Audit-ready AWS foundations for a growing wealth manager

01

Context

The client is an FCA-regulated wealth manager running adviser and client portals on a single AWS account built up over five years. A SOC 2 Type II audit was booked for the following spring, and an initial readiness review found that access, change and logging controls could not be evidenced. An internal attempt to document controls in spreadsheets had stalled. The team needed senior engineers who could rebuild the foundations without pausing feature work.

02

Constraints

Regulatory

Client records retained for at least six years; audit logs must be tamper-evident.

Data

Client data stays in UK regions; no production data outside production accounts.

Integration

Custodian and market-data connections over existing VPNs that could not change during the move.

Timeline

Foundations live eight weeks before the audit observation period began.

03

What we built

We replaced the single account with separate workload, security and log-archive accounts under service control policies. Every infrastructure and application change now goes through a reviewed pull request and a GitOps deploy, and policy-as-code checks block non-compliant changes before they reach production.

• Multi-account landing zone with central SSO and least-privilege roles
• EKS clusters managed through Argo CD, with deploy history kept as evidence
• OPA policies tested in CI and enforced at deploy time
• Log-archive account with S3 Object Lock retention set to six years
• Control mapping, evidence runbooks and a handover workshop for the client's platform team

04

Architecture

Expand

Account and network boundaries, deploy path and audit-log flow. Account names and partner details have been removed.

Full size✕

05

Results

The client's platform team now runs the foundation themselves and produces audit evidence on request from the logs and deploy history. All infrastructure code, policies and runbooks were handed over at the end of the engagement.