We run our own gitlab instance in a central AWS account that has some infra buckets containing modularized Terraform packaged into tarballs that are then fanned out to a couple hundred aws accounts across the teams and environments (prod, qual, dev).

Its all deployed via gitlab ci cd pipelines (which are just ec2 instances spawned at pipeline invocation) in multiple layers. The first layer is a foundation laying the networking rules and the IAM roles, permissions, policies and boundaries, some logging and monitoring. The second layer then assigns team specifics such as budget and maps people's accounts to roles depending on their access level (maintainer, developer, reporter). This layer can also be used to customize firewall rules like opening ports to the company internal IP ranges. The third and final layer is then all of the application infrastructure of the teams, so all their persistence, compute, load balancing, dns routing and serverless stuff. My prior teammates did a lot by hand in the aws console but I told them to stop and retain everything as IaC code. Besides Terraform, in my team we use Packer to build reusable "golden" machine images but also Ansible to configure live machines.

I'm still surprised nobody bothered us to change to Opentofu, it's not even been mentioned yet lol.