AWS Control Tower Service Delivery · Control Tower landing zone

Tenderd: a Control Tower-governed, region-locked AWS landing zone in the UAE

Sovereign in-country landing zonePolicy-enforced region lockData residencyMulti-account segmentationPreventive controlsCentralized immutable audit loggingCentralized workforce identityIdentity federation & MFA enforcementEncryption-at-rest enforcementPrivate connectivity & network isolationInfrastructure-as-code foundationCI/CD delivery pipeline automationDay-2 runbooks & team enablementCloud-to-cloud migrationPhased cutover with parity validationContainer platform modernizationConnected device telemetry & alertingInfrastructure observabilitySecrets management & credential eliminationMigration TCO & business case modellingTarget-state architecture design & costed POC

Eligible

UAE public-sector contracts unlocked by in-country residency

2 → 5

governance and security maturity, five-point CAF scale

standing console access — every change through reviewed Terraform

AWS Control TowerTransit GatewayIAM Identity CenterAmazon EKSECS / Fargate

VeUP delivered Tenderd a governed multi-account AWS landing zone in the UAE (me-central-1) on AWS Control Tower — region-locked by SCP, IaC-first with zero standing console access, federated SSO, and centralized immutable audit — for in-country data residency and UAE government-contract eligibility.

The challenge

Tenderd needed to operate its fleet/heavy-equipment SaaS inside the UAE to support compliant in-region operations and prepare for public-sector contracts requiring in-country data residency. Two constraints shaped the work: data residency and governance (workloads and audit data had to remain in me-central-1 with hard guardrails, centralized compliance evidence, immutable audit trails, and MFA from day one); and operational maturity for a growing engineering team (an IaC-first operating model with no console access for engineers, all change via Terraform and peer-reviewed pull requests). And before committing to the in-region build, Tenderd needed the path off Google Cloud Platform proven on a representative workload.

The solution

VeUP delivered a secure AWS foundation across two engagements. First, a GCP-to-AWS pilot migration of a representative workload — an AWS dev landing zone, a containerized runtime on Amazon ECS with AWS Fargate, networking (VPC, NAT Gateway, VPC endpoints, Route 53, load balancing), a CI/CD pipeline, and an end-to-end container deploy with unit-test validation — proving the path. Then the main build: a governed multi-account AWS environment in me-central-1 — an AWS Control Tower org with Security / Infrastructure / Workloads OUs and dedicated accounts (no workloads in the management account); SCPs denying all regions except me-central-1, blocking root access keys, enforcing MFA, protecting CloudTrail and AWS Config, requiring encryption at rest; GuardDuty / Security Hub / Detective org-wide benchmarked to CIS and FSBP; Google Workspace federated to AWS IAM Identity Center with least-privilege permission sets; a hub-and-spoke AWS Transit Gateway network with VPC endpoints, Client VPN, and Route 53 private hosted zones; CloudTrail / Config / VPC Flow Logs aggregated to a dedicated log-archive account; and architecture docs, Day-2 runbooks, and workshops for knowledge transfer. Delivered as code — separated Terraform repos for infrastructure and account definition, with terraform validate / tfsec / checkov in PR.

Production outcomes

KPI	Result
Production outcomes	A governed multi-account AWS landing zone stood up in the UAE (me-central-1) supporting compliant in-country operations and UAE government-contract eligibility; region-locked by policy (SCPs enforce that no resource can be created outside me-central-1, with root-key blocking, mandatory MFA, and protected audit trails org-wide); an IaC-first operating model with zero standing console access (engineers operate entirely through Terraform and reviewed PRs; privileged console access held by a small admin group with federated SSO); centralized immutable audit (CloudTrail / Config / flow logs consolidated to a dedicated log-archive account, continuous compliance monitoring in Security Hub against CIS); and a de-risked migration path validated end-to-end on Amazon ECS/Fargate with CI/CD before the production landing-zone commitment.
Engagement window	A December 2024 pilot took one representative workload end-to-end onto ECS/Fargate with CI/CD and passed the go/no-go gate. Landing-zone and migration delivery kicked off in October 2025, the UAE migration completed in February 2026, and the platform has run in production since. The Saudi expansion into me-central-2 is now in progress, its readiness assessment already in Tenderd’s hands.
Cost / TCO posture	AWS run-rate for the target environment: $179,641/yr (projected, AWS Pricing Calculator), right-sized against measured consumption so in-country residency came without a cost penalty.
Lessons & continuation	Region-residency belongs in policy, not convention — SCP region-deny is the load-bearing control for a data-residency mandate; a GCP-to-AWS pilot de-risks the large in-region commitment cheaply; an IaC-first / zero-standing-console operating model has to ship with runbooks and workshops or a small platform team can’t operate the surface area of a multi-account org.

AWS services in production

AWS Control TowerAWS Organizations / SCPsAWS IAM Identity CenterAWS Transit GatewayAmazon EKSAmazon ECS / AWS FargateAmazon GuardDuty / Security Hub / DetectiveAmazon API GatewayAmazon CloudFront

Terraform