Infrastructure and security

Cloud infrastructure that stays up for the rush and stays secure after it.

Most systems are fine on a normal day. The trouble starts when the tickets go on sale. We build backends, APIs and websites sized for that moment, on AWS or wherever you need them, secure from launch. Already running something? We review it, move it or make it safer.

One request drawn through four stages of a system from left to right: at the edge, two browsers and a phone wired to a cached copy of the site, with a DNS record above pointing to it and one request path in cyan; a firewall rule table that stops two incoming requests with crosses and passes the cyan one through; a load balancer feeding three compute units in a dashed scaling group with a fourth unit drawn dashed, and a database with a dashed replica; and a metric chart where the line crosses a dashed alarm threshold, marked in cyan, with a leader to the alert card and the log beneath.One request drawn through four stages of a system from left to right: at the edge, two browsers and a phone wired to a cached copy of the site, with a DNS record above pointing to it and one request path in cyan; a firewall rule table that stops two incoming requests with crosses and passes the cyan one through; a load balancer feeding three compute units in a dashed scaling group with a fourth unit drawn dashed, and a database with a dashed replica; and a metric chart where the line crosses a dashed alarm threshold, marked in cyan, with a leader to the alert card and the log beneath.
EdgeProtectRunWatch

What we build

AWS infrastructure, from the edge to the database.

Everything here is something we have set up and run, for a client or for our own software. Take the parts you need.

Two ways in

Build something new on AWS, or improve what you already run.

Most of our cloud work is part of software we build. If you already have an AWS account, or an app hosted somewhere else, we start from what is there. Not on AWS? We also work with another cloud, your own servers or the hosting you already have.

Route 1 · New build

New build on AWS

For a new app, API or website. We design the architecture around how the software will be used, write it as AWS CDK code, set up automated deployments, and launch with WAF rules, least-privilege access and alarms already in place.

  • Serverless or auto-scaling servers, chosen for the job
  • The whole environment defined with AWS CDK
  • Code in GitHub, deployed with GitHub Actions from the first release
  • WAF, permissions, backups and alarms at launch
  • Ongoing management once it is live, if you want it
Start a new build

Route 2 · Existing systems

Migration, security review and ongoing management

For software that already exists. We move it to AWS, or review how your account and application are set up and tighten what we find. A review can be booked on its own, and after it we can run the system for you if you want us to.

  • Migration to AWS from a server or a hosting plan
  • Security review of an account or an application
  • Hardening: WAF, security groups, IAM and backups
  • Cost review: right-sizing and what to switch off
  • Ongoing management, updates and alarms
Ask about an existing system

How a project runs

Defined as code, deployed automatically, reviewed after launch.

Serverless where it fits, so there are no servers to patch and you pay only for what runs. On AWS, everything is written as code with AWS CDK, so nothing is set up by hand and the environment can be rebuilt from the code.

  1. Blueprint

    What the software has to do, how much traffic to expect and when, what data it holds and who needs access to it. From that, an architecture sized for the job, and a price before we start.

  2. Define

    The whole environment written as AWS CDK code: network, compute, data, permissions and alarms, ready to review before anything is deployed.

  3. Deploy

    Each change is reviewed in GitHub and deployed by a pipeline, usually GitHub Actions, so it goes out the same way every time and can be rolled back.

  4. Run

    After launch, we look after the system on terms we agree with you: alarms routed to the right people, updates applied, and the bill reviewed.

Start where you are. If you already have an architecture, a hosting setup or a security report, we review it with you and pick up from there instead of starting again. Tell us what you have.

Where it runs

Vehicle inspections, theatres, ticket rushes and a serverless product.

Software as a service
A vehicle inspection software company
Twelve services moved from EC2 instances to containers on AWS Fargate. CodePipeline and CodeBuild push the images through ECR. The whole infrastructure is defined in AWS CDK so it can be rebuilt in another region if it ever has to be. The VPC was rebuilt from the security groups up, with AWS Config rules and alerts to Slack and SMS from GuardDuty and Security Hub.
Theatres
Mirvish
Mirvish's website and designEdit, running in containers on ECS, with CloudFront and AWS WAF in front and alerts sent to Slack.
Theatres and arts
Drayton, Goodspeed and others
Sites connected to designEdit, on AWS Lightsail servers we set up.
Festivals and carnivals
Caribana Toronto
Hotel packages and ticketing for Toronto's Caribbean carnival weekend, on designEdit and hosted on AWS. It is sized for the pre-event rush, when half of the year's sales come in over the last two weeks.
Software products
designEdit
Our own framework for building business software, which can run serverless on Lambda, S3 and DynamoDB, with sign-in through Amazon Cognito.

Client names are used with permission. Amazon Web Services, AWS and the AWS service names on this page are trademarks of Amazon.com, Inc. or its affiliates. GitHub and Slack are trademarks of their respective owners. Design of a Decade is an independent studio and is not affiliated with or endorsed by Amazon.

Questions

What clients ask about hosting and security.

Why do you recommend AWS?

It has a managed service for almost everything, and with its serverless options there are no servers to patch or look after: your app scales up for a rush, back down afterwards, and you pay for what is used.

Do we have to move to AWS?

No. It's your call. We also work with other cloud providers, your own servers or the hosting you already have, in the region you choose. If moving later matters to you, we can run the app in containers, which move between providers more easily than serverless.

Whose AWS account does it run in?

Whichever suits you. We can set it up in your own AWS account, or run it in ours with hosting billed through us. If it runs in ours, the account can be transferred to you at any time.

What does a security review cover?

A review of how your account and application are set up: access and permissions, firewalls and network rules, backups, logging and alarms. You get a list of what to change and why. You can book a review on its own, with no build work after it. It's an expert review, not a certification.

How does a migration work?

We review what you run today, build the new environment alongside it and test it there. Then we switch over at a time that suits you. Larger systems move in stages, so the business keeps running.

What will hosting cost each month?

It depends on what runs and how much traffic it gets. We size the setup for that and estimate the monthly cost with you before launch. After launch, we review the bill so you aren't paying for capacity you no longer need. Once usage is steady, a one- or three-year Savings Plan or reserved capacity lowers the bill further.

What happens after launch?

We can run it for you on terms we agree with you, or hand it over to your own team. When we run it, monitoring watches the system all the time and alerts us by text and email, so we usually know about a problem before you or your customers do. Updates and a regular cost check are part of it.

Can you take over a system someone else set up?

Yes. We start with a review of what you have. Most of the time we work in what is there, and tighten or replace parts of it in stages.

What happens if we stop working with you?

You keep running what we built. If it runs in our AWS account or our GitHub, we transfer the account and the code to you. The environment is defined as code, so your team or another provider can pick it up and rebuild it if they need to. If designEdit is part of the system, we work with you to choose the licence model that fits.

Building something new, or unsure about what you have?

Tell us about it.

You don't need everything worked out. Send us a rough idea or a full spec, and we'll reply within one business day.

info@designofadecade.com

+1 647.409.1479

Burlington, Ontario