AWS Cloud Center of Excellence (CCoE): Operating Model, RFCs, and How WAR + FinOps Connect

May 2026. AWS still publishes transformation guidance through CAF 3.0 (47 capabilities) and workload reviews through the Well-Architected Framework, but neither document tells you who approves a new region, how FinOps stops a shadow VPC, or how MAP waves get gated. That gap is what a Cloud Center of Excellence (CCoE) closes—when it is an operating model, not a steering committee with slide templates.

This article is for VPs of engineering, enterprise architects, and platform leads building (or resetting) a CCoE on AWS. It connects roles, RFCs, platform vs application ownership, and how Well-Architected and FinOps plug in—without repeating our CAF practice map or Control Tower setup guide.

From a real engagement — A B2B SaaS on 14 AWS accounts (~$280k/month run rate, SOC 2, US + EU regions) had a “cloud guild” that met monthly but lacked RFC intake. Platform published VPC standards; product teams opened 23 security-group exceptions per month via Slack. After formalizing a CCoE charter with 72-hour standard RFC SLA and FinOps tag blocks in CI, exceptions fell to 6/month in 90 days; Well-Architected high-risk findings on pilot workloads dropped from 11 to 4 because logging prerequisites were funded before reviews ran.

What a CCoE does (and does not)

Opinionated take: We recommend one RFC queue for platform exceptions—not separate Security, Networking, and FinOps email threads. Security and FinOps are consulted roles with SLA timers; the CCoE accountable owner publishes the decision.

Operating model: three layers

Executive sponsor (quarterly outcomes, $ targets)
        │
CCoE lead + architects (RFC decisions, standards, WAR program)
        │
Platform engineering (landing zone, pipelines, shared clusters)
        │
Application teams (workloads, CI/CD to prod, tag application)

Platform ships the rails; CCoE sets which trains may run and records exceptions; application teams ship workloads that inherit central logging, SSO, and tag keys.

RFC workflow (the habit that matters)

Every net-new service, region, SCP exception, or internet egress path starts as an RFC. Minimum fields and RACI are in examples/architecture-blog-2026/ccoe-operating-model/raci-and-rfc-template.md.

Standard RFC (in-catalog): target 3 business days. Exception RFC: 10 days with Security + FinOps consulted. Emergency: acknowledge in 4 hours; retroactive RFC within 5 days after incident stabilization.

What broke — A fintech scale-up enabled eu-central-1 for one product team without FinOps chargeback keys. Cost Explorer showed +$18k/month NAT and cross-AZ traffic 6 weeks later; Finance escalated, Engineering blamed “platform delay.” Root cause: no RFC, so tag policies were never updated and CUR allocation defaulted to a shared cost center. Fix: freeze new regions until RFC template included CostCenter + Product keys validated in a sandbox account.

Connecting Well-Architected (WAR)

Run WAR on pilot workloads during CAF Launch/Scale, not as a substitute for missing logging or SSO. The CCoE should maintain a remediation backlog ranked by risk and dollars—not a PDF per review.

Schedule reviews after the landing zone delivers org-wide CloudTrail, Config, and SSO—see WAR six pillars for workload-level depth.

Connecting FinOps

FinOps is a partner function, not a sub-team buried inside Finance:

1. CCoE publishes mandatory tag keys and SCP/tag policies.
2. FinOps owns allocation rules, anomaly detection, and monthly showback.
3. Platform enforces tags in CI/CD and blocks deploy without keys.
4. Application teams fix tag debt within 2 sprints or lose exception rights.

For framework depth, use FinOps on AWS; for culture gaps, engineering cost ownership.

MAP and migration gates

Treat MAP Mobilize as funding for Platform + Security capabilities on the CCoE backlog—not a separate universe. Attach the 47-point migration readiness checklist to Assess → Mobilize transitions; do not start waves with >5 failed Platform/Security controls.

May 2026 product note: plan net-new discovery on AWS Transform and Application Migration Service—Migration Hub stopped accepting new customers November 7, 2025 (AWS documentation).

What to do this week

1. Copy the RACI + RFC template into your ITSM tool.
2. Name an executive sponsor and a single CCoE accountable owner (not a committee).
3. Publish the in-catalog AWS service list and approved regions—everything else requires RFC.
4. Fund three landing-zone gaps from CMA/MAP Assess before scheduling more WAR reviews.

Reproduce this — Start from the RACI + RFC template. Pair with CAF 3.0 overview and your Organizations delegated-admin layout.

What this post does not cover

• Step-by-step Control Tower installation (dedicated guide).
• Industry-specific regulatory playbooks (healthcare, public sector FedRAMP).
• Partner/MAP funding negotiation mechanics.
• Tool comparisons for ITSM (Jira vs ServiceNow)—the RFC fields are tool-agnostic.

---

Related: AWS managed services · Cloud migration consulting · Security & compliance hub

If you only do one thing: Stand up one RFC queue with FinOps and Security SLAs before you add another governance slide deck.