Managed services on AWS

We establish what exists across every account before accepting responsibility for any of it. The output is a transition plan, a remediation list and a written acceptance point.

• Inventory accounts, organisational units, workloads and cross-account dependencies, including the accounts nobody has opened since the day they were created.
• Review AWS Config recorder and aggregator coverage per account and region, and identify where configuration history is simply not being captured.
• Assess CloudWatch log group retention, custom metric volume and alarm coverage, and record current spend by observability component.
• Check AWS Backup plan coverage per resource type, along with restore test history and whether recovery objectives are documented anywhere at all.
• Baseline AWS Security Hub standards, control failures and Amazon GuardDuty finding volume, so posture progress can be measured from a known starting point.
• Review IAM roles, long-lived access keys and cross-account trust relationships, flagging anything unsafe to operate before transition completes.

The operational layer is standardised across accounts and held in code, so a newly created account inherits the same monitoring, guardrails and backup behaviour on its first day.

• Define Amazon CloudWatch alarms and composite alarms against service-level indicators drawn from the business process, not only from CPU and memory.
• Set log group retention, subscription filters and metric filters per workload, routing high-volume, rarely queried data to cheaper storage.
• Deploy AWS Config rules and conformance packs across the organisation, aggregating results into a delegated administrator account.
• Build AWS Systems Manager patch baselines, maintenance windows, inventory collection and automation documents for the routine tasks the team repeats by hand today.
• Configure AWS Backup plans, vault lock settings and cross-account copies per workload class, aligned to the recovery objective agreed with each owner.
• Set AWS Budgets and cost anomaly detection to thresholds and recipients the business chooses, rather than a default nobody reads.

Posture, detection and access hygiene run on a fixed cycle with recorded outcomes. What arrives each month is evidence of state and movement, not reassurance.

• Aggregate AWS Security Hub findings across accounts, agree suppression rules with the reason recorded, and track the remainder to closed, accepted or scheduled.
• Investigate Amazon GuardDuty findings using CloudTrail and Config context, and tune the detections that reflect normal behaviour in your environment.
• Run scheduled reviews of IAM roles, permission boundaries, long-lived access keys and cross-account trust, removing what is no longer justified.
• Monitor AWS Secrets Manager rotation configuration and certificate expiry, rotating on a schedule agreed with each application owner.
• Track Amazon Inspector vulnerability findings per workload, holding exceptions against a named owner and a review date.
• Produce operational evidence supporting your alignment to frameworks such as the Essential Eight; assessment and certification stay with an accredited third party.

Dashboards, runbooks and code are handed over, and your engineers are shown how to operate them. A good managed service reduces your dependence on the provider over time.

• Publish CloudWatch dashboards and saved Logs Insights queries in your own accounts, so engineers can answer routine questions directly.
• Keep Systems Manager automation documents and infrastructure code in your repository, reviewed through your normal pull request process.
• Hold a monthly service review with the platform owner and business sponsor covering incidents, changes, Config compliance, Security Hub movement and cost.
• Train your service desk on first-line triage for the alarms they will actually receive, including what to escalate and what simply needs watching.
• Give finance direct access to the Cost Explorer views and Budgets they control, with the account and tagging model explained in their language.

The work that runs every month once transition is complete. Coverage, contact channels and escalation steps are agreed in your service schedule rather than implied.

• Monitor workload, pipeline and AI endpoint health through CloudWatch alarms, acting on them under the arrangements set out in your service schedule.
• Coordinate incidents end to end, including AWS Support case management, stakeholder communication and a written review for significant events.
• Run patching through Systems Manager maintenance windows inside your change process, reporting compliance by account each month.
• Execute AWS Backup restore tests and AWS Elastic Disaster Recovery drills on the agreed schedule, recording what each proved and what it did not.
• Review Cost Explorer data and Budgets variance monthly, presenting rightsizing, idle resource and commitment recommendations as costed options.
• Keep a ranked improvement backlog spanning Config drift, Security Hub findings, resilience gaps and cost actions, and work it down each cycle.