cloud Engineer questions
- Design a multi-region disaster recovery setup for a payments API with an RPO of under 1 minute and an RTO of 15 minutes. What trade-offs do you consider?
- Leadership asks you to reduce the cloud bill by 30 percent without hurting reliability. How do you approach it?
- How would you migrate a large production database to a managed cloud database with near-zero downtime?
- A company needs reliable connectivity between its data center and the cloud. Compare site-to-site VPN and a dedicated connection like AWS Direct Connect, and describe a resilient design.
- Design a shared Kubernetes platform used by 30 product teams. How do you handle isolation, security, cost and upgrades?
- You find out that long-lived AWS access keys were pushed to a public GitHub repository an hour ago. How do you respond?
- Design observability and alerting for a customer-facing API so on-call gets paged for real problems but not for noise.
- Design an event-driven order processing system on a public cloud that must handle traffic spikes and never lose or double-charge an order.
- Your company has hundreds of Terraform configurations owned by many teams. How do you structure modules, state and governance so it scales safely?