Founder-led AWS engineering
We install the production-grade AWS substrate, ship your app on it, and hand you the IaC. Six weeks for the hardened foundation. Two weeks for an additional app. You go back to building the product.
What we ship you is what we run. Hardened by years of production, not a weekend of vibes.
Two areas of work — the infrastructure underneath and the code that runs on it.
The AWS spine.
A hardened organization foundation: multi-account Organization with delegated Audit and Log-Archive, IAM Identity Center with least-privilege Permission Sets, a 3-tier VPC, CloudTrail + AWS Config baseline, governance SCPs and Tag Policies at the org root, and a battle-tested Terragrunt module-and-live IaC structure with the CI/CD chain already wired.
Read what's in Platform EngineeringThe inside of the repo, productized.
A modular SaaS monorepo: backend API and client-side frontend, Clerk authentication, Stripe integration, LLM integration for tasks and assistants, LLM billing, design patterns for easy extensibility, database migrations, scheduled and async-job patterns, SEO-optimized public pages, observability with alarms, and complete CI/CD pipelines — local environment up in 50 seconds.
Read what's in Software Engineering30 minutes with the founder. A 1-page PDF in your inbox within two business days. Eight dimensions, scored against the controls a production AWS account should clear.
Organization layout, workload separation, Log Archive isolation, CloudTrail centralized at the org level.
IAM Identity Center, root-account hygiene, MFA enforcement, permission-set design.
SCPs, RCPs, AWS Config rules and automatic remediations — the layer that blocks non-compliance before Security Hub sees it.
Module-and-live split, default_tags discipline, state-backend hardening, pre-commit chain, and who-can-apply controls.
VPC layout, subnet tiering, public-subnet exposure, NAT and endpoint posture, per-workload security-group isolation.
S3 public-access block, ALB TLS posture, CloudFront origins, public ECR, GitHub OIDC exposure.
Security Hub, GuardDuty, AWS Config, CIS 4.x metric-filter alarms, and the application-level alarms wired to act on their findings.
GitHub OIDC roles, ARN-scoped policies, branch protection, IaC plan-and-apply path.
We will be honest about whether you need us. If the gap is small enough that one of your engineers can close it in a Friday afternoon, we will say so on the call.
Each dimension scored pass / partial / gap. The PDF surfaces your three highest-leverage gaps.
The patterns above are written up in deep-dives — architecture choices, the tradeoffs, the things we got wrong the first time.
The seven accounts every production workload actually needs, and why we pull the Log Archive / Audit pair out by hand instead of letting Control Tower own them.
ARN-scoped GitHub OIDC trust policies that survive a credential leak by construction. The IAM policy is shorter than the YAML around it.
Why "claim then side-effect" is the only worker pattern that survives a crash mid-run, and how the Postgres advisory-lock variant compares to SQS visibility timeouts in practice.
Two product areas — Platform Engineering covers the AWS spine, Software Engineering covers the inside of the repo. Individual products at fixed prices; most engagements combine two or three. The repository and code is yours from day one.
| Capability | Platform Engineering | Software Engineering | ||
|---|---|---|---|---|
| Product | Core | Core+ anchor | Container Platform — ECS | App Bootstrap |
| Price · Time | $18,000 4 wk | $32,000 6 wk | from $14,000 4–6 wk | $38,000 5 wk |
| Everything coded — full source repository delivered to your GitHub org | included | included | included | included |
| AWS Organization + Audit / Log Archive accounts + Delegated Admins | included | included | not included | not included |
| Base SCPs + Permission Sets + Billing Alerts | included | included | not included | not included |
| 3-tier VPC + NAT Gateway + VPC Endpoints + VPN | included | included | not included | not included |
| CloudTrail centralized + Log Archive centralized + Athena log queries | included | included | not included | not included |
| AWS Config (org-wide) + cost-tuned recording | included | included | not included | not included |
| Security Hub + AWS FSBP/CIS conformance packs | not included | included | not included | not included |
| GuardDuty + Inspector + IAM Access Analyzer | not included | included | not included | not included |
| Security SCPs + Guardrails SCPs + AWS Config auto-remediations | not included | included | not included | not included |
| Terraformed GitHub + agent-agnostic AI skills + onboarding CLI | not included | included | not included | not included |
| ECS base infra — Route53, ALB, Certificates, Cluster | not included | not included | included | not included |
| Backend infra — ECR, ECS Services, AutoScaling, Secrets, Alarms | not included | not included | included | not included |
| Frontend infra — CloudFront, S3 buckets | not included | not included | included | not included |
| Async infra — Queues, async workers, scheduled jobs | not included | not included | optional add-on | not included |
| Data infra — RDS, RDS Proxy, DynamoDB, S3 | not included | not included | optional add-on | not included |
| Production-ready multi-tenant SaaS app — see scope below for the full stack | not included | not included | not included | included |
| Learn more | See scope | See scope | See scope | See scope |
included optional add-on not included
Plain email. No marketing reply, no scheduling tool, no funnel. Tell us what you're shipping and we'll tell you whether we're the right fit.