How is this different from your AWS, Azure & GCP service?

This page is the AWS technology we use inside products. The cloud service covers multi-cloud landing zones, migration, and platform work across AWS, Azure, and GCP. Start there when the engagement is the platform itself.

Which AWS services do you actually use?

The short list depends on the app. Common pieces are VPC networking, IAM, ECS or Lambda, RDS or Aurora for PostgreSQL, S3, CloudFront, and a CI role that can deploy. We do not add a service because it is on a diagram.

Can you work inside an existing AWS account?

Yes. We follow your landing zone, tagging, and change process. If the account has no guardrails, we propose the minimum — separate environments, IAM boundaries, and logging — before new workloads land.

How do you handle AWS cost?

Environments are tagged, non-production is smaller, and storage and data transfer are called out in the design. We review the bill drivers before the architecture hardens.

Do you use Terraform or CloudFormation?

Terraform or CDK for most greenfield stacks. We keep existing CloudFormation when that is already the team standard and changing tools would slow delivery.

Can you set up CI/CD into AWS?

Yes — GitHub Actions (or your runner) builds images, runs checks, and promotes digests into ECS/EKS or Lambda with environment-scoped roles.

How do you approach disaster recovery?

RPO/RTO are written down, backups are configured, and restore drills are scheduled. Multi-AZ and cross-region choices follow the SLA — not habit.

Do you manage AWS cost continuously?

Tags, budgets, and right-sizing reviews are part of the operating model. Non-prod schedules and idle cleanup prevent quiet bill growth.

AWS Cloud Development | Architecture & Delivery

AWS Cloud

Not a default stack.

Zupitrix designs AWS around the product: who deploys, where data lives, and what failure looks like. Compute, storage, identity, and delivery are chosen for that shape — then documented so the account is operable after handoff.

Start Project See workloads

AWS

IAM

ECS / Lambda

RDS

vpc.tfTerraform

module "landing" {
  source = "./modules/vpc"

  name               = "zupitrix-prod"
  cidr               = "10.20.0.0/16"
  azs                = ["us-east-1a", "us-east-1b"]
  enable_flow_logs   = true
  private_subnets    = 2
}

output "vpc_id" {
  value = module.landing.vpc_id
}

IAMLeast privilege by default

DataStores matched to access

ShipRepeatable deploys

CostVisible per environment

Workloads we land

Product shapes that run on AWS

Illustrative app shells — the kind of surfaces we host with clear IAM, networking, and deploys.

Ledger North

Signed-in finance UI on ECS + RDS with private ALB

SaaS

Parcel Track

Public tracking pages on CloudFront + S3 + Lambda

Edge

Clinic Desk

HIPAA-minded VPC, IAM roles, and audit logs

Health

Stream Shelf

Media origin in S3 with CloudFront signed URLs

Media

Ops Beacon

Status board fed by CloudWatch and EventBridge

Ops

Hire Pipeline

Next.js on ECS with Cognito and Secrets Manager

Code we write

IaC and pipelines, not click-ops

Terraform modules and GitHub Actions your team can extend — with owners attached.

ecs_service.tfterraform

resource "aws_ecs_service" "api" {
  name            = "zupitrix-api"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.api.arn
  desired_count   = 2

  load_balancer {
    target_group_arn = aws_lb_target_group.api.arn
    container_name   = "api"
    container_port   = 3000
  }
}

deploy.ymlactions

name: Deploy API
on:
  push:
    branches: [main]

jobs:
  ship:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build & push
        run: |
          docker build -t $ECR_URI:$SHA .
          docker push $ECR_URI:$SHA
      - name: Roll ECS
        run: aws ecs update-service --force-new-deployment ...

Architecture principles

AWS accounts, compute, data, and delivery shaped to the workload — with cost and ownership in the design.

Rules we design to — so the account stays operable after handoff.

01
Environments that differ on purpose
Dev, staging, and production are separate. Promotion is a pipeline, not a copy of one console setup. We document the approach, name owners, and attach acceptance checks so “Environments that differ on purpose” is reviewable in demos and durable after handoff.
02
Identity before resources
Humans and services get roles. Long-lived keys are the exception, with an owner and a rotation plan. We document the approach, name owners, and attach acceptance checks so “Identity before resources” is reviewable in demos and durable after handoff.
03
Data placed deliberately
Relational data, files, and caches use different stores. Backups and restore are tested, not assumed. We document the approach, name owners, and attach acceptance checks so “Data placed deliberately” is reviewable in demos and durable after handoff.
04
Delivery the team can repeat
Infrastructure and app deploys are in code or a documented pipeline. Click-ops is not the source of truth. We document the approach, name owners, and attach acceptance checks so “Delivery the team can repeat” is reviewable in demos and durable after handoff.

Deliverables

What leaves the engagement

Hosting, data, and edge — each with owners and acceptance checks.

Application hosting

Containers, serverless, or a managed Node/Next runtime with TLS, logs, and a rollback. We document the approach, name owners, and attach acceptance checks so “Application hosting” is reviewable in demos and durable after handoff.

Data platforms

PostgreSQL on RDS or Aurora, object storage, and the network path between them. We document the approach, name owners, and attach acceptance checks so “Data platforms” is reviewable in demos and durable after handoff.

Edge and delivery

CloudFront, DNS, and CI roles so releases do not depend on one engineer’s laptop. We document the approach, name owners, and attach acceptance checks so “Edge and delivery” is reviewable in demos and durable after handoff.

Runbook

How an engagement moves

A calm sequence from workload shape to an operable handoff.

01
Workload
Traffic, data class, and who operates production. Exit criteria and owners are written down before the next step starts.
02
Shape
Pick the few AWS services that match, and name what we will not use. Exit criteria and owners are written down before the next step starts.
03
Guardrails
IAM, networking, logging, and backup before feature traffic. Exit criteria and owners are written down before the next step starts.
04
Handoff
Diagrams, runbooks, and access the client team actually has. Exit criteria and owners are written down before the next step starts.
05
Harden
Validate budgets, failure modes, observability, and rollback before traffic. Exit criteria and owners are written down before the next step starts.
06
Handoff
Runbooks, access, and training so the client team can operate without us. Exit criteria and owners are written down before the next step starts.

Platform surface

What we put on AWS — and what links next

The service map we actually use, plus related engagements when the platform itself is the product.

Service map

AWS
IAM
ECS / Lambda
RDS
S3
CloudFront
Terraform
Docker
GitHub Actions
EKS

Linked services

AWS, Azure & GCP
Multi-cloud platform work beyond a single app. Share the journeys and constraints and we will map whether this engagement is the right fit.
Cloud Migration
Moving an existing system onto AWS. Share the journeys and constraints and we will map whether this engagement is the right fit.
Infrastructure as Code
The account and stacks described in code. Share the journeys and constraints and we will map whether this engagement is the right fit.

Outcomes

What we optimize for

Product and engineering goals we keep visible from the first slice through handoff — so velocity never quietly trades away quality.

IAMRoles over keys

TaggedCost by environment

IaCRepeatable deploys

Multi-AZWhere uptime needs it

OIDCCI without static keys

AlarmsOn-call wired

At a glance

Delivery facts

Typical timelines, coverage, and operating constraints we set expectations against before the build surface expands.

Topic	Value	Note
Landing zone	2–4 weeks	Typical baseline. Tracked against AWS delivery milestones.
Compute default	ECS or EKS	By ops maturity. Tracked against AWS delivery milestones.
Data default	RDS + S3	Access-pattern led. Tracked against AWS delivery milestones.
IaC	Terraform/CDK	Team standard. Tracked against AWS delivery milestones.
CI auth	OIDC	No static keys. Tracked against AWS delivery milestones.
Cost	Tagged	Budgets on. Tracked against AWS delivery milestones.

Ecosystem

Technologies that sit beside it

Real stack partners we wire into delivery with clear roles — not decorative logos on a slide.

AWS

Cloud platform — integrated deliberately into delivery with AWS.

Lambda

Serverless — integrated deliberately into delivery with Lambda.

ECS

Containers — integrated deliberately into delivery with ECS.

EKS

Kubernetes — integrated deliberately into delivery with EKS.

RDS

Managed Postgres — integrated deliberately into delivery with RDS.

S3

Object storage — integrated deliberately into delivery with S3.

CloudFront

CDN — integrated deliberately into delivery with CloudFront.

Terraform

IaC — integrated deliberately into delivery with Terraform.

Docker

Images — integrated deliberately into delivery with Docker.

GitHub Actions

Deploy CI — integrated deliberately into delivery with GitHub Actions.

Kubernetes

Orchestration — integrated deliberately into delivery with Kubernetes.

PostgreSQL

Data plane — integrated deliberately into delivery with PostgreSQL.

Integrations

Systems we commonly connect

CMS, identity, commerce, analytics, and edge services joined with typed contracts, webhooks, and ownership — not ad-hoc glue.

Route 53

DNS — integrated deliberately into delivery with Route 53.

ACM

TLS certs — integrated deliberately into delivery with ACM.

SQS

Queues — integrated deliberately into delivery with SQS.

SNS

Fan-out — integrated deliberately into delivery with SNS.

Secrets Manager

Secrets — integrated deliberately into delivery with Secrets Manager.

WAF

Edge protect — integrated deliberately into delivery with WAF.

Architecture

Layers we design explicitly

Boundaries, ops knobs, and rollback policy for each layer — so one team can change without rewriting everything.

Accounts & IAM

Org structure, roles, SSO, break-glass.

Org
SSO
SCPs

Network

VPC, subnets, endpoints, egress control.

VPC
TGW
Endpoints

Compute

ECS/EKS/Lambda fit to traffic shape.

ECS
EKS
Lambda

Data

RDS, S3, backups, encryption.

Edge & delivery

CloudFront, Route53, WAF, ACM.

Capabilities

What we actually deliver

Concrete workstreams with owners, acceptance checks, and a path for your engineers to extend after handoff.

Least-privilege IAM

Roles for humans and services — long-lived keys are the exception.

Environment separation

Dev, staging, and production promoted by pipeline, not console copy.

Cost visibility

Tags and right-sized non-prod before architecture hardens.

Infrastructure as code

Repeatable stacks — click-ops is not the source of truth.

Observability

Logs, metrics, and alarms wired to the people on call.

Migration paths

Lift with guardrails or rebuild when the workload demands it.

Network baselines

VPC patterns, private data planes, controlled egress.

Secrets discipline

Manager/SSM — never baked into images.

Backup & DR drills

Restores practiced, not assumed.

Patterns

Approaches we reach for

Reference implementations and conventions in the repo — so reviews reject one-off variants that bypass the agreed shape.

Landing zone first

Guardrails before product accounts sprawl.

Reference implementation of “Landing zone first” lives in the repo, not only slides.

Immutable promotions

Same artifact across environments.

Reference implementation of “Immutable promotions” lives in the repo, not only slides.

OIDC deploy roles

CI assumes roles — no static keys.

Reference implementation of “OIDC deploy roles” lives in the repo, not only slides.

Tag everything

Cost and ownership stay queryable.

Reference implementation of “Tag everything” lives in the repo, not only slides.

Private by default

Public only at intentional edges.

Reference implementation of “Private by default” lives in the repo, not only slides.

Alarm → human

Metrics without owners are decoration.

Reference implementation of “Alarm → human” lives in the repo, not only slides.

Industries

Domains we apply this in

Same technical playbook, different module depth — regulation, uptime, and partner APIs baked in early.