Cloud Complexity at Two Levels

▶ Watch (00:43)

The 2025 Cloud Complexity Report put 97% of organizations as struggling with cloud infrastructure. Fjellstrom’s view: the real number is 100%. Cloud landing zones are the standard answer, but they only serve platform engineers. The individual developer who wants to write application code has no interest in Terraform or configuration management, and landing zones do nothing for them.

Cloud complexity runs at two levels: the organizational level, where platform engineers handle multi-cloud and hybrid environments, and the individual developer level, where a catalog of hundreds of services obscures a typically simple architecture.

Two Landing Zone Types on a Spectrum

▶ Watch (06:05)

Fjellstrom proposes two landing zone types on a spectrum. The infrastructure landing zone bundles infrastructure management, secrets management, network connectivity, image management, and source code management. Platform engineers use it to build any cloud project. The application landing zone adds compute orchestration and splits the source code: app code in one repository, infra code in another. Cloud complexity stays in the infra repository. Developers touch only the app repository and write code without caring what is running underneath.

Mapping HCP Tools to Each Zone

▶ Watch (10:42)

On HCP, the infrastructure landing zone maps to: Terraform (workspaces or stacks) for all infrastructure changes, Packer and the HCP Packer registry for image management, Vault with a preconfigured namespace for secrets, and Consul plus Boundary for network connectivity. Consul handles machine-to-machine access. Boundary handles human-to-machine access. The application landing zone adds a Nomad namespace where workloads actually run. Sentinel policies apply across all Terraform changes to enforce compliance. Waypoint provides self-service so developers can order or modify a landing zone without involving the platform team.

Self-Service Provisioning in Practice

▶ Watch (15:58)

Fjellstrom showed the flow live. A developer opens Waypoint, picks the application landing zone template, types a name, and clicks create. Terraform runs in the background. Within minutes, the developer gets a Git repository with a boilerplate application already committed and a URL where that application is already running. Nomad, Vault, and Consul are all wired up automatically, through a no-code Terraform module in the private registry. The developer opens the repository and starts writing code. Sentinel blocks any non-compliant change before it reaches a target environment.

Notable Quotes

97% of organizations are struggling Mattias Fjellstrom · ▶ 0:43

They love infrastructure as code. Mattias Fjellstrom · ▶ 4:44

tool sprawl and system fragmentation. Mattias Fjellstrom · ▶ 20:29

Key Takeaways

  • Split infra source code from app source code to hide cloud complexity from developers.
  • Waypoint self-service lets a developer order a fully wired landing zone in minutes.
  • Sentinel policy-as-code enforces compliance on every Terraform change across all environments.