CASE 01 · ACME · 2026
Cut the AWS bill in half, kept the SLA.
A Series-B fintech on a single AWS account, growing 30% MoM, with auditors three weeks out. We rebuilt the landing zone on Control Tower and shipped the SOC 2 Type II remediation work in nine weeks — without a single migration weekend.
Series-B fintech
LANDING ZONE
2026
RESULTS
What changed, by the numbers.
AWS BILL
−44%
RTO
18m
p99 LATENCY
80ms
AUDIT FINDINGS
0
HOW IT WENT
The original account had eight production workloads, three dev environments, a shared services VPC, and a single root user nobody wanted to touch. We started with a written portfolio assessment: every workload mapped to a 6R disposition, every IAM principal inventoried, every NAT gateway costed out.
Week three we provisioned Control Tower with six accounts — prod, non-prod, security, audit, log archive, shared services — and stood up SSO with permission sets that mirrored the existing engineering team structure. Foundation services (DNS, IAM, CloudTrail, Config, GuardDuty) landed before any workload moved.
Then we migrated in three waves, four workloads each. Pilot-light for the data plane, blue/green for the stateless services, dual-write for the queue. The bill dropped 44% on right-sizing alone; Savings Plans took us the rest of the way. Auditors got their evidence in week eight.
RELATED · SAME DOMAIN
Other engagements in this space.
READY WHEN YOU ARE
Let's get your AWS bill (and architecture) in order.
The discovery call is free. You walk away with at least one concrete idea — even if we never work together.