§ services / cloud
AWS, from landing zone to the monthly bill.
Six capabilities we deliver on AWS. Each is a scoped engagement with named artifacts — code, docs, a plan — not a slideshow. Take one, or several in sequence.
01
AWS migration
- Problem
- You are on ageing on-prem hardware, or a lift-and-shift that never got finished, and every move risks downtime you cannot afford.
- We do
- We inventory workloads and dependencies, pick a pattern per app (rehost, replatform, or refactor), and cut over in reversible waves — AWS DMS for databases, Application Migration Service for servers, a tested rollback for each wave.
- You get
- A migrated estate with a wave-by-wave runbook, a dependency map, and a cutover log you can audit after the fact.
02
AWS architecture
- Problem
- A design that was fine at launch is now the reason scaling, audits, and on-call all hurt.
- We do
- We review against the Well-Architected pillars, then lay out multi-account structure with Control Tower and Organizations, network boundaries, and failure domains — and write the trade-offs down, not just the diagram.
- You get
- A set of architecture decision records, a landing-zone layout, and a remediation plan ranked by risk and effort.
03
AWS cost optimization
- Problem
- Spend climbs every month and no one can say which team or service owns it.
- We do
- We attribute cost with tagging and Cost Explorer, right-size compute, cover steady-state usage with Savings Plans and Reserved Instances, and remove the quiet wasters — idle NAT gateways, orphaned EBS volumes, over-provisioned RDS.
- You get
- A ranked savings plan with real figures, the changes applied, and a standing monthly review so the spend does not creep back.
04
AWS security
- Problem
- You need to pass a customer security review, or tighten access before an incident forces the question.
- We do
- We baseline with Security Hub and GuardDuty, cut IAM back to least privilege, enforce encryption and logging with KMS, CloudTrail, and Config, and set guardrails as service control policies so the safe path is the default.
- You get
- A findings report with fixes applied, IAM and SCP policy in code, and a control map you can hand to an auditor.
05
Terraform
- Problem
- Infrastructure changes happen by hand in the console, so nothing is reviewable and environments drift apart.
- We do
- We codify the estate in Terraform with a sensible module structure, remote state and locking on S3 and DynamoDB, and plan and apply gated in CI — so every change arrives as a reviewed pull request.
- You get
- A Terraform repository with reusable modules, a state backend, and a pipeline that plans on a pull request and applies on merge.
06
Ansible
- Problem
- Server configuration is tribal knowledge, and rebuilding a box is a nervous afternoon.
- We do
- We capture configuration as idempotent Ansible roles, keep them in version control, and wire them into image builds and CI so machines are reproducible rather than hand-fed.
- You get
- A role library, tested playbooks, and a documented path from a bare instance to a running service.
Need the reliability side too?
Cloud and reliability are the same job from two angles. See how we keep it running.