Risk & Resilience · Coforge · 2026 – present
Multi-cloud governance and FinOps guardrails, as code
Organisation-wide guardrails across AWS, Azure and GCP: identity federation, tagging, budgets, AI-service controls and automated joiner/leaver access.
3clouds governed
120+sandbox users
USD 250per-user cap
Context
Cloud accounts and subscriptions had been created over time with uneven governance, and learner sandboxes needed to stay useful without running up bills.
Approach
- Identity first. Entra ID federated into AWS IAM Identity Center; one group drives joiner/leaver access, so leavers are flagged automatically.
- Report, then enforce. A mandatory Owner tag ran in report-only mode before enforcement through policy, so teams could fix issues before being blocked.
- Budgets everywhere. Per-account and per-user budgets with alerts to owners and a central list, plus a hard ceiling where it matters.
- AI-service guardrails. AI services denied by default at the organisation root, with an explicit exception list.
- As code. Guardrails deployed with Terraform, with exemption steps documented for future CI/CD roles.
I also built a multi-cloud FinOps data hub (FastAPI, React, FOCUS-normalised BigQuery) with anomaly detection, and a hyperscaler account CMDB with an approval workflow.
What I’d do again
Base limits on current run-rate rather than historical peaks, and show people the enforcement steps before switching them on.