AWS Migrations & Modernization
Migration projects usually don't fail at the workload — they fail at the platform underneath it. We build that platform as code: multi-account foundations, landing zones, Terraform, and GitHub Actions pipelines, then move and modernize workloads onto it in planned waves. Engagement-specific work lands in your repositories as pull requests your team reviews from the first commit; ownership transfers under the engagement terms when the applicable fees are paid.
One hour with the engineer who does the work. Verbal advice, no obligation, no deck.
Built to be finished, not extended
Our incentive is to finish: clean handoff, your team owns the engagement-specific work, and we move on. The SOW states deliverables, timeline, and a fixed price before work starts; if scope changes mid-engagement, we re-scope and agree in writing before work continues. Nothing lands on an invoice you haven't agreed to, every external or reusable-tooling dependency is named in writing, and the person you talk to is the person who does the work.
Platform foundations & landing zones
Multi-account foundations done as code: AWS Organizations structure, service control policies, IAM Identity Center, and centralized logging and network accounts. The goal is an account layout your team can explain — and extend — without us.
- Greenfield landing zone — org structure, guardrails, identity, and logging delivered as Terraform
- Retrofit — restructuring an organically grown single-account estate into a governed organization
- Guardrail review — SCPs, permission boundaries, and the gaps between what policy says and what accounts do
Foundations, runbooks, and the reasoning behind every guardrail — delivered into your repositories.
Terraform & module engineering
Terraform is how everything we ship gets built — we maintain our own versioned module toolkit and build it with the same discipline we hand you. We write modules your team can reuse, untangle state that has grown by accident, and leave infrastructure code that is reviewed, tested in CI, and documented.
- Module library build-out — reusable, versioned modules with examples and CI checks
- State refactoring — splitting monolithic state into composable, safely-planned stacks
- Codifying a hand-built environment — import, reconcile, and put every change behind a pull request
Engagement-specific code lands as pull requests in your repositories — reviewed by your team from the first commit, with ownership transferring on payment under the engagement terms.
CI/CD & GitOps with GitHub Actions
GitHub Actions pipelines, Terraform automation, and GitOps patterns — deployment machinery engineering teams actually want to use. Fast feedback, self-service deploys, and infrastructure changes that go through the same review discipline as application code.
- Pipeline build-out — GitHub Actions workflows for application and infrastructure delivery
- GitOps adoption — plan/apply gates, drift detection, and environment promotion as code
- Supply-chain hygiene — pinned actions, verified tooling, and least-privilege deploy credentials
Migration enablement & replatforming
Lift-and-shift, replatforming, and database moves — founder-led, personally. Waves are sequenced against a dependency map, each with a rollback plan and a fixed price agreed before it starts — planned so failures are small, contained, and reversible.
- Wave planning and execution — sequenced moves with rollback planned before cutover, not improvised after
- Stalled-migration re-baseline — rebuilding the wave plan when the dependency map lives in someone's head
- Modernization increments — containerization, managed databases, and serverless where it genuinely fits the workload
Security, networking, and cost — engineered in, not sold separately
Three concerns run through every build. Security: IAM least-privilege, network exposure, and an audit trail that answers a reviewer's questions with evidence. Networking: VPC design, hybrid connectivity, and traffic paths that stop paying a data-transfer tax. Cost: architecture decisions made with the bill in the room, so the platform you get is one you can afford to run. They're implementation concerns in every SOW — not practice areas with their own price tags.
Terraform-first, and honest about it
We build in Terraform. It's the tool our own delivery machinery is written in, the ecosystem we maintain modules for, and the codebase we can stand behind after handoff. If your estate already runs on CDK or another IaC tool, say so on the consult: we'll tell you honestly whether a Terraform platform alongside it makes sense — and if what you really need is a CDK-native build partner, we'll say that too, and point you at what to look for. What we won't do is quietly take on a stack we wouldn't maintain to our own standard.
What a scoped engagement looks like
The free consult is the scoping entry. We map current state, target state, and constraints; you get a written, fixed-price proposal within 48 hours of scoping.
Deliverables, timeline, assumptions, exclusions, and one fixed price. Half the fee on signature (that payment schedules the work), the remainder on acceptance.
The SOW sets the delivery and review cadence. Focused builds can use short iterations with working infrastructure reviewed at agreed milestones; phased migrations follow the cadence their dependencies and cutover windows require.
Engagement-specific IaC in your repos, a dependency manifest for reusable components, diagrams that match reality, runbooks, and knowledge transfer with the engineers who will operate it.
A 60-day support window while your team takes over. Your first weeks operating a new platform shouldn't be solo.
Engagement-specific work is delivered into your repos and accounts as we go. No private dependency is introduced unless continuing access or a client-owned copy is part of the written handoff.
Fixed price per scoped SOW
Migrations are scoped individually and priced as a fixed-price SOW — after scoping you get a written fixed price within 48 hours, and it changes only if we both agree new scope in writing.
Monthly capacity and the cost diagnostic have published prices → /pricing/.
Proof you can check yourself
The engineer who does the work, independently verifiable:
Download the Sample Architecture Review (PDF)
The PDF includes tagged structure and document-language metadata. If you need the content in another format, email [email protected].
Who does the work
One senior engineer — the one you talk to at scoping, with your team engaged throughout. Some migrations need a bench we do not pretend to have. If yours does, we'll say so in the first hour — that's part of what the free consult is for. Access, continuity, and the one-person questions get direct answers on Security & Trust.
Frequently asked questions
What does "fixed scope, fixed price" actually mean?
The SOW defines deliverables, timeline, and price before work starts. If your requirements genuinely change mid-project, we re-scope openly and agree the new work in writing before continuing — you decide, nothing appears on an invoice unagreed.
Who actually does the work?
The person you talk to. No account managers, no handoff to a delivery bench — senior engineering from the first scoping call through the last commit. That is a structural feature of a boutique, and the reason the quality doesn’t depend on which engineer you happen to get.
How do we see progress?
The SOW sets a progress cadence that fits the work. Code lands in your repositories as pull requests, with reviews or demonstrations at agreed milestones; migration cutovers use the cadence their dependencies and operating windows require.
What does handoff include?
Engagement-specific infrastructure code committed to your repositories, a manifest of external or reusable-tooling dependencies and their continuing-access terms, architecture diagrams that match what actually shipped, runbooks for the common operational tasks, and a knowledge-transfer session with the engineers who will own it. Then a 60-day window where we stay available as your team takes over.
Scope it in an hour, free
Bring the migration that stalled, the platform that grew by accident, or the greenfield you want to get right the first time. One hour, verbal recommendations, and a written fixed price within 48 hours if it should become a project.
Book the Free Consult