An AWS foundation for a client
Accounts, access, backups and cost from day one.
My stack for this
- 01AWS Organizations + IAM Identity Center
Accounts per environment, SSO for people.
- 02Pulumi
Everything as code.
- 03AWS Backup
Backup policies as code.
- 04Savings Plans and Reserved Instances
Commit once the baseline is known.
- 05Cost Explorer (with Claude Code)
Monthly review, with an agent doing the digging.
The picks, in brief
What each one is, my verdict, and what it costs. Every name opens the full entry: when to use it and when not, the gotchas with their fixes, provisioning and alternatives.
Centralised accounts, billing and access. Every client gets this first.
Pricing: No extra charge. Control Tower is free too, but you pay for the AWS Config and CloudTrail it turns on. Replicating Identity Center to a second Region adds only the KMS key.
Infrastructure as real code. And it can use any Terraform provider, so nearly everything is provisionable from one codebase.
Pricing: Free and open source with a self-managed S3 backend (no Pulumi Cloud fees).
Central backup policies for AWS resources. Neon branches cover the Neon side.
Pricing: Sydney: S3 and EFS backups $0.06/GB-month warm (EFS cold $0.012), DynamoDB $0.114/GB-month, EBS snapshots $0.055/GB-month; Aurora and RDS snapshots bill at their own backup storage rates. Copies out of Sydney $0.098/GB for most types ($0.16 for DynamoDB and EFS). Restore tests $1.80 per recovery point. Vault Lock is free.
My main lever on AWS cost. AWS margins are high; commitments bring them down.
Pricing: Sydney, on-demand to committed: Aurora PostgreSQL db.r7g.large $0.333/h to $0.256/h (1-year Reserved Instance, no upfront) or about $0.176/h (3-year, all upfront). Fargate $0.0486 per vCPU-hour to $0.0413 (1-year Compute Savings Plan, no upfront) or $0.0257 (3-year, all upfront). Lambda duration only 12 to 17% off; requests not at all.
Where every cost investigation starts. I let Claude Code read it and find the culprit.
Pricing: The console is free. The API costs $0.01 per paginated request. Hourly data for the last 14 days is opt-in, at $0.01 per 1,000 usage records a month.
Where they sit
The layers of the stack this job touches, with every tool named on this page.
Infrastructure as code
If I can't provision it, it loses points.
Want this stack in your AWS account?
Cloudless Labs is a Sydney consultancy. We migrate on-premises systems to AWS, build serverless apps on this stack, and coach teams to ship with Claude Code and Codex.