AWS consulting for Product Teams
An AWS foundation that stays secure, reliable and affordable, without a full-time cloud engineer.
I find the gaps in your AWS infrastructure, in security, cost waste, observability and account drift, fix them, and hand back infrastructure as code that stays in your accounts. You finally get back to building the product.
30 minutes, no commitment. You leave with a roadmap for your AWS infrastructure.
Engine WorksAssessment › prod-account › Discovery
Account assessment
Checked against the AWS Well-Architected Framework and the CIS AWS Foundations Benchmark
- 1✓Discovery call
- 2✓Map what is running
- 3✓Check against the standards
- 4✓Walkthrough and plan
We start with a free 30-minute call about your setup, requirements, constraints, and what worries you.
Next, I map everything running in your accounts: the services, how they connect, and where the money goes each month.
Then I check it all against the Well-Architected Framework and the CIS Benchmark, and rank every finding by the risk it carries for you.
EC2.19 Security group open to the internet on port 5432IAM.6 No hardware MFA on the root userCloudTrail.1 No trail across all regionsRDS.3 Database not encrypted at restFinally, we walk through the plan together: the three fixes to make first, the full list, and a fixed quote for the work. Take the quote, or hand the plan to your team.
$350, fixed
Your AWS account checked for security gaps, cost waste, observability and drift; if the plan is not useful, you do not pay.
Report in 1 week
A detailed assessment report with findings ranked by risk and severity, and a fix for each one.
Deliver fixes as code you own
I ship the fixes as pull requests to your repo. No lock-in.
How silent cloud creep starts
How an AWS infrastructure drifts over time
AWS rarely breaks in one day. It drifts: environments multiply, nobody owns the account, and cost and security problems pile up where no one has time to look.
Phase 01
The Solo Architect Symphony
Teams rush to ship, and AI coding tools make the app real in weeks. One AWS account gets set up in a hurry, and its foundation is skipped. The app runs, everyone is thrilled, and the cloud feels like an extension of one developer’s laptop.
Phase 02
The Velocity Blindspot
Sales pick up, the team grows, and more dev and staging environments appear. To keep momentum, engineers spin up unmanaged EC2 instances, EBS volumes and NAT Gateways by hand. Owning the infrastructure feels like a distraction that would slow features down.
Phase 03
The Sprawl Trap
Nobody owns the account, so abandoned instances, unattached volumes and unmonitored NAT Gateways cost thousands a month. Enterprise deals stall on security questionnaires the team cannot answer. Passing SOC 2 means months of feature freeze, and new hires lose weeks because the architecture lives only in the early developers’ heads.
What it costs
Financial
- Cloud waste. Thousands a month on idle EC2 instances, unattached EBS volumes and unmonitored NAT Gateways.
- Shrinking margins. Running costs eat into the revenue from each new sale.
Sales and revenue
- Stalled pipeline. Enterprise deals lost to security questionnaires (SIG, VSAQ) the team cannot answer.
- Compliance roadblocks. SOC 2 out of reach without stopping the business.
- Roadmap paralysis. Months of feature freeze to inventory and clean up the sprawl.
Security and operations
- A bigger attack surface. Unpatched, unwatched, forgotten instances open to the internet.
- Fragile infrastructure. So complex and undocumented that nobody dares change or delete anything.
Team and culture
- Onboarding gridlock. New engineers stuck for weeks, unable to run the system locally.
- Tribal knowledge. Everything depends on the early developers, because the architecture lives only in their heads.
How we fix it
From the first call to a foundation in your repo
The intro call is free. The assessment is one fixed price, $350. Every project has its own requirements, so the scope of the work that follows is set by the assessment, and the price is confirmed in writing before any work starts.
Step 01 · Free, 30 minutes
Intro call
Your setup, what I see, what I would do first
We review how your AWS environment is set up today and where it has drifted from what the team needs. I recommend whether the assessment fits, confirm its fixed price, and you leave with a short written roadmap.
Step 02 · $350, fixed, one week
Assessment
What is running, where the risk sits, what to fix first
With a time-limited, read-only IAM role you create, I check the account against the AWS Well-Architected Framework and the CIS Benchmark and write the plan: the findings ranked, the first three fixes, and a fixed quote for the work.
Step 03 · Roadmap and fixes
Walkthrough call
Every finding explained, then a roadmap you own
I walk your team through every finding in the assessment and hand over a roadmap your engineers can implement without me. Or I implement it: each fix as a pull request in your repo, under an IAM role you create and can see, with nothing merged until you approve it.
Ali M.zadeh
Founder and cloud engineer, Cloud Engine Works
Top Rated Plus on Upwork · 100% job success · 700+ hours
Who does the work
I'm Ali M.zadeh. I have spent six years putting applications on AWS for different companies, most often as the lead cloud engineer. Throughout my experience, I have seen the same patterns in account after account: access granted once and never reviewed, resources nobody owns, deploys run by hand in the AWS Console.
My work starts where most teams' attention ends: the infrastructure under the product. You will not be handed to a junior or an account manager. I am the engineer who assesses your account, explains the findings and writes the fixes. I deliver the fixes as infrastructure as code, so the result can be read, reviewed and maintained by your own team.
I take responsibility for the whole path: the assessment, the plan, the code and the documentation. When the work is done, your engineers can run it without me.
Questions people ask before the call
What happens on the 30-minute call?
We review how your AWS environment is set up today, what worries you, and where it has drifted from what the team needs. I give you my view of what to fix first, recommend whether the assessment fits, and confirm its fixed price. You leave with a short written roadmap either way.
Is the assessment really money-back?
Yes. If the written plan is not useful to you, you do not pay. You decide, and you keep the plan either way.
What do you check my account against?
Two published standards: the AWS Well-Architected Framework (the Security, Reliability and Operational Excellence pillars) and the CIS AWS Foundations Benchmark, with the AWS Foundational Security Best Practices controls. The review record is created in your own account, so you keep it and can re-run it. The plan names every finding by its control.
What access do you need?
For the assessment, a time-limited, read-only IAM role you create, with only the permissions the review needs, and nothing that can change your account. All activity is logged in your own CloudTrail, and the access is removed as soon as the assessment ends. No long-lived credentials are ever created. I sign your NDA first if you want one.
Is this a security audit?
No. Security is one part of it. The plan covers access, backups, monitoring, deploys and cost: the things that take a system down, lock a team out or quietly grow the bill. It is not a penetration test and not a compliance attestation.
Will this help us with SOC 2 or a customer's security questionnaire?
Yes, as preparation. The checks overlap with the technical controls those reviews ask about, such as access, logging, encryption and network isolation, and the plan shows where you stand on each. It does not replace the audit itself, and I do not certify anything.
What do I own at the end? Can my team run it without you?
Everything. I deliver the work as pull requests with full documentation, so all of it lives in your own repository and your own account. Your team, or any AWS engineer, can pick it up without me. If you want me to fix the findings, you get a fixed-price quote after the assessment, and taking it is optional.
How do you price the work after the assessment?
The assessment is one fixed price, confirmed on the intro call. The work after it gets a fixed quote in writing, from the assessment, before anything starts. There is no price list for the build, because every project has its own requirements.
Book a free 30-minute intro call
We look at your AWS setup together and I recommend the right next step. If an assessment is not the right fit, I tell you.
You talk to Ali M.zadeh, the engineer who does the work. Pick a time and I confirm it by email.
What you leave with
- My view of your setup and what to fix first
- Whether the assessment fits, and its fixed price
- A short written roadmap, whether we work together or not
Free, no commitment. Leave with a roadmap. Fully confidential.