The framework that became the standard
TrustSoft needed a repeatable cloud foundation for enterprise clients, including Partners Bank.
In brief
- Problem
Manual setup
New client cloud environments took days to configure by hand and differed from one another.
- My contribution
A governance framework
I built TrustSoft's governance framework above Amazon's AWS Control Tower: provisioning, security rules, integrations and operating documentation.
- Result
A company-wide standard
The framework became TrustSoft's standard for almost all projects and the backbone of Cloud Foundation across 15+ enterprise estates.
Results
- Days → hours
- A new client estate went from a week of careful manual setup to repeatable provisioning in hours.
- Up to 40%
- Cloud infrastructure cost reductions across the estates I managed, through automated right-sizing and policy enforcement.
- Cloud Foundation
- The framework became the backbone of Cloud Foundation and TrustSoft's standard for almost all projects.
The problem
Every new client meant a fresh cloud estate, built end to end: accounts, permissions, security rules, and audit trails. Done by hand each time, it took days and no two came out the same.
For a bank, "no two the same" is not an inconvenience. It is a finding in an audit.
What I built on top of it
Every one of them set up the same way, because of the row above.
A baseline shaped by real projects
I started from AWS best practices and refined the framework through work on large client projects. Each project needed a documented foundation that its development and DevOps teams could build on, rather than a fresh infrastructure design every time.
I wrote Terraform components and modules where the ones we needed did not exist. I documented the architecture, setup and operation in full, so the baseline could be reused across projects rather than depend on my involvement in each deployment.
Adoption
Where it went
The documented baseline made new projects much faster to set up. It later evolved into a modular framework that TrustSoft still uses in paid client projects.
I was in touch with AWS about Control Tower directly, sending back what running it at this scale actually taught us.
I later presented the governance approach in Switzerland.
And the layer outlived my time there: Silviu Cosma, TrustSoft’s Head of DevOps, wrote in his recommendation: “the backbone of our flagship product, Cloud Foundation … part of every single project we deliver.”
What it left me with
Inside a company, this made me the person people came to first on anything in that territory.
It is also why the multi-tenant side of Glow is familiar ground: many customers run from one place, with hard walls between them.
AWS partner validation
I wrote the documentation that helped TrustSoft obtain its Amazon QuickSight Delivery Partner designation. This was a company-level AWS service validation, separate from my personal certifications.
AWS announcement naming Trustsoft as a QuickSight Delivery Partner →
Technical detail
- Management OU
- Control Tower Core
- AWS SSO / Identity
- Cloud Foundation
- Terraform SCP Guardrails
- Log Archive & Audits
- Account Vending Engine
- Client Estates
- Partners Bank · PROD
- Eurowag / Prima · LIVE
- 15+ Estates · MULTI
Platform context and technical details
What existed already
AWS Control Tower was Amazon's new platform for multi-account governance. It was thin on the parts an MSP managing dozens of client estates actually needed.
I adopted and mastered Control Tower in its early releases, mapping out its architecture, operational constraints, and the missing layers needed for multi-client operations.
What did not go well
- Control Tower was new and thin, and I was an early adopter. A good share of the first year went into working around gaps in a product I did not control, writing utilities that later AWS updates superseded. That taught me early to build lightweight abstractions that gracefully make way for platform updates.
- Through TrustSoft, I built the full AWS setup for internal dashboarding across EPH's group companies and presented it to leadership at their Prague headquarters. It did not go into production at EPH because the group changed its strategy to Azure. TrustSoft kept the prototype and developed it into a FinOps dashboard it sold to other customers.
What it taught me
- The framework became a company standard because other teams could build on it; the dashboard found its use with different customers.
- Write it down before you build the next thing. The documentation outlived several of the utilities it described, and it was the reason the standard was adopted company-wide instead of staying mine.
- Find out who is actually deciding before you build for the people in the room.
Let's talk about what you are building.
I'm not taking freelance work. Happy to talk about Glow, automation ideas, or a product engineering opportunity.
The hello is written. The rest is yours.
hozaksebastian@gmail.com
Webmail may ask you to sign in. Mail app requires a configured email application.