An AWS account your team will still run in five years.
From an empty account to a multi-account, multi-region organization, or out of a legacy data centre. Designed for the team that will inherit it.
At a glance
- Build
- 6–16 weeks
- then a 3-week handoff
- Starting point
- Greenfield or migration
- Team
- 2–3 senior engineers
- First deliverable
- 48 hours
Your AWS organization, built and handed over.
All of it in your AWS account and your repo.
- Account structure and IAM baseline
- Network design and hybrid connectivity
- Terraform or CDK modules in your repo
- Runbooks written with your on-call, with three real incidents walked through before we leave
- Cost model: monthly spend forecast by service and a Reserved Instance strategy
Select the structure, network, code or runbook line to see where it lives in the diagram.
Four stages, from account structure to cutover.
- 01Account strategyAWS Organizations, SCPs (the guardrail rules on every account) and per-team accounts, with central logging and an IAM boundary that still works when you hire your next ten engineers.
- 02Network and connectivityVPC design, Transit Gateway, and VPN or Direct Connect for on-prem workloads that aren’t moving. Egress controls are in place before anything touches production data.
- 03Compute, storage and dataECS, EKS, Lambda or Step Functions, chosen for your team’s operating experience, not the newest service. S3 as source of truth; RDS, Aurora or DynamoDB where each earns its place.
- 04Migration and cutoverOut of a legacy data centre with the servers still running. The method is below.
How a migration runs.
- Plan first: which applications move, in how many phases, and how much downtime the business can tolerate.
- Database Migration Service, Application Migration Service and Snowball do the moving. The DNS strategy is settled before the first cutover.
- Cutover windows are scheduled with your business. The rollback plan is approved before we run a single task.
Chosen for your five-year horizon, not the newest service page.
Nothing is provisioned until your team signs off.
Sixteen weeks after kickoff, the last rack in the old data centre was powered down.
Aerospace OEM, 2023. Two phases, eleven applications, zero downtime tolerance. The org structure, Terraform modules and a runbook written with their on-call were handed over at week five.
Not a fit if you…
- Are looking for the cheapest bid. We won’t be the lowest number in the spreadsheet.
- Need a throwaway proof-of-concept. Our work is designed for what comes after it.
- Are primarily on Azure or GCP. AWS is our practice, and we’ll point you to someone better.
What to ask before you sign.
How much does a typical engagement cost?
Greenfield AWS foundations run $60–120k. Migrations from a legacy data centre are quoted on scope, typically $150–400k for a mid-size environment. The discovery fee is refunded if we don’t deliver the plan and budget within 48 hours.
Do you work with our existing team, or replace them?
We work with them. We pair with your engineers from day one, and by week three of handoff they are driving. If you don’t have internal AWS engineers yet, we’ll help you hire the first one.
Can we start with a proof-of-concept?
Only if the proof-of-concept is itself headed for production. We don’t take on throwaway work, and we’ll recommend a firm that does.
What if our industry has specific compliance requirements?
We have shipped for banking (OSFI B-13), SOC 2, HIPAA and aerospace data sovereignty. We design the compliance posture into the architecture from day one and hand you the evidence trail your auditor needs.
Do we own the infrastructure code?
Yes. Every Terraform module, pipeline and IAM policy lands in your repository under your organization, and we keep nothing proprietary.
Tell us what you're building.
We reply within one business day.
First call: 30 minutes, on a Tuesday or Thursday, with two engineers, not a sales rep. If we’re the wrong fit, we’ll say so and name a firm that is.