Nine Months to Ship One App

▶ Watch (02:35)

LPL Financial manages $1.9 trillion in assets for 29,000 advisors. Getting a single application from dev to production took nine months, and that was for prioritized apps. Others waited longer. The bottleneck was process: architecture review gates, tickets routed across multiple teams, queues, escalation paths. Every handoff added time.

On the implementation side, there was no single standard. Terraform where a pattern existed, ClickOps where it didn’t, CloudFormation or SAM as a third option. Each environment, dev through prod, was configured differently. The inconsistency made compliance hard to prove and scaling impossible to plan.

Choosing the Architecture: Control Tower, AFT, and Micro-Account Design

▶ Watch (05:10)

AWS Professional Services ran a landing zone assessment and concluded starting fresh was cleaner than retrofitting the existing environment. LPL was already a Terraform shop, so Account Factory for Terraform made the natural foundation. The architecture added micro-account structure: separate AWS accounts per environment per application, which gives teams isolated blast radius and lets security tools operate account-level rather than chasing per-resource configs.

Control Tower handled the organizational baseline. AFT automated account vending on top of it. That combination meant a new account wasn’t a manual provisioning ticket; it was a pipeline run.

Security Baked In: NFRs, Modules, and Shift-Left Guardrails

▶ Watch (08:56)

Before writing a single module, LPL pulled product, app dev, infosec, and DevOps into one room to produce a shared list of non-functional requirements. Every module built afterward satisfies those NFRs by default: KMS encryption, security group rules, CI/CD gates, birthright security scanning through Guard Duty and Wiz. No team has to remember to add them.

Scope discipline mattered as much as the controls. Modules don’t expose every AWS feature, only the use cases LPL actually needs. Fewer configurations means fewer test cases and less drift to audit. About 90 modules cover 60 AWS services.

Results, Scale, and What Comes Next

▶ Watch (13:54)

Delivery dropped from nine months to six weeks, a 75% reduction. Monthly Terraform applies went from 500 in March 2023 to 25,000 by mid-2024. LPL now manages 1.4 million resources through Terraform and has vended over 400 AWS accounts this year alone. Every account gets identical Guard Duty, Security Hub, and Wiz configuration, so patching a zero-day means one change pushed everywhere.

Next on the roadmap: FinOps scanning, proving controls are implemented through AWS automation tools, and restructuring cloud engineering around product ownership so each service has a named team behind it.

Notable Quotes

start small but think big Albert Silva · ▶ 23:39

Key Takeaways

  • LPL cut application delivery from nine months to six weeks by standardizing on Terraform and account factory automation.
  • Security controls, KMS keys, and guardrails are baked into modules at authoring time, not bolted on after deployment.
  • Define ‘automation’ before you build anything; ambiguous definitions inside one org caused years of inconsistent tooling.