Landing zone design
Subscription and resource-group topology, naming, tagging, policy and budget guardrails set before the first workload arrives.
Information technology consulting
Cloud architecture & migration
Cloud landing zones, identity, networking and migration, designed with a cost estimate attached, built from code, and cut over on a date you chose rather than one an incident chose for you.
The situation
Cloud bills nobody can explain
Two patterns turn up repeatedly. The first is an estate that grew by clicking: resources created by hand, no naming convention, permissions granted individually, and no way to rebuild any of it. The second is a lift-and-shift that moved the servers but none of the assumptions, and now costs more than the data centre did.
Both are fixable, and neither is fixed by a tool purchase. It takes a design that someone can defend, expressed as code that someone can review.
Scope
What the work includes
Identity and access
Identity groups, role assignments and least privilege, so leavers lose access by leaving a group, not by memory.
Network architecture
Virtual networks, private endpoints and egress paths documented in a diagram that matches reality.
Infrastructure as code
Terraform in Git, with pull-request review and a pipeline that plans before it applies.
Migration sequencing
Workloads ordered by risk and dependency, each with a rehearsed cutover and a written rollback.
Cost model
An estimate before the build and a review after, including the reserved-capacity and right-sizing decisions worth making.
Architecture
What we actually stand up
The landing zone we build for a team without a platform group. Everything here is expressed as code you own; the parts drawn with a dashed edge are deliberately deferred until something in your business asks for them.
Built in the first engagement
Deferred until it is needed
Where the boundary is enforced
- Edge
- One public entry point with rules you can read, so there is a single place to answer "what is reachable from the internet".
- Platform hub
- Outbound traffic, name resolution and administrative access live here, shared once rather than rebuilt per workload.
- Workload spoke
- Your application and its data, reachable privately. A second workload gets its own spoke instead of being squeezed into this one.
- Cross-cutting
- Identity, secrets and logs are wired in from the first deployment. Retrofitting these is the expensive kind of rework.
100%
Of delivered infrastructure defined as reviewable code
1
Rehearsed cutover before the real one
0
Resources created by clicking in the portal
Deliverables
What you are left holding
Every engagement ends with artefacts you own outright, whether we continue together or not.
- Architecture decision records
- Infrastructure-as-code repository
- Migration runbook with rollback steps
- Cost baseline and optimisation list
Typical stack
What we build it with
Chosen for support horizon and hiring pool, not novelty. If your team already runs something equivalent, we will use yours.
TerraformKubernetesLanding zonesManaged identityCost monitoring
Questions
What clients ask first
Will you tell us to move everything to the cloud?
No. Some workloads are cheaper and calmer where they are, and we will put that in writing. What we will not accept is not knowing which category a system falls into.
How do you handle a migration with no downtime window?
By designing for parallel running: the new path is live and verified against the old one before anything is switched, and the switch itself is reversible.
Can you work alongside our internal team?
That is our preferred arrangement. We would rather leave behind a team that can operate the platform than a dependency on us.
Related
Usually needed alongside
Reliability & security engineering
Observability that answers questions, alerts worth waking up for, pipelines that refuse bad builds, and secrets kept…
See detailsWorkflow & process automation
The recurring manual work that consumes a week every month, rebuilt as durable jobs that log what they did, recover…
See detailsData engineering & integration
Getting data out of the systems holding it hostage and into one place that can be queried and trusted, with schema…
See detailsGet started
Is this the problem you have?
Describe it in three sentences and we will tell you what the first two weeks would look like.