01 The problem
The Cloud Did Not Remove The Infrastructure
It turned it into a monthly invoice and a console with four hundred services in it. The servers are
still there, the failure modes are still there, and now they are one badly chosen setting away from
being expensive. Almost every cloud setup we are asked to look at has the same four problems.
-
The bill grows faster than the traffic
Oversized instances, staging environments running all weekend, storage nobody has opened in two years. Nobody can explain the line items.
Waste
-
It was built by clicking
Set up by hand in the console, undocumented, and impossible to reproduce. Nobody dares touch it because nobody can rebuild it.
Unreproducible
-
The backups have never been restored
Snapshots are being taken, probably. Whether they restore, how long it takes, and what is missing from them, nobody has ever checked.
Untested recovery
-
Customers report the outages
No alerting worth the name, so the first signal that production is down is an email from someone who pays you.
No visibility
Nobody is paid to notice a server that is 80% idle.
The invoice notices every month.
None of this needs a rebuild. It needs someone to sit down with the account, work out what is actually
running, and fix the handful of things that account for most of the cost and most of the risk.
02 The economics
Cloud Costs Are A Design Decision
Cloud spend is not really a procurement problem, it is an architecture problem that arrives as an
invoice. The choices that set your bill, instance sizing, storage class, data transfer paths, whether
anything scales down, are all made during design and then charged for every month afterwards.
Decided at design
A review
Right-sized instances, autoscaling that actually scales down, lifecycle rules on storage, traffic that does not cross a paid boundary for no reason. A few hours of thinking.
Noticed on the invoice
Every month
The same choices, now serving live traffic, with commitments already purchased against the wrong shape and an application that assumes the current layout.
The good news is that the fixes are usually unglamorous and quick. Most of the savings we find come
from a short list: things sized for a peak that never happens, environments nobody turns off, data
kept hot that should be cold, and on-demand pricing on workloads that run permanently.
03 The scope
What We Build And Run
Infrastructure defined in code, deployed by a pipeline, watched by monitoring that pages a human, and
documented well enough that your team can operate it without us.
01
Foundation
The parts that are painful to change once anything is on top.
Accounts
- Account and project structure
- Network, subnets and security groups
- Identity, roles and least-privilege access
- Secrets management and key rotation
- Environment separation, dev to production
- Tagging, budgets and cost alerts
02
Compute & delivery
How your code gets to production, repeatedly and safely.
Pipeline
- Infrastructure as code with Terraform
- Containers, Kubernetes or serverless
- CI/CD with automated tests and gates
- Blue-green and canary deployments
- Autoscaling that scales down as well as up
- CDN and edge caching
03
Data & resilience
What happens on the day something genuinely fails.
Recovery
- Managed databases and read replicas
- Automated backups with restore testing
- Multi-zone and multi-region failover
- Documented recovery time and data loss targets
- Encryption in transit and at rest
- Storage lifecycle and archival rules
04
Operations
Knowing it is healthy without anyone watching a screen.
Handover
- Metrics, logs and distributed tracing
- Alerts that page a person, and only when real
- Dashboards for cost and capacity
- Incident runbooks and escalation paths
- Patching and upgrade schedule
- Team walkthrough and written handover
04 Where we fit
How People Usually Bring Us In
Rarely for everything at once. Most engagements start with one specific thing that has become
uncomfortable enough to act on.
- First production deploymentYou have an application and no infrastructure to put it on yet.
- MigrationFrom on-premise, from a single rented server, or between providers.
- The bill got seriousA cost review that says where the money goes and what to do about it.
- Reliability workAfter an outage, or before the traffic that would cause one.
- Nobody owns itThe person who built your infrastructure has left and taken the context with them.
- Managed operationsA retainer for monitoring, patching, incident response and capacity planning.
- A second opinionAn independent read on an architecture, a quote or a proposed migration.
05 The process
How The Work Runs
We start by understanding what you already have. Recommendations made before that are guesses with
confident formatting.
-
01
Week 0
Audit
What is running, what it costs, who can access it, what is backed up, and what happens
today if the main database disappears. Usually the first time anyone has written that down.
-
02
Week 1
Target architecture
What it should look like, what it will cost per month, and the order to get there in, with
the trade-offs stated plainly rather than buried.
-
03
Early
Quick wins first
The savings and risk fixes that need no application changes get done immediately, so the
work starts paying for itself before the larger pieces begin.
-
04
Ongoing
Codify and automate
Everything moved into Terraform and a pipeline, in stages, so at no point is there a
mixture of managed infrastructure and forgotten console clicks.
-
05
Before cutover
Prove it
Load testing, a failover drill and an actual restore from backup, timed. A migration plan
that has not been rehearsed is a hope, not a plan.
-
06
After
Hand over or hold
Runbooks, dashboards and a walkthrough for your team, or we stay on a retainer and run it.
Either way you are never dependent on us to keep the lights on.
Technologies We Use
Chosen against your workload, your team's skills and your budget. Managed services where they earn
their premium, plainer infrastructure where they do not.
AWS
EC2
S3
Lambda
RDS
ECS/EKS
CloudFront
Google Cloud
Compute Engine
Cloud Storage
Cloud Run
GKE
Cloud SQL
Automation
Terraform
Docker
Kubernetes
Ansible
GitHub Actions
GitLab CI
Observability
Prometheus
Grafana
CloudWatch
ELK Stack
OpenTelemetry
Sentry
06 Who does the work
Engineers Who Have Been Paged At 3am
NoCubical is a small, senior studio. We build applications as well as the infrastructure under them,
which is why our recommendations account for what your code actually does rather than treating it as
a black box to be hosted.
10+ years
Hands-on experience per engineer, across agencies, product companies and enterprises. No juniors learning on your budget.
Senior by default
Small by design. The person answering your questions in week one is still reachable in month six.
Built, shipped, maintained
We have run our own work in production for years, which is the part that teaches you which alerts matter. See how we work.
Your accounts, your bill
We do not resell hosting or hold your infrastructure behind an account you cannot reach. You
own the accounts, you see the real invoice, and you can revoke our access at any time.
Your idea stays yours
We will sign a mutual Non-Disclosure Agreement any time you want one, at no cost. You can
read the exact document we use before you ask for it.
Frequently Asked Questions
Can you reduce what we are already spending?
Usually, and it is one of the most common things we are asked to look at. The savings are rarely exotic: oversized instances, storage nobody has read in two years, environments left running overnight and at weekends, unattached volumes and idle load balancers, and on-demand pricing for workloads that never turn off. We start with a review that tells you where the money goes before you commit to any work.
AWS or Google Cloud?
For most workloads either is a perfectly good answer, and the difference matters far less than how well the thing is built on top. The choice usually comes down to which managed services you lean on, what your team already knows, and what your commercial terms look like. We will give you a straight recommendation and the reasons, not a preference dressed up as a requirement.
Whose accounts does this run in?
Yours. The AWS or Google Cloud accounts are registered to your company, billed to you, and we work inside them with the access you grant and can revoke. We do not resell hosting or put your infrastructure behind an account you cannot reach, because that is the kind of arrangement that becomes a problem exactly when you most need control.
Can you migrate us without downtime?
In most cases yes, by running both environments in parallel, replicating data continuously, and cutting traffic over once the new side has been proven, with the old one kept ready to fall back to. Some migrations do need a short planned window, usually because of a database. Where that is true we will tell you up front rather than discovering it on the night.
Do you offer ongoing management?
Yes. We can hold a retainer covering monitoring, patching, cost review, incident response and capacity planning, or we can set everything up and hand it over with the runbooks your team needs to run it themselves. Both are legitimate choices, and which one fits depends on whether you want to build that capability in-house.
How do you know the backups actually work?
Because we restore them. A backup that has never been restored is an assumption, not a safeguard, and the failure modes are common: a job that has been silently erroring for months, a snapshot missing a volume, or a restore that technically works but takes eleven hours nobody budgeted for. We run the restore, time it, and write down what the real recovery time is.
- Free first call, technical, no obligation
- A cost and risk review before any migration is proposed
- Mutual NDA on request, before the first call
- Cloud accounts in your name, access you can revoke