How do you verify your cloud actually matches your architecture design?

We've been reviewing our AWS environments lately and kept running into the same issue what we designed: 1/ clean tier separation, 2/ traffic through inspection points, 3/ no SG allowing preprod CIDRs to prod vs. what we have running are 2 very different things. Real example: Web load balancers ende