AWS Architecture Consulting

Five usual culprits: idle/stopped EBS volumes still billing, NAT Gateway egress (especially with cross-AZ traffic), oversized RDS instances, S3 storage class misalignment (Standard for cold data), and unattached Elastic IPs. A 1-week cost audit typically finds 20–40% in low-risk savings without touching architecture.

Workload-by-workload. Lambda + API Gateway is a fit for spiky, low-throughput, stateless work — and a poor fit for sustained traffic, long-running tasks, or anything cold-start-sensitive. ECS Fargate is the boring middle option that wins more often than people think. We avoid prescribing one answer; we measure and decide.

Terraform for most engagements (best ecosystem, mature). CDK if your team is heavily TypeScript and wants to stay in code rather than HCL. CloudFormation only when something else doesn't support a service yet. We write modules with explicit inputs/outputs and pin provider versions — no untyped vars, no implicit defaults.

AWS Organizations + AWS Control Tower as the baseline. Separate accounts for prod/staging/dev/sandbox/security at minimum. Cross-account access via IAM Identity Center (formerly SSO) with permission sets, not long-lived users. We refuse to share root credentials and won't create them.

Yes — we've shipped under all three. Standard controls: AWS Config rules for compliance drift detection, GuardDuty for threat detection, KMS-encrypted everything, dedicated logging account with immutable storage, runbooks for incident response. We'll work alongside your auditors and the GRC team owns the final attestation.

Pragmatically — pure cloud-agnostic abstractions are expensive and rarely pay off. We use AWS-native services where they're best (Lambda, S3, DynamoDB) but keep critical business logic portable: containers over Lambda when portability matters, standard SQL over Aurora-specific extensions, etc. The honest answer is some lock-in is fine; document it explicitly so the trade-off is conscious.