Enterprise landing zones for AWS and GCP, ready to fly
Multi-Cloud Runway is a free, open-source infrastructure template providing security-hardened landing zones for AWS and GCP. It sets up multi-account environments with networking, IAM, security monitoring, and compliance via Terraform/Terragrunt. Available on GitHub at github.com/cloudon-one/multi-cloud-runway.
Core Features
Multi-Account Architecture
Enterprise-grade account and project structures for both AWS and GCP.
- AWS Organizations with multi-account separation
- GCP resource hierarchy with project-level isolation
- Environment-based account structure (dev, staging, prod)
- Centralized billing and governance
Network & Security
Pre-configured networking, encryption, and security monitoring.
- VPC/VNet with Transit Gateway and interconnect
- GuardDuty and Security Command Center
- CloudTrail and audit logging
- Encryption at rest and in transit
Compliance Automation
Built-in compliance frameworks with automated validation.
- PCI DSS, CIS Benchmarks, SOC 2 Type II
- ISO 27001 and NIST Framework controls
- Pre-commit hooks with tfsec and checkov
- Quarterly disaster recovery testing
How It Works
Clone and Configure
Clone the repository and run make verify-setup to ensure prerequisites are met. Configure your accounts and regions.
Initialize State Backend
Run make init to provision the S3/DynamoDB (AWS) or GCS (GCP) state backend with encryption and locking.
Deploy Landing Zone
Apply Terraform modules in sequence: accounts, networking, security, then services. Each module is independently deployable.
Start Building
Your multi-account environment is ready with networking, IAM, security monitoring, and compliance checks in place.
Why Choose Multi-Cloud Runway?
Days, Not Months
Deploy compliant, multi-region cloud environments in days instead of months of manual architecture design.
Compliance From Day One
Pre-configured for PCI DSS, CIS Benchmarks, SOC 2 Type II, ISO 27001, and NIST Framework — no retrofitting required.
Error Prevention
Pre-validated modules eliminate common configuration mistakes. Pre-commit hooks enforce security scanning and formatting standards.
True Multi-Cloud
Unified IaC approach for both AWS and GCP. Consistent patterns, shared conventions, separate cloud-specific implementations.
Tech Stack
Frequently Asked Questions
What cloud providers does Multi-Cloud Runway support?
What compliance frameworks are supported?
Can I use only the AWS or only the GCP modules?
How does the pre-commit security scanning work?
Is this suitable for startups or only enterprises?
Other CloudOn Tools
KubeLaunch
KubeLaunch Essentials is a free, open-source Kubernetes platform with integrated security, observability, and service mesh. It deploys a security-hardened EKS cluster via Terraform/Terragrunt with ArgoCD, Kyverno, Falco, Istio, and Kubecost pre-configured. Available on GitHub at github.com/cloudon-one/kubelaunch-essentials.
Learn moreFinOps Guardian
FinOps Guardian is a free, open-source cost governance toolkit for AWS and GCP. It automatically detects idle resources, provides cost-saving recommendations, and cleans up unused infrastructure. Deployed with Terraform, it runs serverlessly on Lambda and Cloud Functions. Available on GitHub at github.com/cloudon-one/FinOps-Guardian.
Learn moreSecureOps
SecureOps is a free, open-source GitHub Action that performs automated security scanning on repositories. It detects secrets, vulnerabilities, and misconfigurations using Gitleaks, Trivy, and OSV-Scanner. Generates multi-format reports and integrates with GitHub Security tab. Available on GitHub at github.com/cloudon-one/git-security-scanner-public.
Learn more