Server racks in a data hall, cloud infrastructure as a real system

WezDev

AWS · infrastructure · Manchester

AWS you can rebuild when something fails.

I build serverless backends on AWS and define them in Terraform or CDK, so an environment can be rebuilt instead of clicked together. By day that includes VPC networking in a regulated environment. IAM and monitoring are part of the work either way. I am based in Manchester.

Work with meGet started

The work

Cloud-native is not a weekend in the console.

Manchester teams do not need another “we use AWS” slide. They need infrastructure defined in code, permissions that hold, and a way to see what broke.

What this actually means

The unit of work is a function, a queue, a table. IAM is part of the product. If you cannot draw the blast radius of a role, you do not ship it. My day job is serverless backends in a regulated environment, and those stacks run inside a VPC: private subnets, security groups, NAT or VPC endpoints, not open internet by default. AfroFind and MOMO Lens are different products. They share the same delivery habits (TypeScript, IaC thinking, production monitoring) but they are not VPC systems. Do not read this page as if every project I ship looks like the regulated day job.

Define it in code

Terraform and CDK. Environments should be rebuildable: Lambdas, queues, tables, alarms, and where the job needs it, the VPC and security groups too. Secrets stay out of the repo. The pipeline is how it gets to production, not a zip uploaded by hand. Drift between the console and the stack is how you get a surprise on a Friday. My opinion is simple. If it is not in code, it is not finished.

Observability is not a dashboard you add later

When something fails, you need three different kinds of signal, not one pretty chart. CloudWatch is where metrics and logs live: latency, errors, throttles, cold starts, queue depth. That answers “is it slow or broken?” CloudTrail answers “who changed what?” AccessDenied storms, role changes, and quiet API errors show up there long before a customer writes an angry email. AWS’s own incident guidance treats mean time to recover as the gap from first alert to safe operations again. That number only moves if you can tell a timeout from an IAM miss from a bad config without opening five tabs. On the regulated day-job stacks, a dead route in the VPC is another common false friend for “Lambda is broken.” Dynatrace sits on top when the environment already has it: traces across services, so you see which hop died instead of guessing. I would rather ship fewer widgets and one runbook that names the next step. A dashboard nobody trusts is worse than none.

Hand it over without a mystery tour

Someone else should be able to read the stack, tighten a role, and ship a release without asking you which console tab to open. On day-job work that also means reading the VPC and security groups. That is the bar. TypeScript on Lambda, API Gateway, DynamoDB, SQS, GitHub Actions. I do this from Manchester, usually remote.

Proof

Shipped product, then the ops behind it.

Tap a still. AfroFind is a live platform I built. The next two are how I think about code and failure on AWS: define it so you can rebuild it, and make alarms answer a real question.

AfroFind discovery platform on a laptop beside MOMO Lens on a phone

AWS · Terraform · ops

Cloud-native delivery

Layer: Live product

Hard part: A backend that only exists in the console cannot be rebuilt, reviewed, or handed over.

Outcome: Ship a real product surface, keep the stack in code, and wire signals that tell you timeout versus IAM versus a bad deploy. VPC work sits on the regulated day-job side, not on AfroFind or MOMO Lens.

See AfroFind

Layers

What has to be right before go-live.

Select a layer. This is the conversation I want in a brief, not a list of service names.

Compute

Lambda and the API in front

Functions, timeouts, retries, and cold starts are the product, not footnotes. API Gateway is where auth and throttling live. If that is vague, the rest of the stack will be too.

Compute
Lambda and the API in front. Functions, timeouts, retries, and cold starts are the product, not footnotes. API Gateway is where auth and throttling live. If that is vague, the rest of the stack will be too.
Network
VPC on the day job. In regulated work I put Lambda behind a VPC on purpose: private subnets, security groups, NAT or VPC endpoints. Slower to set up. Easier to explain when traffic should not touch the public internet. AfroFind and MOMO Lens do not use that pattern. Same engineer, different constraints.
Data
Access patterns first. DynamoDB and queues. Design the reads and writes before the table. SQS is for work you cannot afford to drop. A pretty schema that fights the access pattern will cost you later.
Identity
IAM is the architecture. Roles, resource policies, who can invoke what. Get this wrong and nothing else matters. Least privilege is slower to write. It is cheaper than an incident. CloudTrail is how you prove what happened after the fact.
Ops
Alarms you can act on. CloudWatch for metrics and logs. CloudTrail for change and AccessDenied. Dynatrace for traces when it is already in the account. The thing you need at 2am is a signal you trust and a next step, not five tabs and a guess. Cypress and CI before it reaches production.

Hard parts

The work that actually decides if it holds.

These show up on every serious AWS engagement. They are also why a console-only build falls over.

IAM and tenancy

Who can call what, with which data. If tenancy is painted on afterwards, you will leak. On regulated day-job stacks that also means which subnet and security group. Spell it out in the stack, not in a wiki.

IaC that matches live

Terraform and CDK should describe what is actually running. Where the job uses a VPC, that belongs in code too. Click-ops drift is how production becomes un-reproducible. The pipeline is the source of truth.

Signals you can act on

An alarm without a next step is noise. Metrics tell you something is wrong. Traces tell you where. CloudTrail tells you whether someone or something changed the path. Then you fix the release, not the screenshot.

What you hire

Developer laptop with application code on screen

02

Cloud-native delivery

Serverless backends on AWS: Lambda, API Gateway, DynamoDB, SQS. Defined in Terraform and CDK, with the IAM, networking, and ops work that has to be right before anything goes live.

FAQ

Straight answers.

Who does the AWS work at WezDev?

Wez Kambele is a software engineer based in Manchester. Day job is serverless systems in a regulated environment, including VPC networking. AfroFind and MOMO Lens share delivery habits (TypeScript, IaC thinking, production monitoring) but they are not VPC stacks.

What AWS services do you actually use?

Lambda, API Gateway, DynamoDB, SQS, IAM, CloudWatch, CloudTrail. Defined in Terraform and CDK. GitHub Actions for CI. Dynatrace when the environment already has it. VPC, private subnets, and security groups on the regulated day-job side.

Why put Lambda in a VPC?

On regulated day-job systems, so the function can reach private data stores and stay off the public internet by default. You pay a bit of cold-start and setup cost. You gain security groups, private subnets, and a network path you can explain. That is not how AfroFind or MOMO Lens are built. Different products, different constraints.

Do you only do greenfield?

No. A lot of the work is making an existing AWS account reproducible: locking down IAM, putting the stack in code, and adding alarms that mean something. Where a VPC already exists, that belongs in code too. Greenfield is cleaner. It is not the only shape.

Where are you based?

Manchester, United Kingdom. Remote is normal. Being able to meet in the city is useful. It is not required.

How do I start?

Send a short brief on Get started: what is live now, what has to change, and what “done” means for the first slice. You can also email contact@wezdev.co.uk.

Is this cloud consulting in the agency sense?

No. I do not sell a generic migration package or a WordPress host on Lightsail. This page is for teams who need production AWS: IAM, IaC, ops, and VPC where the environment requires it. If you only need a brochure site, I am the wrong hire.

Related: Product platforms in Manchester · Production SaaS in Manchester · Work with me

Next

If the backend has to be rebuildable, start with a brief.

Tell me what is live, what is click-ops, and what has to hold. I will tell you whether I am the right engineer for it.

Work with meGet started

Your privacy

Cookies help us understand journeys — not sell your data.

We use essential cookies for theme and consent. With your permission, analytics shows which pages and projects people explore so the site can improve. You can change this anytime.