Cloud architecture breakdowns

Real-world cloud architecture.
Design decisions that ship.

Landing zones, multi-region patterns, security blueprints.
— documented from production engagements across AWS, Azure and GCP.

Amazon Web Services

In progress Multi-account · Landing Zone

AWS Organizations Landing Zone from scratch

Designing a secure multi-account structure for a mid-size fintech — Control Tower, SCPs, centralized logging and network isolation between prod, staging and sandbox.

Control Tower SCPs AWS Config VPC

In progress FinOps · Cost Optimization

−38% cloud bill after a FinOps review

Full FinOps audit of a 200k€/month AWS workload — rightsizing EC2, migrating to Graviton, Reserved Instances strategy and Spot for batch workloads.

Cost Explorer Graviton Savings Plans Spot

In progress Security · Zero Trust

Zero Trust network architecture on AWS

Replacing flat VPC peering with a zero-trust model — AWS Network Firewall, PrivateLink, IAM Identity Center and GuardDuty for a HDS-certified healthcare workload.

Network Firewall PrivateLink IAM IC GuardDuty

Microsoft Azure

In progress Migration · Lift & Shift

On-prem to Azure migration for a retail group

200+ VMs migrated over 6 months with zero business interruption — Azure Migrate, ASR for coexistence, ExpressRoute for the cutover window and Azure Policy for governance.

Azure Migrate ASR ExpressRoute Landing Zone

In progress Data · Lakehouse

Azure data lakehouse for a financial group

End-to-end lakehouse built on ADLS Gen2, Databricks Unity Catalog and Azure Purview — ingesting 50+ sources, enforcing data contracts and serving BI teams in near real time.

ADLS Gen2 Databricks Purview Event Hub

In progress DevOps · IaC

GitOps platform on AKS at scale

Full GitOps pipeline for 12 dev teams — Terraform for AKS clusters, Flux CD for app delivery, Azure Key Vault for secrets and OPA Gatekeeper for policy enforcement.

AKS Terraform Flux CD Key Vault

Google Cloud

In progress BigData · Streaming

Real-time analytics pipeline on GCP

End-to-end streaming platform processing 2M events/day — Pub/Sub → Dataflow → BigQuery, with Looker Studio dashboards refreshed every 90 seconds for operations teams.

Pub/Sub Dataflow BigQuery Looker

In progress Security · Sovereign Cloud

Sovereign cloud architecture — GCP Assured Workloads

Scoping and deploying an Assured Workloads environment to meet French data residency requirements — VPC Service Controls, CMEK, Access Transparency and Cloud Armor.

Assured Workloads CMEK VPC SC Cloud Armor

In progress Multi-region · Resilience

Multi-region active-active on GKE

Active-active setup across europe-west1 and europe-west4 — GKE Autopilot, Cloud Spanner for global consistency, Global Load Balancer with health-based failover under 30 seconds.

GKE Autopilot Cloud Spanner Global LB Cloud DNS

Full write-ups with diagrams and decision logs are being assembled.

Want to discuss a specific architecture challenge? Get in touch.

Real-world cloud architecture.Design decisions that ship.