Reviews and assessments
Cloud platform uplift
Hands-on remediation for AWS and Azure platforms that have grown faster than their foundations. The work brings identity, guardrails, encryption and governance up to the standard your auditors and customers expect, without stopping delivery.
Who it is for
This is for organisations with a multi-account AWS estate or an Azure tenancy that works but worries people. Common triggers are an audit finding, a security review, a failed customer questionnaire or a platform team that has lost key staff.
What the work covers
- Account and landing zone structure, including AWS Organizations and Control Tower.
- Identity, including IAM Identity Center single sign-on, role design and the removal of long-lived access keys.
- Preventive guardrails through service control policies.
- Encryption and secrets, including KMS key strategy and Secrets Manager.
- Detective controls, including AWS Config, Security Hub, GuardDuty and CloudTrail.
- Infrastructure as code with Terraform, deployed through CI/CD pipelines and not through consoles.
- Tagging, ownership and governance standards.
What you get
- A baseline assessment and a prioritised remediation backlog.
- Changes delivered as reviewed infrastructure as code in your repositories.
- Documentation and runbooks that your team can operate from.
- Knowledge transfer to your engineers throughout the work.
How it runs
Uplift work runs as a regular commitment of a day or two a week, or as a fixed block of work against an agreed backlog. Changes go through your change process and your pipelines.
Common questions
What is a cloud platform uplift?
A platform uplift is remediation work on the foundations of a cloud environment. It covers account structure, identity, guardrails, encryption, logging and governance, and it brings an environment that grew organically up to a standard that can pass an audit and scale safely.
Will the work disrupt production?
Changes are staged, deployed through pipelines and rolled out account by account, starting with non-production. Preventive controls such as service control policies are tested against real usage before they are enforced.
Do you work with Azure as well as AWS?
Yes. The same approach applies to Azure tenancies, including Entra ID, management groups, Azure Policy and Key Vault.