Service
AWS Cloud Infrastructure with Terraform
Your AWS estate — reproducible, auditable, and safe to change.
Click-ops infrastructure is technical debt with a production blast radius. When your AWS estate is a mix of manually created resources, one engineer's tribal knowledge, and a bill that surprises you every month, you're one mistake away from a very bad day. I migrate AWS infrastructure to Terraform — properly, not just wrapping existing resources in HCL. That means a modular structure your team can maintain, remote state with locking, CI/CD for infrastructure changes, a security baseline that passes audits, and cost visibility so you know what you're spending and why.
Who this is for
- Startups with AWS infrastructure that was "just spun up quickly" and never formalised
- Engineering teams where only one person knows how the infrastructure was set up
- Companies receiving AWS bills that are higher than expected with no clear breakdown
- Teams preparing for SOC 2, ISO 27001, or enterprise customer security questionnaires
- CTOs who want to move faster on infrastructure without breaking production
What you get
Terraform codebase
Modular Terraform code in a structure your team can navigate — environment directories, reusable modules, and clear variable boundaries. No Terraform anti-patterns.
Remote state and locking
S3 backend with DynamoDB locking. State encryption at rest. Separate state files per environment to isolate blast radius.
Infrastructure CI/CD
Atlantis or GitHub Actions workflow for infrastructure PRs: terraform plan on every PR, apply on merge. No manual terraform apply in production.
Security baseline
VPC with private subnets, security groups scoped to minimum required, IAM roles with least-privilege policies, CloudTrail enabled, S3 public access blocked, GuardDuty active.
Cost dashboard
AWS Cost Explorer configured with tags for cost allocation. Budget alerts for unexpected spend spikes. Right-sizing recommendations for over-provisioned resources.
Architecture documentation
Network topology diagram, service dependency map, and runbooks for common operations (scaling, rotating credentials, disaster recovery).
How it works
Infrastructure audit
2–4 daysI inventory your existing AWS resources, identify what's manually managed, review IAM policies for over-permissive roles, and produce a risk assessment.
Architecture design
3–5 daysVPC design, account structure recommendations, module architecture, and migration strategy — documented before any Terraform is written.
Terraform import and codification
1–3 weeksExisting resources imported into Terraform state. New resources created in code. Drift between code and reality eliminated.
Security hardening
3–5 daysIAM policies reviewed and tightened. Security groups audited. Encryption at rest and in transit verified. AWS Config rules deployed for continuous compliance.
CI/CD for infrastructure
2–3 daysTerraform workflow automated. Plan on PRs, apply on merge. Notifications for apply failures and drift detection.
Cost optimisation
2–3 daysReserved instances and savings plans analysis. Right-sizing recommendations. Unused resources identified and removed.
Pricing
Infrastructure migrations are scoped per-project: a typical AWS estate codification with security hardening runs £3,500–£9,000. Cost optimisation engagements are often day-rate (2–5 days) since the scope depends heavily on what we find. I provide Infracost estimates so you can see the projected cost impact before committing.