Cloud Infrastructure (AWS & GCP)
Account setup, a sane architecture, least-privilege IAM, and a cost model — so your cloud does not become a liability.
Run
A cloud account that grew organically is a security and billing risk. I set up (or clean up) AWS and GCP with a clear account structure, locked-down access, private networking, and a cost model you can actually forecast.
- Account / project structure: separate prod and non-prod, billing consolidated
- Least-privilege IAM: roles not users, SSO where possible, no long-lived keys
- Network baseline: private subnets, controlled egress, no public databases
- Secrets in a managed store (Secrets Manager / Secret Manager), never in env files or repos
- Logging, audit trail, and budget alerts wired to email/Slack
- A written architecture doc and a month-by-month cost estimate
Structure first
Production and everything else get separated — different AWS accounts or GCP projects — so a mistake in staging cannot touch real data or customers. Billing rolls up to one place with per-environment tags so you can see where the money goes.
Access that a security review will not flag
Humans log in through SSO and assume roles. Machines use workload identity or short-lived tokens. Long-lived access keys are removed. Every privileged action lands in an audit log.
Cost you can predict
You get a spreadsheet mapping each component to its pricing dimensions and an estimate at low, expected, and high traffic — plus budget alerts so a runaway resource pages you before the invoice does.
FAQ
Have a project in mind?
Tell me what you are building. You get a scoping call and a fixed quote — no obligation.