Building a Secure AWS Landing Zone for a Regulated Western Utility

A major Western electric utility serving millions of customers operates under some of the strictest reliability and compliance requirements in critical infrastructure. As the utility began establishing a foothold on Amazon Web Services, it needed governance, identity, and security controls in place before a single production workload could move — not after. Working with Redapt and AWS Professional Services, the utility stood up a secure, well-architected AWS landing zone built for a regulated operating environment from its first account.

Turning Challenges Into Opportunities

From Governance Gap to a Repeatable Cloud Foundation

The utility's cloud ambitions were real, but so was the risk of moving too fast in a critical-infrastructure environment without a governed foundation in place first. Account structure, network topology, identity boundaries, and incident response all needed to be defined and documented before the organization could safely expand its AWS footprint.

For regulated utilities, cloud adoption is not a race to the first workload — it is a race to a foundation that will still hold when the fifth business unit and the auditor show up.

The Problem

The utility needed to establish a well-architected, governed AWS platform before expanding production use of the cloud, but had not yet defined its account structure, network topology, identity boundaries, or security baseline for a regulated environment. Without that foundation, each new workload risked introducing its own ad hoc security posture and inconsistent operational controls. The organization needed a documented, repeatable pattern for account vending, access management, and incident response before broader adoption could proceed responsibly.

The Solution

Redapt, working alongside AWS Professional Services in a non-production environment, ran a structured discovery-first engagement: facilitating workshops to capture the utility's requirements across operations, security, and compliance, then designing and implementing an AWS Organizations account structure, network topology, and a minimum security baseline before any workload architecture was finalized. Runbooks, playbooks, and infrastructure-as-code templates were produced as engagement deliverables, not afterthoughts, so the utility's own team could operate what was built.

The Outcome

The utility now has a documented, governed AWS foundation — account structure, network routing, identity integration, and a minimum-security baseline — in place ahead of broader workload adoption. Detective and preventative guardrails are automated into every new account the utility creates, rather than layered on afterward. The organization's security and operations teams maintain documented playbooks and runbooks covering identity, detection, infrastructure security, data protection, and incident response, providing a repeatable framework to scale as adoption grows.

SOLUTION DEEP DIVE

A Discovery-First, Governance-Before-Workloads Approach

Redapt led a phased engagement that established landing zone design, security foundations, data protection, and incident response readiness before the utility further scaled its AWS footprint.

Landing Zone Discovery & Enablement

Facilitated workshops with the utility covering organization structure, operations, security, governance, and compliance requirements
Documented account structure, network topology, and infrastructure-as-code decisions against AWS general best practices
Reviewed the utility's current and planned future-state cloud architecture and captured decisions in a shared tracker
Produced referenceable playbooks and runbooks, supported by sample code and architecture diagrams, to automate future AWS deployments

Secure Landing Zone Design & Implementation

Defined AWS Organizations structure and an account-vending pattern for future account creation
Designed and implemented DNS and network routing across the internet, inter-account, and on-premises paths
Automated detective and preventative guardrails so every new account the utility creates inherits the baseline
Integrated secure, operational account access with the utility's existing identity provider

Data Protection Baseline

Built configuration rules enforcing the utility's defined key strength standards to support compliance and drift detection
Established an AWS resource encryption strategy, defining what must be encrypted at rest and in transit
Delivered recommendations on AWS Identity and Access Management and AWS Key Management Service policy for the utility's administrators

Incident Response & Operational Monitoring

Gathered Recovery Point and Recovery Time Objectives to inform high-availability and disaster-recovery design
Defined security assertions for the utility's cloud environment and recommended Amazon GuardDuty and Amazon Detective usage patterns
Developed referenceable playbooks and sample runbooks across identity, detection, infrastructure security, data protection, and incident-response epics
Designed an automated operational monitoring environment using AWS-native services

Partnership Page

THE OUTCOMES

Foundation Set, Governance Repeatable

The utility now operates from a documented AWS foundation designed to support regulated, critical-infrastructure workloads as adoption expands — not a one-time deployment.

Governed Account Structure

AWS Organizations, network topology, and identity integration are documented and repeatable for every new account the utility creates.

Security Baseline Established

A minimum security baseline and automated guardrails are in place before workloads scale, not retrofitted afterward.

Incident Response Readiness

Recovery objectives, security assertions, and monitoring playbooks provide the utility with a defined path for responding to threats.

Operational Playbooks in Hand

Runbooks and infrastructure-as-code templates let the utility's own team extend the platform without starting from scratch.

Get Expert Help

CONCLUSION

A Foundation Built to Carry What Comes Next

The utility closed a governance gap before it became a growth constraint — trading ad hoc account setup for a documented, repeatable AWS foundation that its own team can extend. A regulated environment doesn't get a second chance at its first landing zone. Request an Architecture Review — the same structured, peer-level assessment of design decisions and risk that gave this utility a foundation built to hold under audit, not just under load.

PRIVACY / CONFIDENTIALITY STATEMENT

Your trust and confidentiality are our top priorities. Redapt prioritizes and protects our customers' privacy, so we don't publicly disclose account names or other identifiable information. We are eager to share our successes and are happy to provide specific referrals or case studies upon request.

BLOG

The latest in infrastructure, technology, and security

VIDEO CENTER

Go deeper with expert stories, insights, and strategy

CUSTOMER STORIES

Discover how we elevate organizations

ABOUT US

Get to know our mission, team, and what drives us

LEADERSHIP

Meet the leaders driving innovation and customer success

Events

Explore Redapt’s upcoming and past events.

CAREERS

Join a team built on impact, collaboration, and growth

Actionable Insights.

Make-or-Break Focus Areas.

Experts Save You Time.

Contact Us