AWS, configured so nobody is afraid to touch it.

Most AWS problems are not technical. They are an account nobody has audited, permissions far wider than they need to be, and infrastructure that exists only because someone clicked through the console eighteen months ago.

Where we run it

This site sends its enquiries through Amazon SES using OIDC federation, so it assumes a role at runtime and stores no access key anywhere.

What we build with it

AWS in practice.

Application hosting

Containers, serverless or static, chosen for what the application actually is rather than for fashion.

Databases and storage

RDS, S3 and the backup and recovery plan that makes them worth having.

Email and messaging

SES with domain verification and DKIM, so your mail reaches inboxes rather than spam folders.

Identity and least privilege

IAM roles rather than long-lived keys, scoped to what each service genuinely needs.

Cost review

Finding the instance nobody uses and the storage class nobody chose deliberately.

When not to use it

The honest view.

Plenty of applications do not need AWS. If you are running one small web application, a managed platform will cost less and take less of your attention. AWS earns its place when you need control, compliance or services that have no managed equivalent.

Questions we get asked

Straight answers.

AWS, Vercel or something else?

Vercel for front ends, because the developer experience is worth the premium. AWS for anything with real infrastructure behind it. Most of our projects use both, and there is no contradiction in that.

Can you audit an account we inherited?

Yes, and it is a good first engagement. Permissions, costs, backups and what is actually running, written up plainly rather than as a console screenshot.

Do you use infrastructure as code?

For anything that matters, yes. Infrastructure that exists only in a console is infrastructure nobody can reproduce after an incident.

How do you handle credentials?

Preferably not at all. Where a platform supports OIDC federation we use short-lived role credentials instead of storing keys, which is exactly how this site sends its own email.

Building in AWS?

Whether it is a new build, a rescue or a second pair of hands alongside your team, tell us what you need and you will get a straight answer within one working day.