Organisation and accounts
Design the estate: environment boundaries, shared-services accounts, audit and log archive, and a layout that maps to how your teams actually work. All of it defined in Terraform or OpenTofu rather than clicked together.
Services
Cloud & Platform Foundations
Your cloud estate grew faster than the rules around it, and the platform is starting to inherit that mess.
The account model, network, identity, and guardrails your platform inherits. We make the cloud estate predictable before Kubernetes multiplies every weak boundary.
Most platform problems start below the platform: accounts without clear boundaries, networks that grew by exception, and access patterns nobody wants to defend. We design and codify that base layer so every cluster, environment, and delivery workflow starts from a known shape.
Scope
Where the work has to hold.
Every engagement is scoped to the pressure in front of you. These are the areas we usually need to make reliable for the change to stick.
Network topology
Plan address space, connectivity, DNS, and egress once, so a new environment is a module call instead of a negotiation. Hub-and-spoke or flat, the design is documented and repeatable.
Identity and guardrails
SSO for engineers, short-lived OIDC credentials for CI, and policy guardrails that block the dangerous defaults before anyone relies on them.
Typical estate design
What a foundations engagement typically produces. The structure is provider-agnostic: AWS is the most common substrate, but the same layers apply on any cloud.
guardrails
Governance baseline
Policy Guardrails (e.g. SCPs)Drift and Config RulesAudit LoggingBudget Alerts
access boundaries
Identity and access
SSO for Engineers
Role and Permission Model
OIDC for CI
Break-glass Access
account model
Organisation
Account and Environment Layout
Shared Services
Log Archive
Network Topology
Engagement shape
Start clean, or clean up before you scale.
Greenfield estates, existing estates that need tightening before the platform grows, and focused identity or network redesigns are all common shapes.
Greenfield estate
A new organisation designed and built in code from the first account: structure, networking, identity, guardrails.
Pre-platform tightening
The estate exists but grew organically. We restructure accounts, networks, or access before Kubernetes multiplies the blast radius.
Identity and access reset
Replace long-lived keys and ad-hoc admin with SSO, a role model, and short-lived credentials for humans and CI.
Outcomes we are aiming for
01
An account and environment model with clear boundaries, owned in code
02
Network topology and shared services that scale past the first cluster
03
Identity, access, and guardrails defined once and enforced everywhere
From the blog
See how we think before you talk to us.
Deep dives from the engineering blog covering the tools and patterns this service is built on.
Cloud Foundations
Managing multiple AWS accounts with OpenTofu/Terraform
Manage multiple AWS accounts with OpenTofu/Terraform, from the simplest setup up to AWS Control Tower AFT.
6 min read
Infrastructure as Code
Testing OpenTofu and Terraform with native test blocks
Native test blocks, Terratest and policy checks: what to test in OpenTofu and Terraform, and what to skip.
5 min read
Delivery Workflows
Deploy to AWS from GitHub Actions with OIDC, no static keys
How to securely deploy to AWS from GitHub Actions using OIDC
6 min read
Start with the problem
Tell us what the estate looks like today.
A rough sketch of your accounts, networks, and how people get access is enough for a useful first conversation.