Samples · fictional client
Four engagements, three of six weeks and one of four, for a fictional client. Every report as delivered, grouped by engagement and by week.
Who they are
Tidepost, Inc. runs a social-video news app from Denver, Colorado: 38 employees, 15 of them engineers, 600,000 monthly active users, and a licensing line that sells verified clips to 18 newsrooms. Its Series A required a SOC 2 Type 2 report, so it ran all four AWS engagements back to back, starting from the one account the founders opened, which became 9, on a bill of $157,565 a month. The youngest of the four, where the work is the order: the controls in place before the auditor’s window opens, then the waste taken out.
tidepost-0-guide.pdf
Who Tidepost is, why a Series A and a SOC 2 Type 2 brought four engagements, what each of the 33 reports delivers, and what is real and what is simulated.
View Sample Engagement Reports in the PDF viewerDownload PDF of Sample Engagement Reports
vantalect-tidepost-sample-reports.zip
Every PDF from the Tidepost, Inc. engagements (AWS Cost Analysis & Optimization, AWS Security, Compliance & Governance Audit, AWS Well-Architected Framework Review and AWS Multi-Account Foundation), the reading guide included, as delivered, in one download.
Download ZIP of the Tidepost, Inc. sample reportsAWS security · compliance · governance
A fictional social-video startup with one AWS account and a SOC 2 Type 2 window coming: 47 findings verified, nine of ten criticals closed and the last signed for with an end date, and the same scan from 24.0% to 90.0%.
Download all 34 Tidepost PDFs as one ZIP
The sponsor readout is the short document an executive reads and signs off on. The full reports below are for the engineers it gets forwarded to.
tidepost-security-3-readout.pdf
The ten criticals agreed, the one accepted in writing until the March 22 cutover, the Foundation plan, and the next four weeks.
View Audit Sponsor Readout in the PDF viewerDownload PDF of Audit Sponsor Readout
Week 1 of 6: Scan
tidepost-security-1-scan.pdf
The read-only scan of the founders’ account as found, with MAF-01 to MAF-13 run beside it, and the inventory that replaces the Foundation’s own.
View Week-One Scan, Including the Foundation Checks in the PDF viewerDownload PDF of Week-One Scan, Including the Foundation Checks
Week 2 of 6: Audit
tidepost-security-2-audit.pdf
Forty-seven verified findings ranked, the governance review that is the Foundation’s discovery, the target organization, and the first SOC 2 technical map.
View Findings Register, Governance Review, Target Organization, and the SOC 2 Technical Map in the PDF viewerDownload PDF of Findings Register, Governance Review, Target Organization, and the SOC 2 Technical Map
Week 2 of 6: Audit (appendix)
tidepost-security-2-appendix.pdf
The evidence behind each finding: what was read, how, and what it showed.
View Audit Appendix: Evidence by Finding in the PDF viewerDownload PDF of Audit Appendix: Evidence by Finding
Week 3 of 6: Criticals and guardrails
tidepost-security-4-criticals-guardrails.pdf
Every critical closed or accepted, change by change, and the workload guardrails that keep them closed.
View Criticals Closed and Workload Guardrails in the PDF viewerDownload PDF of Criticals Closed and Workload Guardrails
Week 4 of 6: Identity
tidepost-security-5-identity.pdf
Administrators off long-lived keys, people on IAM Identity Center, CI on OIDC federation, and workloads on roles.
View Identity: People in Identity Center, Workloads on Roles in the PDF viewerDownload PDF of Identity: People in Identity Center, Workloads on Roles
Week 5 of 6: Detection and response
tidepost-security-6-detection-response.pdf
GuardDuty, Security Hub, and Inspector delegated to tp-audit, the alert routing, and the first response runbooks.
View Detection and Response from the Audit Account in the PDF viewerDownload PDF of Detection and Response from the Audit Account
Week 6 of 6: Re-scan
tidepost-security-7-rescan.pdf
The same scan run the same way, check by check, and the gate.
View Week-Six Re-Scan in the PDF viewerDownload PDF of Week-Six Re-Scan
Week 6 of 6: Hand over
tidepost-security-8-runbooks-handover.pdf
The runbooks, the evidence index for the auditor, the SOC 2 technical map as of the handover, and what remains.
View Runbooks, the Evidence Index, and Handover in the PDF viewerDownload PDF of Runbooks, the Evidence Index, and Handover
AWS multi-account · Organizations · Control Tower
One AWS account became 9 in four weeks, as the add-on after a Security Audit: production joined without moving a workload, 11 policies landed with no policy-caused denial, and the scan went from 1 of 12 checks passing to 11, plus 1 waived in writing.
Download all 34 Tidepost PDFs as one ZIP
The sponsor readout is the short document an executive reads and signs off on. The full reports below are for the engineers it gets forwarded to.
tidepost-foundation-3-readout.pdf
The greenfield path, the account map, the change windows, the in-scope checks, and the risk register, presented in the Audit readout.
View Foundation Plan Readout in the PDF viewerDownload PDF of Foundation Plan Readout
Week 2 of the Audit: Design (appendix)
tidepost-foundation-2-appendix.pdf
Every SCP, RCP, declarative policy, tag policy, backup policy, and Control Tower control, as code, with what each blocks.
View The Policy Set as Code in the PDF viewerDownload PDF of The Policy Set as Code
Week 1 of 4: Landing zone
tidepost-foundation-4-landing-zone.pdf
Control Tower in the new management account, the Security OU with tp-log-archive and tp-audit, and IAM Identity Center.
View Landing Zone and Core Accounts in the PDF viewerDownload PDF of Landing Zone and Core Accounts
Week 2 of 4: The join
tidepost-foundation-5-moves.pdf
The pre-flight, the January 28 join of the founders’ account as tp-prod, its enrollment, and the billing transfer.
View The Founders’ Account Joined and Enrolled in the PDF viewerDownload PDF of The Founders’ Account Joined and Enrolled
Week 3 of 4: Guardrails and vending
tidepost-foundation-6-guardrails-vending.pdf
Policies proven in Policy Staging and attached OU by OU, the vended tp-sandbox-ml, and central backup.
View Guardrails, Vending, and Shared Services in the PDF viewerDownload PDF of Guardrails, Vending, and Shared Services
Week 4 of 4: Re-scan
tidepost-foundation-7-rescan.pdf
MAF-01 to MAF-13 run again: eleven passing and one waived in writing, and the gate.
View Foundation Re-Scan in the PDF viewerDownload PDF of Foundation Re-Scan
Week 4 of 4: Hand over
tidepost-foundation-8-runbooks-handover.pdf
Vending, moving an account, changing a policy, break glass, and suspending an account, and the operator role deleted.
View Operations Runbooks and Handover in the PDF viewerDownload PDF of Operations Runbooks and Handover
AWS architecture · Six pillars
A fictional social-video news app and its one production workload, scored against all six pillars of the AWS Well-Architected Framework: 25 high-risk issues agreed, 20 closed by change, 5 accepted in writing, none unresolved at week six, verified in its own Well-Architected Tool.
Download all 34 Tidepost PDFs as one ZIP
The sponsor readout is the short document an executive reads and signs off on. The full reports below are for the engineers it gets forwarded to.
tidepost-wa-3-readout.pdf
The agreed HRI register, milestone one, the five HRIs accepted with the cost engagement’s dates, and the next four weeks.
View Review Sponsor Readout and Milestone One in the PDF viewerDownload PDF of Review Sponsor Readout and Milestone One
Week 1 of 6: Workload and evidence
tidepost-wa-1-workload.pdf
The Brief as a workload in Tidepost’s AWS Well-Architected Tool, its architecture as found, and the evidence gathered.
View Workload Definition, Current-State Architecture, and Evidence in the PDF viewerDownload PDF of Workload Definition, Current-State Architecture, and Evidence
Week 2 of 6: Review
tidepost-wa-2-review.pdf
Fifty-seven questions answered with evidence, 25 high-risk and 21 medium-risk issues, and the improvement plan.
View Six-Pillar Review: Every Question, Its Evidence, and the HRI and MRI Register in the PDF viewerDownload PDF of Six-Pillar Review: Every Question, Its Evidence, and the HRI and MRI Register
Week 2 of 6: Review (appendix)
tidepost-wa-2-appendix.pdf
Each question’s selected and missing best practices, as recorded in the AWS Well-Architected Tool.
View Review Appendix: Answers by Question as Recorded in the Tool in the PDF viewerDownload PDF of Review Appendix: Answers by Question as Recorded in the Tool
Week 3 of 6: Reliability
tidepost-wa-4-reliability.pdf
Three zones, AWS Backup to tp-backup, the restore test, the zone drill, and the disaster recovery plan.
View Reliability: Three Zones, Backups, Restore, and Recovery in the PDF viewerDownload PDF of Reliability: Three Zones, Backups, Restore, and Recovery
Week 4 of 6: Operations
tidepost-wa-5-operations.pdf
Console-built resources imported into the CDK, canary deployments, SLOs with tracing and alarms, and the incident process.
View Operational Excellence: Code, Deployments, Observability, and Incidents in the PDF viewerDownload PDF of Operational Excellence: Code, Deployments, Observability, and Incidents
Week 5 of 6: Performance, cost, and sustainability
tidepost-wa-6-performance-cost-sustainability.pdf
The ranking endpoint moved off GPUs, the cost practices in place, and the five HRIs that wait on the cost engagement.
View Performance, Cost, and Sustainability: What Closed Here and What Moves to the Cost Engagement in the PDF viewerDownload PDF of Performance, Cost, and Sustainability: What Closed Here and What Moves to the Cost Engagement
Week 6 of 6: Milestone two
tidepost-wa-7-milestone.pdf
Milestone two against milestone one, pillar by pillar, and the gate.
View Week-Six Milestone, Pillar by Pillar in the PDF viewerDownload PDF of Week-Six Milestone, Pillar by Pillar
Week 6 of 6: Hand over
tidepost-wa-8-handover.pdf
The runbooks, the milestone cadence, the SOC 2 technical map as of March 31, and what remains.
View Runbooks, the Milestone Cadence, and Handover in the PDF viewerDownload PDF of Runbooks, the Milestone Cadence, and Handover
AWS cost
A fictional startup that built fast on one AWS account: $1,054,404 a year identified at list prices, $725,391 measured on its own Cost and Usage Report across 31 changes, and five approved changes kept out of the gate until their conditions are met.
Download all 34 Tidepost PDFs as one ZIP
The sponsor readout is the short document an executive reads and signs off on. The full reports below are for the engineers it gets forwarded to.
tidepost-cost-3-readout.pdf
The baseline, the savings ranked, the decisions made at the readout, and the next four weeks.
View Analysis Sponsor Readout in the PDF viewerDownload PDF of Analysis Sponsor Readout
Week 1 of 6: Baseline
tidepost-cost-1-baseline.pdf
Twelve months of spend across the January 28 change of payer, the April run rate by service and account, and what earlier engagements changed.
View Spend Baseline: Nine Accounts, One New Payer in the PDF viewerDownload PDF of Spend Baseline: Nine Accounts, One New Payer
Week 2 of 6: Find and rank
tidepost-cost-2-analysis.pdf
Thirty-seven findings priced as 40 changes from the AWS price list, ranked, each with a prescriptive change.
View The Analysis: Waste Register, Rightsizing, Commitments, Savings Roadmap in the PDF viewerDownload PDF of The Analysis: Waste Register, Rightsizing, Commitments, Savings Roadmap
Week 3 of 6: Quick wins
tidepost-cost-4-quick-wins.pdf
Notebooks, schedules, log levels, gateway endpoints, gp3, and expirations, change by change.
Week 4 of 6: Rightsizing and commitments
tidepost-cost-5-rightsizing-commitments.pdf
The embedding endpoint, moderation, Karpenter, the API on Graviton, and the Savings Plan.
View Rightsizing, Moderation, and Commitments in the PDF viewerDownload PDF of Rightsizing, Moderation, and Commitments
Week 5 of 6: Architecture and guardrails
tidepost-cost-6-architecture-guardrails.pdf
Telemetry to Parquet, renditions to Glacier Instant Retrieval, logs kept 30 days, five guardrails built and two inherited, and the avoidance range.
View Data Lifecycle, Telemetry, and Guardrails in the PDF viewerDownload PDF of Data Lifecycle, Telemetry, and Guardrails
Week 6 of 6: Measure
tidepost-cost-7-measurement.pdf
Every change measured on Tidepost’s Cost and Usage Report, annualized, and the gate.
View Measured on the Cost and Usage Report in the PDF viewerDownload PDF of Measured on the Cost and Usage Report
Week 6 of 6: Hand over
tidepost-cost-8-handover.pdf
The five deferred changes with owners and dates, the monthly cost review, the guardrail register, and the client’s May 14 milestone.
View Roadmap, Deferred Changes, and Handover in the PDF viewerDownload PDF of Roadmap, Deferred Changes, and Handover
The next conversation
Tell Charles which challenge is in front of you. He will tell you which engagement fits and what it would measure.
Remote engagements nationwide.
Serving clients since 2020.