AWS Control Tower based Landing Zone with Account Factory for Terraform

Background

EstimateOne’s goal is to connect the commercial construction industry with an easy to use, one-stop-shop for builders, tradies, and construction suppliers across Australia, New Zealand and the UK.

Their innovative cloud-based tendering platform brings builders, suppliers, and sub-contractors together to facilitate collaboration on commercial construction projects. It enables:

1. Tradespeople to find and manage upcoming work opportunities specific to their trade
   

2. Builders to distribute and oversee construction drawings and documents
   

3. Suppliers to search for their products and easily follow projects where they have been specified
   

Founded in Melbourne, EstimateOne was one of the few local organisations to remain bullish through the pandemic. Rather than conservatively weathering the storm of uncertainty, newly appointed CTO, Mark Grebler, capitalised on a muted hiring market to scale the engineering team from single digits to nearly 50 people. This bold determination and commitment to delivering EstimateOne’s technology vision has established them as one of the preeminent technology organisations to work, evidenced by placing 3rd in AFR’s Best Places to Work list in 2022.

The challenge

Every successful scale up reaches a point where commercial viability has been achieved and growth becomes the primary strategic goal. Sustainably executing an aggressive growth strategy requires scalable infrastructure, automation, platform stability, resilience, and security. EstimateOne and Midnyte City collaboratively designed a road map and implementation plan to enable the anticipated infrastructure performance for the expected local and international growth.

The roadmap included:

Implementation

EstimateOne’s Infrastructure and Development teams worked closely with the Midnyte City team to assess the current cloud infrastructure and development workflows. The group agreed to prioritise the AWS organisation structure and deployment pipeline workflows.

They implemented an AWS Control Tower based Landing Zone with Account Factory for Terraform to manage cloud governance across workloads. Account provisioning was automated and the required base infrastructure consisting of CI/CD agents and secrets was deployed. Good practices for security compliance were followed including federated login to the AWS organisation, implemented via AWS SSO and Google Workspaces. This significantly reduced the time required for account provisioning.

With EstimateOne’s rapid expansion, a network redesign facilitated secure and compliant growth globally. By utilising AWS Control Tower and cross account connectivity provided by AWS’ Transit Gateway, the group deployed an interconnected, secure and governed private network that scales as new accounts are requested. This eliminated manual deployments and substantially reduced the risk of human error.

Results and benefits

The key benefits from executing the roadmap included:

• Increased velocity resulting from faster roll out of AWS accounts
  

• Reduction in lead time for changes
  

• Reduction in Mean Time To Recovery (MTTR) due to improved team processes
  

• Decreased change failure rate from improved developer platform and agility
  

Cloud network infrastructure redesign
Strengthening cloud governance across EstimateOne’s ecosystem centralised control for the management and automation of security compliance. De-duplicating container images reduced unnecessary costs by implementing shared ECR repositories. The automated account and base infrastructure deployment through Account Factory for Terraform resulted in base security guardrails, automatic provisioning of secure networks, build agents, automated governance, and auditing capabilities. This enabled developer accounts that are ready to go upon account creation. Federated authentication in AWS was established using Google Workspace IdP to manage and control access to AWS accounts. Finally, the network redesign enables more efficient and effective management and risk mitigation for security, costs, and internal processes.

Team upskill and continuous improvement
The EstimateOne and Midnyte City teams worked closely to design and implement cloud governance, DevOps, and team processes. Team rituals like stand ups, retrospectives, showcases were used to communicate progress and share knowledge across the organisation. Pairing, lunch and learns, and brown bags on AWS and pattern topics ensured knowledge transfer and upskilling were a priority for the team throughout the engagement.

With the uplift in team capability, the team grew more engaged and excited about technical strategy and opening new ways of thinking to drive EstimateOne’s global expansion.