Cloud Infrastructure

Cloud account setup and foundational architecture on AWS, Google Cloud and Microsoft Azure — account structure, identity and access management, network architecture, core services configuration and billing controls. Getting the foundations right before any application is deployed.

• Cloud account structure: management account, workload accounts per environment
• IAM roles and policies following least-privilege principle
• Virtual private cloud (VPC) with public, private and data subnets
• Security groups and network access control lists
• Billing alerts and budget controls to prevent surprise costs
• AWS region or GCP zone selection for EU data residency compliance
• Core services: compute, database, storage, load balancer, DNS
• Initial security baseline: MFA, CloudTrail/audit logging

Hetzner Cloud setup for cost-effective, EU-hosted infrastructure — popular with German and European businesses for its competitive pricing and GDPR-friendly data centres in Germany and Finland. Configured with the same rigour as hyperscaler setups: firewall rules, private networks, load balancers and object storage.

• Hetzner Cloud project setup with network and firewall configuration
• Server sizing: shared CX, dedicated CCX or ARM CAX instances
• Private network for internal service communication
• Hetzner Load Balancer for high-availability setup
• Hetzner Object Storage (S3-compatible) for file storage
• Managed database or self-managed with backup automation
• German or Finnish data centre selection for data residency
• Hetzner Cloud API integration for automated provisioning

Infrastructure as code with Terraform — defining the entire cloud environment in version-controlled configuration files so it can be reproduced exactly, modified safely and rolled back if a change causes problems. No more undocumented manual console changes.

• Terraform module design for reusable infrastructure components
• State management with remote backend (S3, Terraform Cloud)
• Terraform workspaces for multi-environment management
• Plan and apply workflow in CI/CD pipeline
• Resource drift detection and correction
• Terraform Cloud or Atlantis for team collaboration and PR review
• Provider coverage: AWS, GCP, Azure, Hetzner, Cloudflare
• Infrastructure documentation generated from Terraform code

Network architecture and security configuration that follows the principle of least privilege — applications in private subnets, databases inaccessible from the internet, traffic flowing through load balancers, and all access controlled by security groups and firewall rules.

• VPC and subnet architecture: public, private, data tiers
• Security groups: inbound and outbound rules per service
• Application load balancer in public subnet terminating TLS
• Application servers in private subnet: no direct internet access
• Bastion host or VPN for operator access to private resources
• WAF (Web Application Firewall) configuration
• DDoS protection via CloudFront, GCP Armor or Azure Front Door
• Certificate management: ACM/LetsEncrypt with auto-renewal

Cloud cost optimisation — analysing actual resource usage, removing waste, right-sizing over-provisioned instances, implementing reserved instances for predictable workloads and setting up auto-scaling so the business only pays for what it uses.

• Cost analysis: breakdown by service, environment and team
• Right-sizing: identify and resize over-provisioned instances
• Reserved instance or savings plan purchase for steady workloads
• Spot or preemptible instances for batch and background workloads
• Auto-scaling configuration: scale down during low-traffic periods
• Storage lifecycle policies: move infrequently accessed data to cheaper tiers
• Dev and staging environment scheduled shutdown outside business hours
• Cost tagging and chargeback reporting by project or department

Multi-environment infrastructure for development, staging and production — each environment isolated, production-like in configuration and provisioned from the same infrastructure-as-code definitions so that what is tested in staging is what is deployed to production.

• Development, staging and production environments fully isolated
• Environment parity: same services, same configuration, different data
• Environment-specific secrets management (AWS SSM, Vault)
• Automated environment provisioning from IaC for new features
• Preview environments for pull request testing
• Environment promotion pipeline: dev → staging → production
• Environment cleanup: remove unused feature branch environments automatically
• Cost controls per environment: development smaller than production