AWS consulting, starting with the bill nobody has read
Trusted by
AWS consulting, three pillars, one operator.
One Canadian team structures the accounts, reads the bill, and runs what's left. AWS migration, AWS managed services and AWS cost optimization are three different purchases, and most estates need them in that order.
Accounts and landing zone
A structure with separate blast radius, guardrails and centralised logging, built on what AWS recommends now: Control Tower as the foundation, with Landing Zone Accelerator where regulated controls demand it.
The bill, line by line
Every service, region and orphaned resource mapped to an owner and a reason, with the findings costed and ranked before any work is proposed.
The run, handed over or held
Patching, guardrail drift and cost review on a cadence, either transferred to your team with the runbooks or operated by ours.
Does AWS Consulting work the same way in every industry?
No. The AWS Consulting work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in healthcare, provincial health privacy law; and in legal, Law Society duties and solicitor-client privilege. We keep the service and change the part that bends.
OSFI's technology and cyber risk rules set what an examiner will ask to see.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
A production line can't stop for a patch window, so changes have to fit the schedule.
OT and IT convergence. A flat network between plant and office is the common failure, and segmentation is the fix. It's a design problem, not a purchase.
SCADA networks and remote sites can't go offline, so changes are planned around them.
SCADA and ICS. Availability outranks confidentiality here, and you often can't take a system offline to investigate what happened on it.
What do you need from AWS Consulting?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- AWS Consulting
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584AWS consulting in Canada, made real.
Two things go wrong on AWS, and they aren't the ones people expect. The account structure, and the invoice.
The account structure everything else inherits.
Start with the structure, because everything else inherits it. Most estates we see grew inside a single account: one blast radius, one set of credentials, no separation between production and the thing somebody built to test an idea in 2023. A landing zone fixes that by giving each workload its own account with guardrails, centralised logging and a security account that can see everything and change nothing. What AWS recommends here changed, and a lot of proposals haven't caught up. The current pattern is Control Tower as the foundation, with Landing Zone Accelerator layered on for the controls a regulated estate needs.
Reading the invoice against reality.
Then read the invoice properly, which almost nobody does. The risk sits in two places. Resources nobody owns, because the person who created them left and the tag was never mandatory. And commitments bought against a shape the estate no longer has, so you're discounted on the wrong thing. Both are found by reading the bill against reality rather than against last month's bill. Landing Zone Accelerator itself carries no licence charge, which is worth knowing, and it still isn't free to run.
Residency, procurement and the Canadian angle.
The Canadian angle is residency and procurement. AWS runs Canadian regions, so keeping regulated data in the country is a configuration decision rather than an obstacle, and it's one a guardrail can enforce rather than a policy document requesting it. What needs watching is cross-region replication switched on by a default somebody accepted, and billing in US dollars against a Canadian budget. We don't resell AWS, or the other two hyperscalers, so we're free to tell you when a workload suits a different platform, or belongs on hardware you own instead of in public cloud at all.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our AWS landing zone and cost optimization work runs.
Four steps, and step 01 needs nothing from you but read-only access. We'd rather look before proposing, because an AWS estate is unusually knowable from the outside: the billing data and the resource inventory tell you most of what a discovery workshop would, and they don't flatter anybody. About half of what we find in that first pass is fixable without a project.
Engagement phases
Phases 01 to 04
Read the estate
Read-only access across accounts, the full billing export, resource inventory and tag coverage. Findings costed and ranked before anything is proposed, so you can see the size of the problem before you commit to fixing it.
Design the structure
Organisational units, account separation, guardrails and centralised logging, built on Control Tower with Landing Zone Accelerator where the controls demand it.
Fix the bill
Orphaned resources retired, storage tiers corrected, commitments matched to the shape the estate actually has rather than the one it had when somebody signed.
Hand it over or hold it
Runbooks, guardrail drift checks and a cost review cadence, either transferred to your team with training or operated by ours. The account stays yours either way.
AWS consulting questions, answered straight.
Answers first, including the one where the fix needs no project. An architect takes the call.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
