For teams on AWS — or moving to it — who need production-grade infrastructure skills without hiring a platform team. We design, fix, automate and hand over, working directly in your account and your repositories.
Most AWS problems trace back to a foundation that was clicked together in a hurry. We design account structure, VPCs and IAM up front and deliver them as reproducible code, so every environment is identical and every change is reviewable.
Separate production, staging and tooling, with consolidated billing and guardrails.
Public, private and isolated tiers sized for growth, with routing that's easy to reason about.
Roles instead of long-lived keys, least-privilege policies, and no shared admin users.
Terraform, CloudFormation or plain boto3 — whatever your team will actually maintain.
Databases and application servers don't belong on public IPs. We move workloads into private subnets, give your team secure access over VPN, and keep AWS services reachable without routing everything through costly NAT gateways.
Application and data tiers with no inbound internet path at all.
WireGuard or AWS Client VPN, so engineers reach internal services without bastion sprawl.
Private access to S3 and other AWS services, often cutting NAT data charges significantly.
Rules rebuilt around roles rather than IP lists nobody remembers adding.
PostgreSQL can carry far more than most teams ask of it. We set up replication and pooling, design schemas that don't need migrating every quarter, and replace slow procedural code with set-based SQL that scales with your data.
Streaming replicas, failover, and read/write routing sized to your workload.
PgBouncer or RDS Proxy, so traffic spikes don't exhaust database connections.
UUID keys, JSONB for extensibility and row-level security for multi-tenant isolation.
Query plans, indexing and set-based rewrites for your heaviest workloads.
Backups being "enabled" is not a recovery plan. We set up continuous archiving and point-in-time recovery, automate restore tests, and run a timed disaster-recovery drill so you know your real recovery point and recovery time.
Continuous WAL archiving to S3 or RDS PITR, configured and verified.
Scheduled restores into a scratch environment, with alerts when one fails.
A full recovery executed and timed, giving you measured RPO and RTO figures.
Step-by-step recovery procedures your on-call engineer can follow at 3am.
Security reviews often stop at a checklist. We go through the whole path a request takes — edge, TLS, firewall, application auth, IAM — and fix what we find. Useful before a customer security questionnaire, an audit or a funding round.
TLS automation, rate limiting and request filtering, with AWS WAF or a self-hosted alternative.
OAuth, magic-link or SSO login and role-based access built into your applications.
Unused permissions, wildcard policies and long-lived keys found and removed.
Risks ranked by impact, each with a concrete fix and an executive summary.
If a deployment needs one specific person and a checklist, it's a risk. We build pipelines and machine images so servers can be rebuilt from scratch in minutes and every release can be rolled back.
Versioned artifacts built once and promoted between environments.
Baked AMIs with cloud-init, so new instances are ready on first boot.
Every release recorded, and the previous version one command away.
Environment config and secrets managed centrally, never committed to git.
You can't fix what you can't see, but observability bills can rival the infrastructure itself. We set up structured logging, search, health checks and alerting sized to your team — using CloudWatch, open-source tooling or both.
JSON logs from every service, archived to S3 with sensible retention.
Find any request across every server in seconds, not by SSH and grep.
CPU, disk, replication lag and certificate expiry watched continuously.
Few, meaningful alerts routed to the right person — not a noisy channel everyone mutes.
Most AWS savings don't come from discounts — they come from design. We find what you pay for but don't use, schedule non-production environments, right-size by measured load, and only then look at commitments.
Spend broken down by service, environment and team, with the top savings ranked.
Development and staging that shut down outside working hours automatically.
Instance types and storage matched to real utilisation, not launch-day guesses.
Savings Plans and reservations sized after the waste is gone, not before.
Moving from Heroku, Render, DigitalOcean, another cloud or your own servers? We inventory what you run, rehearse the move, replicate data ahead of time and cut over in a planned window with a tested way back.
Services, data stores, scheduled jobs, secrets and dependencies mapped and ranked by risk.
Databases synced ahead of time so the final switch takes minutes, not hours.
A full dress rehearsal before the real window, with an agreed downtime budget.
The old platform retired only after the new one has proven itself under load.
Three ways to work with us, each with defined deliverables. Pricing follows a short discovery call, once scope is clear.
An independent look at your AWS environment before a big decision — or just to know where you stand.
We design and deliver a defined outcome — a new foundation, a migration, a DR setup — alongside your team.
A senior cloud engineer on your team part-time — for companies that need the skills but not a full-time hire.
Forty-five minutes on your stack, constraints and goals with an engineer — not a sales team.
Scope, deliverables, milestones and a fixed or capped price you can take to approval.
Work lands in your account and repositories continuously, with weekly check-ins.
Documentation, runbooks and our access revoked — your team owns what was built.
XeroOps, our own product, provisions private networking, HA PostgreSQL, a WAF, auth, deployments, logging and tested backups into your AWS account with one command. It's an option, never a requirement.
About XeroOps →No. Our consulting is independent of XeroOps and most engagements never involve it. We work with whatever you run — EC2, ECS, EKS, RDS, Aurora, Lambda — and recommend what fits your team.
AWS is where our production experience is deepest, so delivery engagements are AWS-first. We also migrate teams to AWS from other clouds, platforms like Heroku and Render, and on-premises servers.
Often, yes. Many of our clients are too small to justify a full-time platform engineer but too far along to keep improvising. A review or a fractional retainer is usually the right starting point.
We work through IAM roles scoped to the engagement, revoked at handover. We don't copy production data out of your account, and we're comfortable working under your security policies and NDAs.
Yes. We're headquartered in Canada and work with clients across North America, remotely and in overlapping time zones.