AWS Well-Architected Framework · Fixed price
Six pillars, one workload.
Every high risk closed.
An evidence-backed AWS Well-Architected Framework Review of your most important production workload, followed by four weeks of closing every agreed High-Risk Issue as code. Two-week Review for $25,000, or six-week Remediation for $35,000.
Two-week review, $25,000. Six-week remediation, $35,000, with half the fee invoiced only when every agreed High-Risk Issue is closed. One signature, no procurement cycle.
Review it, or remediate it too.
Both fixed price.
Fixed scope, fixed price, one signature.
Both start within two weeks of it.
The Review
One critical production workload, evaluated across all six pillars of the AWS Well-Architected Framework. We do not rely on a self-reported questionnaire: the answers are checked against your live configuration, CloudWatch and X-Ray telemetry, Cost and Usage Report, and infrastructure code.
- All six pillars evaluated: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability
- Answers checked against live configuration, metrics, and code rather than taken from memory
- The workload and its baseline milestone recorded directly in your AWS Well-Architected Tool
- An evidence-backed High-Risk Issue (HRI) and Medium-Risk Issue (MRI) register with concrete designs
- A sequenced remediation roadmap you can run yourselves, or with us
Charles’s time: up to 40 hours over the two weeks, about 8 of them live with your team.
Read-only, start to finish. Configuration, telemetry, and billing are inspected through a read-only role you deploy and delete; only the Well-Architected Tool workload entry is recorded in your account.
The Remediation
The Review in the first two weeks. Then weeks three through five close every agreed High-Risk Issue as code in your repositories, with the engineers who own the workload. Week six verifies every fix and records the closing milestone in your AWS Well-Architected Tool.
- Everything in the Review
- Every agreed High-Risk Issue fixed as code, through your pull requests and your pipeline
- Multi-AZ, backup, failover, and quota protections put in place for Reliability
- Identity boundaries, encryption, network controls, and guardrails tightened for Security
- Observability, deployment safety, right-sized compute, and storage lifecycle policies applied
- The week-six milestone recorded in your AWS Well-Architected Tool against week two
Charles’s time: up to 110 hours over the six weeks, about 38 of them live with your team.
The guarantee. The second half of the fee is invoiced only when every High-Risk Issue agreed at the week-two readout is closed, verified in the week-six AWS Well-Architected Tool milestone.
No standing access to production. Every architectural change lands as code in your repositories, reviewed by the engineer who owns the workload, and ships through your pipeline.
Week by week
Because the work has a shape.
The same weeks, every time, which is why it is fixed price.
- Week 1Inspect and interview.The read-only role goes into the accounts that run the workload on day one. We inspect your live configuration, telemetry, deployment pipelines, and Cost and Usage Report, then run focused pillar sessions with your architects, platform engineers, and service owners.
- Week 2Score and design.Every pillar question is scored in your AWS Well-Architected Tool with the resource-level evidence behind it. Each High-Risk Issue and Medium-Risk Issue gets a concrete target design, an effort estimate, and a sequence in the remediation roadmap, presented at the sponsor readout.
- Week 1Inspect and interview.The Review’s first week: read-only inspection of the accounts that run the workload, plus the pillar workshops with the engineers who built and operate it. No changes yet.
- Week 2Score and design.The Review’s second week: the baseline milestone recorded in your AWS Well-Architected Tool and the High-Risk Issue register agreed with your sponsor. That agreed list is what the next four weeks close.
- Week 3Security and reliability foundations.Identity least-privilege, secret management, encryption, and network boundaries go in as code alongside multi-AZ topology, automated backups, restore checks, and service quota monitors.
- Week 4Resilience and operational excellence.Health checks, circuit breakers, queue backpressure, and auto-scaling rules are tuned to real load. Deployment rollback gates, structured telemetry, SLO alarms, and incident runbooks go into the repositories.
- Week 5Performance, cost, and sustainability.Compute, containers, and databases are matched to workload demand; caching, storage tiers, lifecycle rules, and data-transfer paths are tightened so the workload runs faster on fewer resources.
- Week 6Verify and hand over.Every remediated High-Risk Issue is verified against live configuration and telemetry, the week-six milestone is saved in your AWS Well-Architected Tool, and your team takes over the quarterly review cadence.
What you hold at the end.
Every deliverable is an artifact in your repositories or your inbox.
None of them is a promise in a deck.
- 01The Well-Architected Tool baseline.Your workload defined and scored across all six pillars directly in the AWS Well-Architected Tool inside your account, with the week-two milestone saved.
- 02The High- and Medium-Risk Issue register.Every HRI and MRI verified against your live accounts rather than self-reported, ranked by business impact and effort, each with the exact resources it touches.
- 03The current- and target-state diagrams.Architecture diagrams of the workload as it actually runs today, and the target-state changes that close each High-Risk Issue.
- 04The reliability and recovery analysis.Failure-mode trace across availability zones, data stores, dependencies, quotas, and backup paths, measured against your RPO and RTO targets.
- 05The security and operational gap analysis.Workload IAM roles, secrets, network boundaries, CI/CD deployment safety, observability coverage, and on-call alarm quality.
- 06The remediation roadmap.Every architectural fix sequenced by risk reduction and engineering effort, with pull-request-level scope. It is the Remediation’s plan customized to you, and what you run yourselves if you stop here.
- 07The sponsor readout.A concise written executive brief and closing walkthrough for engineering leadership.
- 08Every agreed High-Risk Issue closedas code in your repositories, each shipped through a pull request reviewed by the engineer who owns the service.
- 09Reliability controls in place:multi-AZ failover, automated backup verification, connection pooling, throttling protection, and service quota alarms.
- 10Workload security hardened:least-privilege execution roles, KMS encryption, secret rotation, security group boundaries, and VPC endpoints.
- 11Operational telemetry and alarms:dashboards, SLO-aligned alerts, deployment health checks, and automated rollback triggers wired to your on-call.
- 12Performance and cost tuning applied:compute, database, and storage configurations matched to measured traffic, with lifecycle rules on logs and object stores.
- 13Operational runbooksfor failure recovery, rollback, scaling events, and dependency outages, walked through with the engineers on call.
- 14The week-six Well-Architected milestonerecorded in your AWS Well-Architected Tool against week two. It is the artifact that decides the second invoice.
- 15The handover workshop,its recording, and the runbook for running your own Well-Architected milestones after major releases.
How much of Charles you get.
Fixed price does not mean unbounded.
The cap is in the statement of work, and so is what we need from you.
Over two weeks. About 8 of them are live with your team across the pillar sessions and readouts; the rest are live configuration inspection, architecture analysis, Well-Architected Tool documentation, and roadmap design.
Over six weeks, roughly 18 hours a week. About 38 of them are live with your team: the pillar sessions, the twice-weekly code reviews, the pairing on infrastructure changes, the office hours, and the readouts.
By written change order, agreed before the hour is spent. Remote by default; an on-site day is priced separately.
- One critical production workload and the AWS accounts that run it (up to 50 accounts in one AWS organization)
- All six pillars of the AWS Well-Architected Framework, plus the Serverless, SaaS, or Data Analytics lens where applicable
- Fixes in up to four infrastructure-as-code repositories, in the tool you already use: Terraform, CloudFormation, or the CDK
- A read-only inspection role in every account that runs or supports the workload within three business days of signature, from a CloudFormation template we hand you, plus access to record the workload and its milestones in your AWS Well-Architected Tool. The clock starts when that access exists.
- The workload’s lead architect or tech lead available at least four hours a week for pillar reviews and pairing
- The sponsor available for thirty minutes a week, and in the Remediation, pull-request reviews and change approvals within two business days through your normal release process
The rooms Charles leads.
Every meeting is on the calendar before week one.
Nothing else is asked of your engineers except the reviews and the pairing.
- Kickoff60 minutes
Sponsor, workload owner, and platform lead. Workload boundaries, RPO/RTO and SLO targets, access, and the two-week schedule.
- Architecture & reliability session90 minutes
Request flow, data stores, failure modes, backups, quotas, and scaling behavior with the engineers who run the workload.
- Security & operations session90 minutes
Workload identity, secrets, network boundaries, CI/CD pipeline, telemetry, alerting, and incident history.
- Performance, cost & sustainability session60 minutes
Instance and database sizing, caching, storage tiers, data transfer, and resource utilization against demand.
- HRI & roadmap review90 minutes, end of week two
Every High- and Medium-Risk Issue walked through with the engineering team: the live evidence, the proposed fix, and the sequence.
- Sponsor readout60 minutes, end of week two
The six-pillar scorecard, the agreed High-Risk Issue register, the roadmap, and what six weeks would close.
Weeks one and two are the Review’s: the kickoff, the three pillar sessions, the HRI review, and the sponsor readout. Then:
- Sponsor check-in30 minutes, weekly
High-Risk Issues open and closed, pull requests merged this week, and any trade-off waiting on a decision.
- Change review60 minutes, twice a week, weeks three through five
Every infrastructure and configuration pull request read with the workload owner before it ships, with its rollback plan.
- Pairing60 to 90 minutes, two or three times a week
Working directly with your engineers on reliability, security, observability, and performance changes in non-production first.
- Office hours45 minutes, twice a week
Drop-in architectural Q&A, weeks three through six.
- Week sixabout 5 hours across the week
The closing Well-Architected Tool milestone review, a 2-hour handover workshop, and the closing sponsor readout.
The tools of the engagement.
Nothing exotic, and nothing you have to buy.
Everything the engagement produces is recorded, transcribed, and left with you.
The inspection role
A read-only role in the accounts that run the workload, from a CloudFormation template you inspect before deploying and delete when we finish. It reads configuration, metrics, and billing, never application data or secret values.
AWS Well-Architected Tool
The workload, pillar notes, evidence references, and both milestones (week two and week six) are recorded in the AWS Well-Architected Tool inside your own AWS account, so the history stays with you.
Your repositories and pipeline
Every remediation in weeks three through five is written as code in your Terraform, CloudFormation, or CDK repositories, merged through your pull requests, and deployed by your pipeline.
Zoom
Every pillar session, review, and workshop is held on Zoom and recorded with your permission, with transcripts and recaps delivered alongside each recording.
Pavilion
Set up for your engagement in week one: the calendar, every recording with its transcript, the HRI register, architecture diagrams, and roadmap your sponsor accepts, in one archive you keep afterward.
Scheduling, approvals, risk acceptances, change orders, and invoices go by email, keeping the commercial record in your inbox.
Who this is for
- A CTO, VP of Engineering, or chief architect with a business-critical production workload on AWS
- A system preparing for enterprise scale, a major customer launch, due diligence, or a post-incident architectural reset
- Teams that want an independent, code-verified six-pillar review rather than a vendor sales pitch
- Budget authority for a fixed-price engagement without a procurement cycle
Who it is not for
- Teams looking for a free checkbox workshop to unlock partner promotional credits
- Organizations whose primary need is a 50-account compliance audit (see our Security Audit) or an organization-wide FinOps bill reduction (see our Cost Optimization)
- Workloads where no engineer is available to review and merge pull requests during weeks three through five
Not a checkbox workshop.
A review that ships the fixes.
Many AWS Well-Architected Framework Reviews are offered as free or subsidized partner lead generation: a few hours of questions answered from memory, an exported PDF of High-Risk Issues, and a follow-on statement of work to actually do the engineering. We verify every pillar against your live environment, and in the six-week engagement we close the High-Risk Issues with you.
A self-reported interview and a slide deck
A two- to four-hour workshop walking through the AWS Well-Architected Tool questions from memory, without reading your live configurations, IAM policies, CloudWatch telemetry, or Terraform state.
- Answers rely on what people in the room think is deployed in production
- Produces a generic console printout of High-Risk Issues without pull-request-ready designs
- Stops at the report, using the open HRIs to pitch an open-ended remediation contract
- Leaves your engineers with a long backlog and no capacity to close it
Verified against live accounts, closed in code
Two weeks of hands-on inspection across configuration, telemetry, billing, and code before we score the six pillars, followed by four weeks of shipping the fixes through your pull requests.
- Pillar answers backed by live resource configurations, metrics, and IaC inspection
- Delivers concrete target-state architecture diagrams and sequenced, PR-scoped fixes
- Closes every agreed High-Risk Issue as code in weeks three through five
- Half the six-week fee rides on closing every agreed HRI in the week-six milestone
When to choose Security Audit or Cost Optimization over a WAFR.
A Well-Architected Framework Review evaluates one production workload across all six pillars. If your immediate pressure is across your entire AWS organization — up to 50 accounts — choose the specialized engagement built for that job: the AWS Security, Compliance & Governance Audit for CIS/AWS benchmark scanning and SOC 2, HIPAA, PCI DSS, or ISO 27001 mapping across every account, or AWS Cost Analysis & Optimization for a twelve-month Cost and Usage Report baseline and a 3× fee savings guarantee.
The receipts
Six pillars are only as good as the production systems they have been tested on.
Client names withheld per NDA.
Who does the work
Charles Sieg. AWS Certified Solutions Architect — Professional, DevOps Engineer — Professional, and Security — Specialty, plus Data Engineer — Associate and AI Practitioner. Cloud architect and platform engineer for Fortune 1000 clients across healthcare, pharma, insurance, and financial services, on AWS bills from $20,000 to more than $300,000 a month. Both engagements are delivered by Charles personally, inside your accounts and repositories, with your engineers.
Questions a CTO asks first
What counts as one workload?
In the AWS Well-Architected Framework, a workload is the set of components that together deliver business value — for example, a customer-facing SaaS platform, a checkout and payments pipeline, or a real-time data platform — across the production, staging, networking, and shared-services accounts that support it (up to 50 accounts in one AWS organization). We agree on the exact workload boundary before you sign.
Why pay for a Well-Architected Review when some AWS partners offer one for free?
A free partner WAFR is a pre-sales discovery call: a few hours of self-reported questions in a conference room to qualify you for a follow-on consulting contract or partner funding. We do not sell follow-on staffing. We inspect your live AWS accounts, telemetry, billing, and Terraform or CDK code for two full weeks, design the exact architectural fixes, and in the six-week Remediation we write and ship the code with your team under a result guarantee.
How does this differ from the Security Audit or Cost Optimization engagements?
A Well-Architected Review goes six pillars wide on one critical production workload: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. Our Security Audit goes deep on security, governance, and compliance across an AWS organization of up to 50 accounts, and our Cost Optimization engagement goes deep on your entire twelve-month Cost and Usage Report with a 3× savings guarantee. If one flagship system is keeping you up at night across reliability, scaling, security, and operations together, start here.
What counts as a High-Risk Issue (HRI) for the guarantee?
The AWS Well-Architected Tool flags a High-Risk Issue when a foundational best practice across any of the six pillars is missing and exposes the workload to significant risk of outage, data loss, security compromise, or runaway cost. In week two we verify every HRI against your live environment and agree on the written HRI register with your sponsor. That agreed list is what the week-six milestone and the second half of the fee are measured against.
What if an HRI requires a multi-quarter application rewrite?
We tell you plainly in week two. If an HRI cannot be closed safely through infrastructure, configuration, and platform changes within six weeks — or if you decide the business trade-off is not worth making right now — you can record it in writing as an accepted risk or deferred roadmap item at the readout, and it counts as closed for the guarantee.
Do you record the review in our AWS Well-Architected Tool?
Yes. We create or update the workload directly inside the AWS Well-Architected Tool in your own account, record the week-two baseline milestone, and in the Remediation record the week-six milestone. Nothing is locked in an external consultant portal.
Do you ever change production directly?
No. Every architectural change in weeks three through five is written as code in your repositories, reviewed in a pull request by the engineer who owns the workload, tested in non-production first, and deployed through your pipeline.
How much of Charles’s time do we actually get?
Up to 40 hours in the Review and up to 110 in the Remediation, with about 8 and 38 of those hours live with your team. The caps are written into the statement of work. Anything beyond them is a written change order at $450 per hour, agreed before the hour is spent.
Three more fixed-price engagements.
Same two shapes, same two prices.
Two weeks and $25,000 for the diagnostic, six weeks and $35,000 for the result.
Engineering Leverage
Your board asked what the company is getting from Claude Code, and the honest answer is faster autocomplete.
Read the engagement
AWS Cost Analysis & Optimization
The AWS bill grew faster than the business, and nobody can say who owns which line.
Read the engagement
AWS Security, Compliance & Governance Audit
An audit is coming, a customer sent a security questionnaire, or nobody can say for certain who can reach production.
Read the engagementStart with a short call.
Tell us what the workload does, which AWS services it leans on, and what prompted the review. You will hear back from Charles within one business day, and the first call is fifteen minutes.
AWS, Amazon Web Services, AWS Well-Architected, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. Zoom is a trademark of Zoom Video Communications, Inc. Vantalect is not affiliated with or endorsed by either.