Cloud-Native Engineering & DevSecOps
Cloud infrastructure, CI/CD, security-by-design, and site reliability on AWS and Azure.
Overview
We have been building and running cloud-native systems since 2013, early enough that the term was not yet a selling point. Nearly everything we have delivered runs on AWS or Azure.
Before the market had decent Infrastructure as Code tooling we wrote our own, Hamlet, also known as CodeOnTap. Having built one, we know where the current ones break and how to write definitions that still make sense two years later.
We are an AWS Gold Partner, and the portfolio splits roughly evenly between AWS and Azure, including Azure for Australian Government and Protected tenancies. Left to choose we take AWS, for cost and for the breadth of its managed services. Either is fine.
How We Deliver
PaaS-First Architecture
We prefer managed platform services wherever practical, reducing operational complexity and improving resilience:
| Concern | PaaS Preference | IaaS Fallback |
|---|---|---|
| Compute | AWS Fargate / Azure Container Apps | ECS on EC2 / Azure VMs |
| Database (SQL) | AWS RDS / Azure SQL Database | Self-managed PostgreSQL |
| Database (Document) | AWS DocumentDB / Azure Cosmos DB | Self-managed MongoDB |
| Object Storage | AWS S3 / Azure Blob Storage | — |
| Message Streaming | AWS Kinesis / Azure Event Hubs | Self-managed Kafka/Pulsar |
| Workflow | AWS Step Functions | Self-managed Temporal |
| Monitoring | AWS CloudWatch / Azure Monitor | Prometheus + Grafana |
| CDN / Edge | AWS CloudFront / Azure Front Door | — |
PaaS services handle patching, scaling, backups, and failover automatically, freeing the team to deliver business value rather than manage infrastructure.
Infrastructure as Code
All infrastructure is defined in version-controlled code and deployed through automated pipelines. Nothing is configured by hand in a console.
| Tool | Use Case |
|---|---|
| Pulumi | Preferred general-purpose IaC in Python or TypeScript, supporting multi-cloud |
| Terraform | Declarative IaC where client ecosystems favour it |
| AWS CDK | AWS-specific projects benefiting from native constructs |
| Azure Bicep | Azure-native projects and APO environments |
Every solution is deployable to the developer’s local environment (Docker Compose) and promoted through integration, pre-production, and production using the same IaC definitions.
Security by Design
Security is embedded at every layer, not bolted on before go-live:
At the network layer that means VPC isolation, data stores on private subnets, and services behind load balancers and firewalls.
Identity runs on OAuth2 or SAML, with role-based access at least privilege and MFA on anything privileged. Data is encrypted at rest through KMS or Key Vault and in transit over TLS 1.3, and secrets never live in code.
In the pipeline, SonarQube and OWASP ZAP run static and dynamic analysis on the way through, with dependency scanning on every build. GuardDuty or Azure Defender watch for threats, and PagerDuty wakes someone when they find one.
CI/CD
Every project follows the same automated release process from developer commit through to production, with quality gates at every stage. Our agile delivery practice describes the full sprint and release cycle. On mature projects such as National Parks, this pipeline has supported over 200 production releases with zero failures.
Principles
- Everything as code. Infrastructure, configuration, monitoring rules and pipelines all live in version control, so any environment can be rebuilt rather than repaired.
- PaaS over IaaS. Let the provider carry the patching, scaling and failover. It is more reliable than we would be, and it frees the team for the work that is actually ours.
- No vendor lock-in. Open-source and cloud-agnostic where practical, and the client holds all the infrastructure code regardless.
Policy Alignment
- ACSC Essential Eight — Automated patching through PaaS, application control through containerisation, restricted admin privileges, MFA enforcement, automated backups.
- AWS Well-Architected Framework — All six pillars applied through IaC, automated monitoring, and PaaS-first design.
- OWASP Top 10 — SAST/DAST in pipelines, input validation, secure API design, dependency scanning.
Evidence
- Case Study: National Parks e-Ticketing — Cloud-native AWS platform since 2015, 200+ zero-failure releases, 99.999% availability.
- Case Study: DAFF Application Maintenance — 8 systems on AWS; WAF neutralised 141,879 threats in a single month with zero breaches.
- Case Study: COVIDSafe — Back-end portal built on AWS in weeks, security-hardened with ACSC collaboration.
- Case Study: Medical Cost Finder — MVP to mature cloud-native platform on Azure over multiple years, 47 production releases.
- Staff: Kseniya Shychko — DevOps lead; developer of Hamlet/CodeOnTap IaC platform.
- Staff: Girish Patil — IaC expertise with Pulumi; contributor to GoSource Pulumi open-source library.
Tools & Technologies
- Infrastructure as Code: Pulumi (preferred), Terraform, AWS CDK, Azure Bicep
- CI/CD: GitHub Actions, AWS CodePipeline, Azure DevOps Pipelines
- Containerisation: Docker, Docker Compose, AWS ECS/Fargate, Kubernetes
- Cloud Platforms: AWS (Gold Partner), Microsoft Azure (including APO)
- Security: SonarQube, OWASP ZAP, AWS Inspector, GuardDuty, Security Hub
- Testing: pytest, Jest, Cucumber/Gherkin, Playwright, Postman/Newman, Locust