AWS infrastructure as code in Terraform, rebuilt rather than remembered.
Hands on the keyboard, not a diagram handed to your team. Networking, containers, databases, queues and the deployment pipeline, defined in Terraform so the whole environment can be rebuilt from the repository. Fixed price, agreed after a scoping call.
Infrastructure we build is defined in Terraform, lives in your repository and is documented, so the day we stop working together costs you nothing.
What goes wrong when infrastructure lives in the console
Most AWS environments start in the console. Someone clicks through a wizard to get a database running before a launch, and it works. Then a second environment is needed, and it is built by hand again, from memory, slightly differently. A year later nobody can say for certain how production is configured, why a security group allows what it allows, or how to rebuild any of it if something is deleted.
The same problem turns up in another form when Terraform exists but nobody trusts it. State files on a laptop. Modules copied between folders. A plan that wants to destroy something, which nobody dares apply. Infrastructure as code only helps if the code is the truth.
What we build in Terraform
The whole environment, not only the parts that were easy to write down.
Networking
VPCs, subnets, routing, NAT and VPC endpoints, and security groups that say what they allow and why.
Compute and containers
ECS services, Lambda functions, EC2 where it still makes sense, and the load balancers in front of them, sized from real metrics rather than guesses.
Data and storage
RDS and Aurora databases, S3 buckets with lifecycle rules, queues and caches, with backups and encryption set in code instead of remembered.
Deployment pipelines
Pipelines that build, test and deploy your application with rollback built in. Infrastructure changes go through the same review as application code.
Accounts and access
AWS Organizations and account structure, IAM roles with only the permissions they use, and Secrets Manager in place of secrets in environment variables.
Automation
The recurring manual work that eats an engineer's week, moved into Lambda, EventBridge or Step Functions and defined alongside everything else.
How a Terraform engagement runs
- Scoping call and proposal. We agree what gets built, then send a written proposal with the deliverables, a fixed price and a delivery date.
- Foundations first. Remote state in S3 with locking, a repository layout your team can follow, and separate state per environment, so one mistake cannot reach everything.
- What exists, imported. If you already run on AWS, we bring existing resources under Terraform rather than rebuild them, and confirm the plan shows no changes before going further.
- Plan before apply. Every change is run as a Terraform plan and read before it is applied, so nothing reaches your account that nobody has looked at.
- Handover. Documentation written so your team can run and extend the code without us.
What you get
- The environment defined in Terraform, in your repository and your AWS account
- Remote state with locking, kept separate for each environment
- Every change planned and reviewed before it is applied
- Modules shaped to your system, not a framework to learn first
- An environment that can be rebuilt from the repository rather than remembered
- Documentation, so the day we stop working together costs you nothing
Why Terraform, and why it matters who writes it
We use Terraform because it outlives the engagement. It is widely used, so the next engineer you hire can probably read it on their first day, and the code is yours whether or not we are still around.
Terraform is only as good as the discipline around it. Code nobody trusts is worse than no code, because it looks like the truth. We keep modules plain, names predictable and changes small. The multi-tenant SaaS platform we run ourselves is defined in code the same way, so the patterns we bring have been lived with.
It is also how the rest of our project work is delivered. An architecture design becomes Terraform. A staged migration builds its target environment in Terraform first. Reliability guardrails, backups and alarms go in the same repository.
Who this is for
Teams starting a new build who want it right from the first commit. Teams whose environment was built by hand and can no longer be reproduced. Teams with Terraform that has drifted from what is actually running. For Canadian clients, we build in Canadian AWS regions by default. We work with teams in Canada, the United States and Europe, remotely.
Frequently asked questions
Can you bring our existing AWS resources into Terraform?
Yes. We import what already exists rather than rebuild it, then check that Terraform plans no changes before anything else is touched. Your running systems stay as they are while the code catches up with them.
Our Terraform no longer matches what is running. Can you fix that?
Yes. We run a plan against what is really deployed, work out which side is right for each difference, and bring the code and the account back into line one small change at a time.
Where is the Terraform state kept?
In your AWS account, in an S3 bucket with versioning, encryption and state locking, with separate state for each environment. Never on a laptop.
Will our team be able to maintain it after you leave?
That is the point of it. The code lives in your repository, changes go through the normal review your team already uses, and it is documented, so the day we stop working together costs you nothing.
Do you write our application code as well?
No. Application code stays with your engineers, who know it better. We build the infrastructure it runs on and the pipeline that deploys it.
How is a Terraform project priced?
A fixed price, agreed after a scoping call and set out in a written proposal with the deliverables and a delivery date. No hourly billing, no open-ended meters.
Related services
Get your infrastructure into code
Fifteen minutes on a call is enough to tell whether a Terraform project makes sense for you, and roughly how large it would be. If it does not make sense, we will say so.