25+ developers ship without a ticket. Three of us run the platform.

A new cloud foundation for a customer-facing application, with delivery teams from several organisations shipping on it. In production for three years.

The situation

The organisation was building a new cloud foundation, and a custom stack on top of it, to deliver a customer-facing application. The platform was being built while teams were already working on it. Cloud resources were created by hand, one request at a time, and every new project, permission or deployment queued behind a handful of people.

Who does what

Product teams

Several dozen developers across several delivery teams, building the product’s services and frontends. They request their own environments, deployments and permissions.

Platform team

Three of us. We built the platform, review infrastructure and deployment changes, and run it.

Security team

A small team on the client side. They review every permission and access change.

Cloud governance

The client’s cloud policies, billing and auditing, delivered through the same pipelines.

Each group works in its own repository. A team proposes a change as a pull request, the people who own that area review it, and merging it is what applies it to the cloud. Nobody files a ticket, and nobody provisions anything by hand.

What we built

• A platform repository: one manifest per cloud project. Product teams propose new environments; the platform team approves.
• A deployment repository: what runs in each environment, the cloud services it needs and how they connect. Product teams submit; the merge deploys.
• A security repository: service accounts, roles and guardrails. Product teams request the permissions they need; the security team approves.
• Pipelines for cloud governance, so policy, billing and audit configuration follow the same path.

What it changed

• Over 100 changes a week, on average. About three in five are deployments; the rest are permission and security changes, mostly requested by product teams themselves.
• Minutes from merge to production.
• No security incident requiring review in three years. Risky permission requests are caught in review, before they reach the cloud.

Built to outlast its own tooling

The CI engine is being replaced, from Concourse to GitHub Actions, one project at a time. Both engines have run side by side for months, with no downtime and no issues. Not a single platform or deployment manifest had to change, because the manifests describe what should run, not how it gets deployed.

Delivery

Three engineers. First project in production in under six months. Running for three years.