Cost breakdown by workload
Not the Cost Explorer chart you already have. Spend mapped to the thing that caused it, with the idle resources named.
Assessment
AWS Well-Architected Review
Two weeks inside your account. At the end you get a ranked list of findings with the cost, the effort and the blast radius next to each one, so you can decide what is worth doing.
2 weeksFixed feeSix pillarsWritten report
What is an AWS Well-Architected Review?
An AWS Well-Architected Review is a structured read of a workload against the six pillars AWS publishes: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. It ends in a written list of findings, each with the cost to fix, the effort and what breaks if you leave it.
The problem
Most reviews end in a PDF nobody opens
The AWS tool generates a long list of high-medium-low findings with no idea which ones matter to your product. We do the reading, then throw away the items that do not apply to you. What is left is short enough to actually work through, and each line says who has to do it and roughly how long it takes.
2 wks
start to report
6
pillars covered
1
engineer, named
0
agents installed
What you get
Included in the engagement
IAM and network exposure
Every role with wildcard permissions, every security group open to the internet, every key that has not rotated.
Failure analysis
What breaks first at three times current traffic, what has no backup, and what has a backup nobody has ever restored.
Reliability and recovery targets
Where your actual RTO and RPO sit versus what the business assumes they are. These two numbers are usually the surprise.
A ranked remediation plan
Effort, cost and risk against each item, so you can hand it to your team or hand it back to us.
How it runs
How the review runs
Two weeks, in this order. You see findings as they land rather than all at once at the end.
Access and scope
A read-only role into the accounts in scope, plus an hour with whoever knows the workload. We agree what is in and what is deliberately out.
Automated read
The Well-Architected Tool, Trusted Advisor, Config and Cost Explorer run first, so the machine-findable problems are found by a machine.
Manual read
Where the tools stop: IAM policies against ninety days of actual use, network paths, the restore nobody has tested, the single points of failure a checklist skips.
Ranking
Every finding gets a cost to fix, an effort estimate and a blast radius. Anything that does not apply to your product is deleted, not downgraded to low.
Readout
Two hours walking the ranked list with your team, then the written report. You leave with the first three items scoped well enough to start.
Fit
Who this is for
If none of these sound like you, say so on the call and we will tell you honestly whether this is the right piece of work to start with.
- You inherited an AWS account and nobody who built it still works here.
- Your bill grew faster than your traffic and nobody can say why.
- A customer or auditor is about to ask questions you cannot answer yet.
Do you need production access?
Read-only access is enough for the review itself. We use a cross-account role you create and can revoke, and we tell you before we look at anything that touches customer data.
What if we do not like the findings?
You keep the report either way. It is a fixed fee and there is no obligation to have us do the remediation. Several clients have taken the list to their own team and just called us for the hard parts.
How long does a Well-Architected Review take?
Two weeks from access to report for a single workload. Larger estates with several accounts take longer, and we tell you the number before starting rather than discovering it halfway through.
Which six pillars does the review cover?
Operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. Every finding is filed under one of them, and the ones that do not apply to your product get dropped rather than padded out.
What do we actually get at the end?
A written report with a ranked remediation list, cost and effort against each line, the current spend broken down by workload, and a walkthrough call with the engineer who did the reading.
Do you use the AWS Well-Architected Tool?
We use it as a checklist, not as the deliverable. The tool produces high-medium-low findings with no view of what matters to your product, so the judgement about which ones to keep is ours and it is the part you are paying for.
How often should a review be repeated?
Once a year for a stable system, or after anything that changes its shape: a large customer, a new region, a migration, a funding round that changes the traffic assumptions.
Reference
The AWS documentation we work from
Related
Work that usually comes with this
Compliance and security
IAM cleanup, encryption, audit trails and the evidence collection that turns a SOC 2 or ISO 27001 questionnaire into a short afternoon.
SecurityRead more
DevOps and platform
Terraform, deployment pipelines and environments that rebuild from code. Deploys a new hire can run in their first week without supervision.
PlatformRead more
AWS migration
Data centre, another cloud, or a half-finished migration someone else started. We plan the cutover, rehearse it, and keep the rollback usable.
MigrationRead more
Send us your AWS bill
Thirty minutes with an engineer, no slide deck. We will tell you what we would change first and what it would cost to have us do it.