Multi-cloud governance · Security
Multi-cloud governance and security for AWS and Azure
Multi-cloud governance is one set of rules for every cloud you run: how accounts and subscriptions are set up, who can access what, what gets logged and watched, how data is encrypted and backed up, who owns each cost, and how changes are made. Without it, each cloud drifts its own way.
HabileLabs sets that standard on AWS and Azure and keeps it enforced, using each cloud's own tools. On AWS, Wonder Finance's AWS Config rules enforce encrypted EBS and RDS, non-public S3 and restricted network ports.
- AWS CloudFormation Service Delivery validation, audited by AWS
- AWS Partner, Advanced Tier Services
- Microsoft Solutions Partner for Azure Infrastructure
The problem
Where governance drifts once there are two clouds
Some gaps sit inside each cloud. Others sit between them, where nobody's job description reaches.
Two sets of accounts, two sets of rules
AWS accounts and Azure subscriptions created project by project, each set up a different way, with no landing zone behind them.
Admin access nobody has reviewed
Admin access spread across too many people, and leavers removed from one cloud but not the other.
Logs in two places, watched in neither
Alerts that fire but nobody acts on, and findings that sit in two consoles with no single owner.
Backups never restored
Backups that have never been restored to prove they work, on one cloud or on both.
Bills that no team owns
No tags or budgets, so no team owns the bill, and no single view of the total across subscriptions, accounts and clouds.
Changes made by hand
Infrastructure configured by hand in each console instead of from templates, so no two environments are quite the same.
The standard
One standard, six areas, enforced on each cloud
One standard for how every account and subscription is set up.
On AWS, accounts sit in a landing zone built with AWS Control Tower, with Service Control Policies as guardrails. On Azure, subscriptions sit in an Azure landing zone, with networking, identity and security policies designed and built before any workload moves. Both follow one naming, network, logging and tagging standard that we write down with you. At Eternal Hospital, Jaipur (EHCC), a secure landing zone was set up with AWS Control Tower in the AWS Mumbai Region.
- AWS Control Tower landing zone
- Service Control Policies
- Azure landing zone
- One naming and tagging standard
Access kept to what each role needs, on both clouds.
Least-privilege access on AWS through IAM roles and Service Control Policies, and on Azure through Entra ID roles, with admins given only the access their role needs. Where your people already sign in with Entra ID, we federate AWS access to that directory, so joiners and leavers are handled once. At Aavas Financiers, on AWS, Amazon Cognito manages user authentication and AWS IAM enforces role-based access across all layers.
- AWS IAM least privilege
- Service Control Policies
- Entra ID roles on Azure
- Entra ID sign-in federated to AWS
Featured result
90%less unauthorized access on AWS, through encryption, IAM guardrails and AMS compliance checksAlso with
Threats watched on both clouds, and findings fixed.
Logging, threat detection and alerts across accounts and subscriptions. On AWS, Amazon GuardDuty watches for suspicious network traffic and API activity, AWS Config checks configuration against your rules, and AWS CloudTrail keeps the audit trail. On Azure, Microsoft Defender for Cloud findings are reviewed and fixed. Alerts from both clouds reach one team, with one way of handling incidents.
- Amazon GuardDuty
- AWS Config and AWS CloudTrail
- Microsoft Defender for Cloud
- One incident process for both clouds
Also with
Data encrypted, and backups proven by restoring them.
On AWS, encryption with AWS KMS and credentials in AWS Secrets Manager; at iSEEit, separate customer managed keys protect production and non-production. On Azure, Azure Backup and Azure Site Recovery are set up, monitored and checked with test restores. Recovery copies can be kept outside the primary account or region, and every system gets a recovery time and recovery point that you set.
- AWS KMS customer managed keys
- AWS Secrets Manager
- Azure Backup and Azure Site Recovery
- Test restores on a schedule
One cost view, with every cost owned.
AWS, Microsoft Azure and Google Cloud all make billing data available in FOCUS, the FinOps Foundation's open cost and usage format, so the bills can land in one view. Each cost is tagged to the team that owns it, budgets and alerts make new waste visible early, Savings Plans cover steady AWS usage, and Azure Cost Management holds Azure's tags, budgets and alerts.
- One FOCUS-based cost view
- Tags by owner
- Budgets and alerts
- Savings Plans and Azure reservations
Changes made through templates, not by hand.
Infrastructure defined in version-controlled templates instead of configured by hand, so every environment is created the same way and security rules are enforced automatically. On AWS, that is AWS CloudFormation, for which AWS has awarded us a Service Delivery validation after auditing delivered customer work. On Azure, the landing zone and its policies are set before workloads move, and changes to production resources are scheduled with you and checked afterwards.
- AWS CloudFormation templates
- AWS Config rules in CloudFormation
- Separate stacks per environment
- Production changes scheduled with you
Case in focus · AWS
How Wonder Finance's guardrails are enforced as code on AWS
Wonder Home Finance (Wonder Finance) is a housing finance company in Rajasthan. Its AWS infrastructure is built from modular AWS CloudFormation templates, with AWS Config rules written into them, so security rules are enforced automatically rather than checked by hand. This is AWS work on one cloud. We show it here because guardrails written as code are the core of the standard we set on each cloud.
Encrypted storage and databases
AWS Config rules enforce encrypted EBS volumes and RDS databases.
No public storage
AWS Config rules keep S3 storage non-public.
Restricted network ports
AWS Config rules enforce restricted network ports.
Threats watched across accounts
Amazon GuardDuty watches for suspicious network traffic and API activity across accounts.
Modular templates
Infrastructure deploys from modular AWS CloudFormation templates, with over 80% less time to deploy infrastructure.
Policies enforced automatically
Security policies are enforced automatically through the templates, not applied by hand.
Wonder Finance's AWS WAF work is a separate case study: 12M+ malicious requests blocked in the first year. Read the CloudFormation case study.
What you receive
What a multi-cloud governance review gives you
The review covers AWS and Azure, and the on-premises systems that connect to them. It is a technical review: where regulation applies, it covers technical readiness, not legal or compliance advice.
A map of what runs where
Every account, subscription and connected on-premises system, with what runs in it and who owns it.
A written standard
Landing zone, naming, network, logging and tagging rules for both clouds, in one document your team and partners can follow.
An access review
Who holds admin and privileged access on each cloud, which access no longer matches a role, and what to remove.
Security and recovery findings
Amazon GuardDuty, AWS Config and Microsoft Defender for Cloud findings, and backups checked by restoring, ranked by risk.
One cost view
AWS and Azure spend in one FOCUS-based view, with untagged and unowned costs listed.
A remediation plan
Gaps ranked by risk, with the effort each one takes. Nothing changes in your accounts until you approve the plan.
Need an exit plan as well? The cloud exit assessment adds an exit plan per critical workload.
Ways to start
Three ways to start, each with its own scope
Pick the one that matches the clouds you run. Each has its own terms. For the multi-cloud governance review, the first conversation is free.
Multi-cloud governance review
For AWS and Azure estates that grew without one standard. We review accounts and subscriptions, identity, logging, encryption, backups, cost and change control, and rank the gaps by risk.
Best for: Teams running AWS and Azure side by side
- One written standard for both clouds
- Gaps ranked by risk
- A remediation plan you approve
AWS security and DR review
For AWS accounts. The security assessment checks them against the AWS Well-Architected security pillar: misconfigurations, open access, unencrypted data and missing logs, ranked by risk.
Best for: Banks, NBFCs, hospitals and SaaS teams on AWS
- Gaps ranked by risk
- A recovery plan around your RTO and RPO
- A recovery drill before you rely on it
Managed Azure services
For Azure environments nobody runs day to day. Microsoft Defender for Cloud findings reviewed and fixed, Entra ID access kept to what each role needs, and backups checked with test restores, with a monthly report.
Best for: Teams without a cloud operations team
- Support hours agreed for each contract
- Environments built by another partner taken over
- Monthly health and cost review
How a governance engagement runs
Review
Accounts, subscriptions, access, logging, encryption, backups, cost and change control reviewed on each cloud, with gaps ranked by risk.
Agree
One written standard for both clouds, agreed with your team before anything changes.
Enforce
Guardrails applied through Service Control Policies, AWS Config rules and AWS CloudFormation templates on AWS, and through the Azure landing zone and Entra ID roles on Azure.
Keep current
Findings, access and cost reviewed on a regular cadence, by your team or as part of our managed cloud services.
Partner status
The credentials behind our governance work
AWS awards each Service Delivery validation through an independent audit of delivered customer work. Of our nine, the one that applies most directly here is AWS CloudFormation, which we use to enforce security rules as code, as at Wonder Finance. On Azure, HabileLabs is a Microsoft Solutions Partner for Infrastructure, one of its three Azure designations.
AWS Partner, Advanced Tier Services- AWS CloudFormation Delivery
AWS WAF Delivery- Microsoft Solutions Partner, Infrastructure (Azure)
All nine validations, and what each covers: AWS competencies and validations.
- AWS service delivery validations
- 9
- AWS competencies
- 2
- Microsoft Azure partner designations
- 3
Keep exploring
More on running more than one cloud
Multi-cloud and hybrid cloud services
AWS, Azure and the systems that stay on-premises, run as one estate by one team.
Multi-cloud servicesCloud exit assessment
An exit plan per critical workload, for banks, NBFCs and regulated teams that need a tested way out.
Cloud exit assessmentCloud security and disaster recovery
Identity, encryption, AWS WAF, backups and recovery plans tested before an outage.
Security and DRCloud cost optimization
Rightsizing, Savings Plans and storage tiering on AWS and Azure, with published client results.
Cloud cost optimizationManaged cloud services
Monitoring, incident response, patching, backups, security and cost control for AWS and Azure.
Managed cloud servicesAWS vs Azure vs Google Cloud
Where each cloud tends to fit, and the questions that decide which one should be your primary cloud.
Compare the clouds
Governance FAQs
Multi-cloud governance, answered
What governance covers across AWS and Azure, which tools we use on each, and how a review starts.
One set of rules applied to every cloud you run: how accounts and subscriptions are structured, who can access what, what is logged and watched, how data is encrypted and backed up, who owns each cost, and how changes reach production. Each cloud enforces the rules with its own tools, and one team checks that they hold.
Because the gaps sit between the clouds: a leaver removed on one cloud and not the other, logs collected in two places and watched in neither, costs that no team owns. One standard means the same question gets the same answer on both.
On AWS: AWS Control Tower, IAM and Service Control Policies, AWS Config, Amazon GuardDuty, AWS KMS, Savings Plans and AWS CloudFormation. On Azure: an Azure landing zone, Entra ID roles, Microsoft Defender for Cloud, Azure Backup, Azure Site Recovery and Azure Cost Management. We use each cloud's own tools and hold them to one standard.
Yes. If your people already sign in with Microsoft 365 and Entra ID, we can federate AWS access to that directory, so one identity per person covers both clouds and a leaver is removed once. Access on each cloud is still kept to what each role needs.
Not yet. Each of our published results is on one cloud, and our published governance examples are on AWS: Wonder Finance's AWS Config rules enforce encrypted EBS and RDS, non-public S3 and restricted network ports, and Dr. B. Lal Clinical Laboratory saw 90% less unauthorized access through encryption, IAM guardrails and AMS compliance checks. On Azure, security and access management are part of our managed Azure services.
It covers the technical side. RBI's Master Direction on Outsourcing of Information Technology Services, effective from 1 October 2023, applies to banks, NBFCs and other regulated entities. It asks for an exit strategy that keeps business continuity during and after an exit, with alternatives identified, and for cloud services it expects the full data lifecycle to be covered. A governance review shows where your setup stands technically; the cloud exit assessment adds an exit plan per critical workload. Both cover technical readiness, not legal or compliance advice.
AWS, Microsoft Azure and Google Cloud all make billing data available in FOCUS, the FinOps Foundation's open cost and usage format, so spend can sit in one view. Costs are tagged to the teams that own them, budgets and alerts are set on each cloud, and spend is reviewed on a regular cadence.
No. The review ends with gaps ranked by risk and a plan you approve. Nothing changes in your accounts until then, and changes to production resources are scheduled with you and checked afterwards.
Ask for a multi-cloud governance review. Tell us which clouds, accounts and subscriptions you run, and who looks after each. The first conversation is free.
Next step
Is each of your clouds following the same rules?
Ask for a multi-cloud governance review. We review accounts, access, logging, encryption, backups, cost and change control on AWS and Azure, and rank the gaps by risk. The first conversation is free.
- One standard for AWS and Azure
- Gaps ranked by risk
- AWS CloudFormation validation, audited by AWS