Track 08 · Deployment & opsLesson 01 of 11
Deploying into the customer's cloud
Landing zones, environments and promotion, under their guardrails.
- Lesson library · reference
- 30 min read
- 60 min hands-on
- Pro
What you'll be able to do
01You can:
- Explain a landing zone on AWS, Azure and Google Cloud, and read a customer's hierarchy, guardrails and network hub before writing infrastructure.
- Design an environment strategy for an agent system and state what differs per environment and what must not.
- Choose per-environment network and identity boundaries: private endpoints, controlled egress, separate deploy and run identities.
- Implement a promotion gate that enforces one artefact digest, allow-listed config differences, data classes, private endpoints, model allow-lists and approvals.
- Defend your request list and promotion process to a platform team and a change advisory board (CAB).
Before you start
- Secrets, dependencies and network isolation: signed images, vaulted secrets, default-deny egress.
- Agent credentials, from issue to revoke: workload identities.
- Finding and masking personal data: what masked data in lower environments means.
- Data residency and sovereignty: why a Region is chosen.
- Regression tests and CI gates: the eval gate a promotion depends on.
- Background: you know what a VPC and an IAM role are and have read a Terraform plan.
The short version
A landing zone is the customer's pre-built, multi-account cloud estate: a hierarchy of accounts, guardrail policies inherited down it, a shared network hub, central logging and one identity entry point. You do not build it or change it. You request accounts, endpoints, egress entries and roles through the platform team, and design so your first plan passes their controls. Inside it you run several environments and promote one tested artefact through them by digest. Only allow-listed configuration changes between environments. Lower environments never see production data classes, and production reaches models and platform services only over private endpoints.
- Read the guardrails before you write Terraform. An explicit deny in an organisation policy beats any permission in your account.
- Environments differ in configuration, never in code. Any unlisted difference is drift and blocks promotion.
- Agents add per-environment surfaces: model profiles, quotas, keys, data classes, connectors. Promotion is a recorded decision with independent approvers.
Pro lesson
The rest of this lesson is in Pro.
The mental model, worked example, field note, failure table, exercise and self-check, with the voice tutor.
- Every stage and specialisation, in full
- Every lab and every role project
- Halden weeks 2–10, on your record
- Every drill, live in the playground
- All solutions, plus the server judge
- Lab Assistant and every Teach with AI