Expertise — Amazon Web Services
We design, migrate and operate AWS platforms for small and mid-sized European businesses: multi-account foundations, segmented network, containers, protected data, end-to-end Terraform, managed AI — and a bill that goes down instead of drifting.
01 — The platform in figures
Ranges observed on platforms between 20 and 300 server equivalents, Paris region (eu-west-3), public list prices.
02 — The problem
An account created on a Friday afternoon, a forgotten NAT gateway, backups that cannot be restored, an EBS volume that keeps growing on its own, three test environments running all night: the bill does not drift because instances are expensive, but because decisions were never made.
We start the other way round: describe the infrastructure before creating it. What is described can be measured, what is measured can be optimised, and what is optimised stays optimised — because Terraform refuses manual drift.
03 — The eight building blocks
Each block stands on its own. Together they make a platform you can audit, rebuild identically and evolve without fear.
Foundations
AWS Organizations, one account per environment, federated access and centralised logging. Segmentation is structural, not declarative.
Perimeter
A VPC per tier, public and private subnets, controlled egress, traffic inspection and application protection at the edge.
Compute
The right building block for the right workload: orchestrated containers, controlled instances, event-driven functions for short tasks.
Data
Storage that is classified, encrypted, versioned and backed up. Every dataset has a lifetime, an owner and a known cost.
Industrialisation
No resource created by hand in production: the platform is code, reviewed, tested and versioned, with a locked state.
Intelligence
Document assistants, agents and semantic search on your data, running on managed services and billed on actual usage.
Operations
Correlated metrics, logs and traces, useful alerts and executable runbooks. An alert without a procedure is noise, not monitoring.
FinOps
Every euro on the bill is attached to a service, a team and an environment. You optimise what you can see, and you switch off the rest.
The foundation we deploy by default: one account per environment, one VPC per tier, three availability zones, no uncontrolled egress.
The journey of one packet, from the internet to the application — and the logs that prove what happened.
04 — What we deliver
We do not sell compliance in a PDF. We build barriers that hold when someone is in a hurry, and evidence that produces itself.
Every requirement is tied to a technical control, and every control to evidence you can open: Terraform configuration, audit log, scan report.
Commitment: a security architecture review is delivered at the end of every stage, with accepted gaps and a dated remediation plan.
Separate accounts, least-privilege roles, temporary federated access, no clear-text secrets, automated rotation in Secrets Manager.
WAF with managed and business rules, rate limiting, denial-of-service shielding, allow-list egress filtering.
Encryption in transit with TLS 1.3 and at rest with annually rotated KMS keys, key separation per application, S3 access logging enabled.
Encrypted backups, immutable where regulation requires it, restoration tested and timed twice a year, safety copy in a second region.
CloudTrail on every account, Config for configuration drift, GuardDuty and Security Hub for detection, alerts to the on-call channel.
Container image vulnerability scanning in the pipeline, secret scanning before every merge, quarterly review of granted rights.
Data, from encryption to tested recovery: nothing counts as backed up until the restore has been timed.
05 — Before / after
| Before | With Zorglon |
|---|---|
| Resources created by hand in the console, untracked | Every resource described in Terraform, reviewed in code review, rebuilt identically |
| One account where production and test environments mix | One account per environment, segmented, with separate rights |
| Secrets in shared configuration files | Secrets Manager, temporary roles, no long-lived keys |
| A bill explained at the end of the month, too late | A budget per application, alerts at 60 %, 80 % and 100 %, weekly decisions |
| Backups assumed to be good, never restored | Restoration tested and timed, contractual RPO and RTO |
| An incident understood by one single person | Written runbooks, correlated alerts, shared on-call rotation |
The industrialisation chain: nobody applies an unreviewed change, and nobody needs an administrator key.
06 — Our method
Review of the current state: accounts, network, rights, data, backups, dependencies and the last twelve months of billing. You get a readable map and a ranked risk list.
Target architecture, service choices, recovery objectives, regulatory constraints and target budget. Every technical decision is tied to a cost and a risk.
Accounts, network, identities, logging and the Terraform repository are deployed. The foundation is laid before the first application.
Migration in waves, with dual running, response-time verification and a prepared rollback at every step. No cutover on a Friday.
Monitoring, on-call, budgets, monthly review of costs and rights, continuous hardening. The platform keeps improving after go-live.
A worked example, line by line: €3,200 a month down to €1,420 — €21,400 a year, with no reduction in service quality.
07 — Where the money goes
Most of the time, AWS optimisation is a matter of discipline: switching off what is not used, choosing the right instance family, buying the right commitment, moving cold data away and replacing public internet paths with private links.
We refuse one practice only: reducing redundancy to lower the bill. A cost that falls at the price of availability is not a saving, it is debt.
AI on AWS, billed on usage and bounded by design: your data is not used to train a model.
08 — Artificial intelligence
We connect AI to your documents and internal tools, behind a gateway that avoids single-vendor dependency and enforces a spending ceiling per use case.
Semantic search across your procedures, contracts and technical records, citing the source of every answer.
Agents that query your APIs, prepare a file or trigger a process, with human validation on sensitive actions.
Connectors to your business software, document management and monitoring, with no re-keying and no pointless data copies.
A single entry point to several models, with logging, quotas, request filtering and European hosting.
Budget per assistant and per user, answer caching, automatic selection of the cheapest model that is good enough.
Input and output filtering, per-service isolation, and no customer data used to train models.
09 — Case studies
Manufacturing · specialised ERP and CRM
Challenge — A legacy business application running on ageing servers, with no redundancy, backups that had never been tested and unexplained bill growth.
Technical services · multi-site monitoring
Challenge — Equipment and servers spread nationwide, with no wear indicators, and interventions triggered only after a breakdown.
Engineering · internal document assistant
Challenge — Tens of thousands of technical documents scattered across folders, costly manual search and different answers depending on who you asked.
10 — Frequently asked questions
No. We start from what exists, including a badly organised AWS account: the audit identifies what should be kept, segmented or replaced. A full rebuild is only proposed when it costs less than repair, and it is always costed before you decide.
No, and that is contractual: the Terraform repository, the access rights, the accounts and the documentation belong to you. We train your teams and stay available on request. You must be able to carry on without us.
The first effects appear in the first month on visible items: unused environments switched off, resizing, orphaned storage cleaned up. Capacity commitments show on the second or third month, once the workload is stable enough to be measured.
Yes by default: Paris (eu-west-3) as the primary region, Europe as the perimeter, and a second European region for the safety copy when recovery requirements justify it. Transfers outside the European Union are documented, limited and subject to your written approval.
Yes. We design AWS, Azure and OVHcloud architectures, and we can combine providers when it is justified. The approach stays the same: infrastructure described as code, segmentation, observability and cost control.
You take back the entire repository, the architecture documentation, the operating procedures and the access rights. A handover plan is part of the contract, with a support period if you want one.
Five-day AWS audit: mapping of accounts and network, twelve-month billing analysis, ranked weaknesses and a costed optimisation plan. You leave with decisions, not with one more report.
