Managed Cloud Ops
& AWS Partner-Led Support

What's covered

• Service onboarding — secure access (SSM/Bastion/VPN) + CMDB build
• Runbook creation — SOPs for known issues (Disk Full, Service Down, etc.)
• Event management — thresholds, synthetic checks, alert dedup
• L2/L3 incident response — restart, scale, clean, RCA on P1
• Patch management — scheduled OS patching in maintenance windows
• Backup validation — periodic restore tests for RTO/RPO compliance

SLA & reporting

• TTA (Time to Acknowledge) and TTR (Time to Resolve) tracked per priority
• Live dashboard — see every action, alert, and ticket in real time
• Monthly review with named SDM, signed off by both sides
• "5 Whys" RCA PDF for every Major Incident with prevention plan

Tech stack

• Monitoring: Prometheus, Grafana, Datadog, CloudWatch, Zabbix
• Alerting: PagerDuty, OpsGenie
• ITSM: Jira Service Management (JSM), ServiceNow
• Access: AWS SSM Session Manager (no SSH keys to manage)

What's in the loop

• Tagging policy — CostCenter, Env, Owner enforced via AWS Config / SCP
• CUR analysis (Athena + QuickSight) — idle EBS, 24/7 non-prod, RDS waste
• Rate optimization — Compute SP vs Standard / Convertible RIs
• S3 lifecycle — auto-transition Standard → IA → Glacier by access pattern
• Trusted Advisor + custom checks — set as monthly governance
• Anomaly alerting — sudden cost spikes routed to Slack/Jira

What you get back

• Initial audit deck — top 10 wastes ranked by $/month
• Tagging compliance dashboard — % allocation, owners, drift
• Monthly cost report — actual vs forecast, anomalies, RI utilization
• Pricing options — flat fee or % of savings (your choice)

What's in scope

• Identity — IAM Identity Center (SSO), MFA enforcement, ABAC/RBAC policies
• Network — Security Groups, NACLs, WAF rules (SQLi/XSS), PrivateLink
• Encryption — KMS Customer Managed Keys, at-rest (EBS/RDS/S3), TLS 1.2+
• Audit — CloudTrail + VPC Flow Logs centralized to a tamper-proof S3 / SIEM
• Threat detection — GuardDuty, Security Hub, AWS Config rules
• Continuous evidence — runbooks for "300 audit questions in one week"

Frameworks & standards

• SOC2 Type I/II
• ISO 27001
• GDPR / HIPAA
• MiCA (EU crypto regulation) · VARA (UAE)
• PCI-DSS scoping

IaC layer

• Terraform / Terragrunt with remote state (S3 + DynamoDB locking)
• Modular structure: networking, compute, data, security as separate modules
• Drift detection + plan/apply gates wired into CI

CI / CD architecture

• CI: Lint → Unit → SAST (SonarQube) → Build → Trivy → Push (ECR)
• CD: Helm → EKS / OpenShift via ArgoCD GitOps (or push-based)
• DAST + image signing (cosign) for production-bound artifacts
• Observability baked in: Prometheus, Grafana, Loki, ELK

The four phases

• Discover — agentless scanning (AWS Application Discovery Service) maps deps, latency, DBs
• Land — Control Tower, multi-account OUs (prod / dev / sec), VPC + Transit Gateway
• Migrate — AWS MGN block-level for compute · DMS + SCT for databases (CDC enabled)
• Optimize — WAFR review (~$5k value), FinOps loop, observability rollout

Cutover playbook

• DNS TTL lowered 24–48h before
• Final data sync via DMS, validation queries
• Route 53 weighted records for canary traffic
• Rollback plan signed-off before go/no-go

What we deliver

• Infrastructure audit — automated config / version / EOL scanning
• Process mining — value-stream mapping from ticket to deploy
• Gap analysis vs reference architectures (AWS WAFR, ISO)
• Remediation backlog — Epics/User Stories prioritized by ROI & risk
• Architecture diagrams (Visio / draw.io) ready for board pack

Use cases

• Tech Due Diligence before a PE/VC investment decision
• Post-M&A integration into the buyer's tech ecosystem
• Annual IT audit (cost / capability / compliance gaps)
• Vendor / build-vs-buy decisions for the next 12 months

Migration scope

• JCMA execution — XML/JSON validation, app data, user mapping
• Workflow design — Workflow + Screen + Permission + Notification schemes
• Post-functions, validators, conditions — engineered, not glued
• Atlassian app re-licensing on Cloud (cost optimization included)

JSM & automation

• Request types + JQL-based SLAs + queues per team
• ScriptRunner — Groovy scripts for behaviors, listeners, REST integrations
• CMDB (Insight / Assets) — object schemas tied to runbooks
• Automation rules — escalation, smart linking, reminders

Cluster design

• Control Plane HA (etcd quorum), Worker sizing, ODF storage classes for stateful
• IPI (Installer Provisioned) or UPI (User Provisioned) on Bare Metal / vSphere
• SDN / OVN-Kubernetes networking, ingress design, MetalLB if needed
• Backup / DR strategy — etcd snapshots + ODF replication

Security & automation

• SCCs (Security Context Constraints) tuned per namespace
• RBAC integration with LDAP / AD, image-registry restrictions
• Ansible Tower / AAP — OS hardening (CIS), patching, cert rotation
• RHACS (Advanced Cluster Security) for runtime threat detection

Stage 1 — data plumbing

• ETL/ELT via AWS Glue + Lambda — pulls SQL, APIs, S3, SaaS sources
• S3 raw zone, then PySpark / dbt to curated zone (Iceberg / Parquet)
• Athena + Snowflake / Redshift for ad-hoc queries
• Lineage + data quality checks (Great Expectations or built-in)

Stage 2 — AI on top

• Vector embeddings stored in OpenSearch / pgvector / Bedrock KB
• RAG pipeline — prompt templates, context windows, guardrails
• Amazon Q Business for internal "ask the company" use cases
• Bedrock Claude / Sonnet for structured generation tasks

Live KPIs (last 30 days)

Activity timeline (last 24h)

• 02:14 — auto-scaled prod ASG +2 nodes, traffic spike from EU launch
• 04:08 — rotated TLS cert on api.example.com (no downtime)
• 09:31 — applied OS patch CVE-2026-0871 to 14 instances
• 11:45 — moved 380 GB of cold data S3 Standard → Glacier (saved $42/mo)
• 14:02 — P3 incident: RDS slow query, mitigated via index hint, RCA scheduled
• 17:50 — backup restore drill on staging-db-3, RTO 7m / RPO 4m — pass

What you don't see today (and will)

• Silent fixes — config drifts auto-corrected before they break anything
• Background patching — what / when / why, with rollback path
• Cost anomalies caught before they show up on the bill
• Backup & DR drills run on schedule, not "next time we have time"
• Compliance evidence collected and stamped, ready for the next audit

Supported migrations

• MySQL → MariaDB (mostly drop-in, validation focused on engine quirks)
• Oracle → MariaDB (schema conversion via SCT, PL/SQL → stored procs)
• Aurora MySQL → MariaDB (when Aurora pricing stops making sense)

Cutover plan

• SCT runs schema + code conversion, manual review of unsupported items
• DMS full-load + CDC runs in parallel until tail lag < 1 sec
• Read-only window opened on source, final CDC drain, app re-pointed
• Source kept warm for 7–14 days as rollback insurance