eCloudpod
AWS consulting
Advisory and delivery on the AWS account you already run. Identity, network, the bill, and the pipeline. A move onto AWS is one workload, not a program.
Cloud consulting · since 2017
AWS and Azure consulting for the account you already run.
Consulting on AWS and Azure: what to change, what to leave, and what the consequence will be. The engagement is a review, a build, or a retainer. The account stays in your name.
Services
Cloud consulting and advisory.
AWS and Azure first, since 2017. Google Cloud, Alibaba Cloud, and DigitalOcean when the system already runs there.
Azure consulting
The same practice on Azure. Landing zones, identity, and a catalog teams request, applied by pipeline. The subscription stays in your name.
Cloud architecture advisory
Account shape, what should stay unbuilt, and the consequence of the change. One decision, written, then made in your repository.
DevOps consulting
Environments, CI/CD, and Terraform your team runs after the engagement. The pipeline is the way to production.
FinOps
Tags, budgets, and the waste that can be cut without touching the service customers use. A VM schedule is one product, used when idle machines are the bill.
Observability and SRE
Metrics, logs, traces, and an alert a person can answer. Fractional SRE is scheduled days after production is real. Not a night desk.
Cloud security engineering
The findings that matter, closed in infrastructure code, with an owner and an expiry. Not a penetration test, and not a SOC 2 audit.
Observability
The system should speak before the customer does.
Signals
Metrics, logs, and traces for the service that earns the money.
Alerts
One page a person can answer. Not a channel that nobody owns.
The view
A dashboard with an owner, tied to the runbook, in your account.
Capabilities
The work. Each one ends in your repository.
Architecture, DevOps, automation, administration, security, and solution design. The roles held since 2017.
01
Observability
You hear it before the customer does
Metrics, logs, traces, and an alert a person can answer.
02
Cloud architecture
A decision, not a diagram pile
Account shape, identity, network, and what should stay unbuilt.
03
Cloud DevOps
One path to production
Environments, CI/CD, and the pipeline your team runs after the engagement ends.
04
Automation
Terraform you own
Infrastructure as code, modules, and secrets. The repository stays in your account.
05
Administration
The account, operated
Identity, backups, patching, and the bill on AWS and Azure.
06
Security engineering
Findings that stay closed
The rows that matter, patched in code, with an owner and an expiry.
07
Solution design
One workload, one cutover
A design for the system you have, including GCP, Alibaba Cloud, and DigitalOcean when that is where it runs.
Products
Tools, when the advisory calls for them.
The practice is the consulting. A VM schedule, a second path, cost control, or an Azure catalog is a product left in the account, not the engagement itself.
SchedulesOne product
| Machine | Scope | Window | State | |
|---|---|---|---|---|
| payments-api | Production | Always on | Running | — |
| checkout-web | Production | Always on | Running | — |
| batch-reports | Non-production | Mon–Fri 07:00–19:00 | Stopped | Start |
| qa-api | Non-production | Mon–Fri 08:00–18:00 | Stopped | Start |
| sandbox-db | Non-production | On demand | Stopped | Start |
Next change · batch-reports starts Monday 07:00, account time.
Hours off the bill
VM start / stop
One product, used when the advisory says the bill is idle machines. Each machine has its own window. Production stays running.
A second path that is real
High availability
Active and standby, or a second zone, for the workload that cannot go down with one failure.
Keep the spend that earns
FinOps
Tags, budgets, schedules, and a monthly note. Cut waste without touching the service customers use.
A catalog, not the raw portal
Azure self-service
Teams request an approved resource. The pipeline applies it. No standing owner on the subscription.
01 — Start
Where it hurts. The first buy is named from that.
Not seven equal services. Pick the pain. The offer that matches is the one to buy first.
The cloud bill
Deploys and the platform
Incidents and on-call
A red CSPM
One workload to move
I need to improve my cloud platform
I need advice on what to change
I need someone to own the account
Start with the two-week review. Savings and risk in one document, before any rebuild.
02 — Offers
Three ways to buy the practice.
Reviews are the small fixed engagement. The build is the project. The retainer starts after production is real. The amount is quoted on the call, not billed as open hours.
01
Cost and reliability review
The bill, the real risks, and the first ten fixes. Ranked, not dumped into a slide.
- Where the money goes, and what is safe to cut
- Which scanner findings are noise, and which one is the breach
- A sequenced fix list your team can run, or we can
02
Platform foundations
Terraform, environments, CI/CD, IAM, secrets, and baseline observability for one product.
- A repository you own on the last day
- A pipeline that is the way to production, not a favor
- Identity, secrets, and the alerts that actually page someone
03
Fractional SRE
Embedded platform ownership after the product is already live.
- Incident reviews and a short monthly note of what moved
- On-call design, SLOs, and the pipeline when it hurts
- Memory of last month. A chatbot session does not accumulate that
Inside an engagement, not a second catalog
- One-workload migration, with a cutover plan and a rollback
- Kubernetes, only if you already run it in production
- FinOps after the review: tags, budgets, scheduling, a monthly cost note
- Observability that pages a human, plus two or three SLOs
- AWS backup that includes a restore watched end to end
- Security baseline in Terraform: IAM, network, patch cadence, an exception log
03 — Scanner
A CSPM already told you the bucket is public.
Wiz, Security Hub, Defender for Cloud, and Security Command Center are good at the list. They do not decide, they do not patch the module you actually apply, and they do not sit the change window. That gap is the work.
| Finding | Scanner | Operator |
|---|---|---|
| Public bucket, marketing site | Critical | Often noise. Confirm the contents, then move on. |
| 0.0.0.0/0 on port 443 | High | Depends who is supposed to be on the internet. |
| Cross-account admin role | Medium | Usually the one that matters. This is the breach. |
| Unencrypted log bucket | Medium | Fix it in the module, then price the KMS line. |
-
Decide
Which fifteen findings are real, given how this business actually runs.
-
Patch
The fix in the Terraform or pipeline that ships next, not a ticket that rots.
-
Keep it closed
An owner, an exception expiry, and a monthly look at what is still red.
04 — What stays human
A model can draft the module. It does not sign the change.
Use the model inside the work. Do not buy “AI automation” as the product. The offer that survives is the decision, the production change, and an owner who answers when it breaks.
-
01
The change window
A model can propose the security-group fix. It will not watch the error rate and revert at minute six.
-
02
The accept-risk call
Written down, with an owner and an expiry. Not every red row deserves a project.
-
03
Incident command
During an outage the bridge has a named owner: stop the bad deploy, talk to the people who can change it, write the review.
-
04
A restore you watched
A green backup check is not a restore. The deliverable is recovered data, not a policy file.
About
A cloud practice. Since 2017.
Since 2017 the practice has taken accounts that already exist and left them runnable. Scope is written before the work starts. The repository, the pipeline, and the keys stay in your name. Based in Costa Rica, remote, with overlap on US Eastern business hours.
Running the change is not enough. What matters is the knowledge behind it: what the consequence will be, when to make the move, and how to deal with it when the account does not follow the plan.Victor Carranza, Founder and CEO
06 — How we work
Why the work is shaped this way.
The account is already running. What is missing is a decision someone will stand behind, and a change that stays after the engagement.
Why it is needed
A scanner already listed the findings. A diagram already described the target. Neither one chooses what to change, what to leave, or what happens if the account does not follow the plan.
Advice that lives in a slide leaves when the call ends. The account changes only when the change is in the repository you keep, with a person who can run it the week after.
How the work is done
We start from the system you have. The first meeting names the pain, the access that exists, and what should stay unbuilt. Scope is written before a key is issued: fee, timeline, and the credentials required.
Delivery is in your repository. A short note each week says what is done, what is blocked, and what is next. The handoff names an owner. A retainer is a separate agreement.
-
01
Thirty minutes
What hurts, what you run, and what access exists. No deck.
-
02
A written scope
Fee, timeline, and the credentials required. Nothing starts on a handshake.
-
03
Your repository
The work lands in git. A short note each week: done, blocked, next.
-
04
A named handoff
Runbook and an owner. A retainer is a separate yes, not a surprise.
07 — Questions
Before the call.
Do you provide AWS consulting?
Yes. AWS is a primary platform. The work is the account you already run: architecture, DevOps, cost, security, and the change in your repository.
Do you provide Azure consulting?
Yes. Azure is a primary platform, including landing zones and a self-service catalog applied by pipeline. The subscription stays in your name.
How does a cloud advisory engagement start?
Thirty minutes. What hurts, what you run, and what access exists. Then a written scope for the review, the build, or the retainer. Nothing starts before that.
Is this a consultancy with a bench?
No. Engagements are scoped to what the practice can staff. If a job needs a specialist that is not here, that is said before the scope is signed.
Will you replace our CSPM?
No. Wiz, Security Hub, Defender, and the others already produce the list. The work is deciding which rows matter, patching them in infrastructure code, and leaving a cadence so they stay closed.
Who owns the Terraform?
You do. Modules, pipelines, and runbooks land in your repository. The keys are not kept as the product.
Which clouds?
AWS and Azure are the primary platforms. Google Cloud, Alibaba Cloud, and DigitalOcean are also part of the operating record. A multi-cloud transformation program is not the offer.
Do you staff a night desk?
No. Fractional SRE is scheduled days, plus incident command inside an engagement. It is not follow-the-sun support.
Where are you based?
Costa Rica, working remote, with overlap on US Eastern business hours.
08 — Contact
Thirty minutes on the account.
Consulting first. What hurts, what you run, and whether the review, the build, or the retainer is the right next step. No deck. No credentials before the scope is agreed.
[email protected] · +506 6036 0199
Prefer to talk? Call. Costa Rica · remote · US Eastern overlap.