Cloud infrastructure that just works.

Cloud infrastructure decisions made in the first 12 months of a product often compound for years — the wrong provider, premature Kubernetes adoption, or absent FinOps controls can quietly consume 30–40% of engineering budget with no business return. This section gives you the data and frameworks to make those decisions with eyes open, not after the invoice arrives.

Cloud Provider Selection: Where Each Platform Wins

Provider selection is not a technical preference question — it is a business context question. The wrong choice costs 12–24 months of migration work later. Use the table below as a starting point, then validate against your specific compliance requirements, team experience, and workload profile.

Source: Synergy Research Group Q3 2024; Stack Overflow Developer Survey 2024 (AWS 48%, Azure 28%, GCP 28% developer usage). AWS holds the largest market share for the 8th consecutive year but faces slow erosion as Azure and GCP capture enterprise and data workloads respectively.

Infrastructure as Code: The 2025 Decision

HashiCorp's August 2023 relicensing of Terraform from MPL 2.0 to the Business Source License (BSL 1.1) reshaped the IaC landscape and forced teams to make a deliberate choice where none existed before. For end users running their own infrastructure, the BSL has no practical impact. For vendors embedding Terraform commercially, it is a different calculation — and that shift created real community momentum behind OpenTofu, the Linux Foundation fork that reached GA in January 2024 with 800+ GitHub contributors within 12 months of the fork.

DeepLearnHQ take: We default to OpenTofu for greenfield projects and Terraform for teams with existing HCL codebases. Pulumi is our choice when infrastructure logic is genuinely complex — not because it is fashionable, but because HCL breaks down on real conditionals. We have never recommended CDK to a team that was not already 100% committed to AWS for the foreseeable future.

Kubernetes: Managed Cluster vs Managed Container Service

The CNCF Annual Survey 2024 found 84% of respondents running Kubernetes in production — up from 66% in 2020. That saturation masks the real question: who manages the control plane and what operational surface are you accepting? EKS costs $0.10/hour per cluster before any compute — that is $876/year just to have the cluster exist. For teams running fewer than 10–15 services with predictable traffic, managed container services (Cloud Run, Fargate, Azure Container Apps) deliver most of the value at a fraction of the operational burden. The Kubernetes migration trigger is roughly $3,000–$5,000/month in compute spend with a dedicated platform engineer available to manage it. Before that threshold, Kubernetes is a tax on engineering velocity, not a benefit.

Cloud FinOps: The 30% Waste Problem

Gartner's 2024 estimate: 30% of all cloud spend is wasted — idle or oversized instances, unattached volumes, over-provisioned databases, forgotten development environments, and unmonitored egress. That figure has been consistent across multiple years of reporting. At $100K/month cloud spend, that is $30,000/month in recoverable cost. The discipline to recover it requires process, not just tooling. Most teams that run their first FinOps review discover the same thing: the waste was always visible in the data — nobody was looking at the data.

FinOps Maturity: Crawl, Walk, Run

Crawl — Cost Visibility. Tag all resources by team and product from day one. Retroactive tagging is painful; most teams discover 15–20% of spend is untagged and unattributable when they attempt it later. Enable AWS Cost Explorer, Azure Cost Management, or GCP Billing dashboards. Set billing alerts at your expected monthly spend and at 2x that figure — the second alert is the early warning before a bad month becomes a crisis. Walk — Optimization. AWS Compute Savings Plans offer approximately 30% discount (1-year, no upfront) over on-demand for committed workloads. Right-sizing is the highest-ROI single action: AWS Compute Optimizer and Azure Advisor surface recommendations from utilization data, and the standard finding is that 40–60% of EC2 instances are oversized by one size class or more, delivering 8–15% savings when addressed with load testing validation. Run — Unit Economics. Cost per API call, cost per customer, cost per transaction. This requires tagging discipline propagated through CI/CD and product teams owning cost metrics. The cultural shift from showback (informational reporting) to chargeback (actual P&L impact) is the milestone that signals genuine FinOps maturity.

FinOps Tooling in the CI/CD Pipeline

Infracost. Open-source tool that integrates into CI pipelines to show the cost delta of infrastructure changes before merge. A PR adding a new RDS instance or changing an EC2 type surfaces the monthly cost impact as a PR comment — at the same review moment as code quality checks. This is a non-negotiable addition to any IaC CI pipeline. OpenCost. CNCF Incubating project, Prometheus-compatible cost allocation for Kubernetes by namespace, deployment, and pod. The right answer for teams wanting Kubernetes cost visibility without Kubecost Enterprise pricing. CAST AI. ML-driven Kubernetes cost optimization handling right-sizing, spot instance management, and bin-packing automatically. Customer case studies report 50–60% Kubernetes cost reduction; uses read-only analysis mode before any automation is enabled. Pricing: percentage of savings realized — aligns vendor incentives with client outcomes.

DeepLearnHQ take: We instrument Infracost on every IaC PR from week one of an engagement. The first month typically surfaces two to four infrastructure changes that would have added $3,000–$8,000/month in unplanned spend. The tool pays for itself in the first sprint and permanently changes the team's instincts about infrastructure cost.

CI/CD Platform Selection

The CI/CD platform decision is deceptively consequential. Migrating a complex pipeline ecosystem mid-project is expensive, vendor lock-in through marketplace integrations is real, and the wrong choice creates friction that compounds across thousands of developer interactions per month. Make this choice with an explicit evaluation rather than defaulting to whatever the team used last.

Platform Comparison and Workload Decision Map

GitHub Actions. The default for teams already on GitHub. Tight integration with GitHub Events, a marketplace of 20,000+ actions, and a generous free tier (2,000 minutes/month for private repos) created gravitational pull most competitors could not withstand. The Stack Overflow Developer Survey 2024 found 56% of developers use GitHub Actions for CI/CD, up from 45% in 2022. That adoption rate drives tool ecosystem investment and community support. Pricing: Linux runners at $0.008/minute. Key limitation: large-matrix builds can exhaust concurrent runner limits; self-hosted runners solve this at the cost of infrastructure overhead. GitLab CI. The strongest end-to-end DevSecOps platform when you want source control, CI, container registry, security scanning, and release management in one product. GitLab Ultimate includes SAST, DAST, dependency scanning, and container scanning natively, removing the need for separate security tool integrations and reducing audit surface. CircleCI. Lost significant market share to GitHub Actions between 2022–2024. The January 2023 security incident (compromised session tokens) damaged enterprise trust and accelerated migrations. Viable for teams with existing CircleCI pipelines; not the right choice for greenfield in 2025. ArgoCD. Not a CI tool — a continuous delivery controller that syncs Kubernetes cluster state to a Git source of truth. GitHub Actions or GitLab CI handles build-and-push; ArgoCD handles deploy-to-cluster. They are complementary, not competitive. Used by approximately 47% of Kubernetes users (CNCF 2024).

DeepLearnHQ take: For new projects on GitHub: GitHub Actions plus ArgoCD for Kubernetes deployments is our default recommendation. For teams evaluating GitLab: the all-in-one proposition is genuinely compelling if security and compliance requirements are complex. We avoid recommending CircleCI for greenfield in 2025; the trust damage from the 2023 incident persists and migration to GitHub Actions is well-understood.

Security Architecture by Company Stage

Cloud security failures are almost always architectural, not operational — a misconfigured S3 bucket, an over-permissive IAM role, a public RDS instance exposed by a default setting. The Verizon DBIR 2024 analyzed 10,626 confirmed breaches and found that credential abuse accounted for 77% of web application attacks. The IBM Cost of a Data Breach Report 2024 put the average breach cost at $4.88 million — a 10% year-over-year increase and the highest on record. The investment to prevent that incident is a fraction of that figure at every company stage.

Minimum Viable Security Posture by Stage

Seed stage ($0–$2M ARR). Non-negotiables: MFA everywhere (Okta or Google Workspace SSO); no secrets in code (git-secrets, pre-commit hooks, Doppler or AWS Secrets Manager); dependency scanning in CI (Dependabot, 5 minutes to configure); IAM least privilege for all cloud roles; backups tested quarterly with automated restore verification. Engineering cost: 10–20 hours of setup time, approximately $500/month in tooling. This list has no acceptable shortcuts. Series A/B ($2–$20M ARR). SOC 2 Type II (enterprise customers will require it — start the 12-month observation period 12 months before you need the certification, not 3); SIEM with alerting (AWS Security Hub plus GuardDuty, or Datadog Security); annual penetration test ($15,000–$30,000 for black-box external); security champion in each engineering team. Tooling cost: $5,000–$15,000/month. Enterprise ($20M+ ARR or regulated). CSPM (Wiz, Lacework, or Orca Security); Zero Trust network access; full SBOM generation and management; 24/7 MDR or SOC coverage; formal red team exercise annually; ISO 27001 or SOC 2 plus FedRAMP/HIPAA as applicable. Cost: $50,000–$200,000+/month depending on scope.

Supply Chain Security: SLSA and Sigstore

US Executive Order 14028 (May 2021) set in motion a broad industry shift toward software supply chain transparency. By 2024, SBOM (Software Bill of Materials) generation is a standard expectation in enterprise procurement. The SLSA (Supply-chain Levels for Software Artifacts) framework defines build integrity levels: Level 1 (build process documented, provenance available); Level 2 (hosted build service, signed provenance); Level 3 (hardened build environment, non-forgeable provenance). Sigstore/cosign enables keyless signing of container images using OIDC identity — by 2024, major open source projects including Python, Node.js, and Kubernetes adopted Sigstore for release artifact signing. The Verizon DBIR 2024 reported that third-party and supply chain components were involved in 15% of breaches, up 68% year-over-year — making this a material business risk, not an advanced practice.

DeepLearnHQ take: On every engagement, we configure AWS Security Hub, GuardDuty, and resource tagging on day one — not in the last sprint before an audit. The clients who treat security controls as a deployment prerequisite rather than a compliance artifact have never had a cloud incident requiring public disclosure. The correlation is not subtle.

Evaluating a Cloud DevOps Partner

The questions below distinguish practitioners with real project experience from consultants who have read the documentation. Ask them in a technical conversation with the engineers who will do the work — not the sales team, not the solutions architect assigned for the pitch.

Six Qualification Questions

1. "Walk me through a Kubernetes migration you did in the last 12 months. What went wrong and how did you recover?" A credible answer includes a specific failure mode — node autoscaling misconfiguration, etcd backup gap, ingress controller incompatibility — and a concrete recovery. Vague answers about "challenges navigated successfully" are a yellow flag. 2. "What is your position on Terraform versus OpenTofu versus Pulumi?" A partner without a view on this is not a senior practitioner. The right answer for your context is derivable from your situation; they should be able to derive it. 3. "How do you handle secrets in CI/CD?" Environment variables baked into images is wrong. Secrets Manager or Vault with short-lived credentials fetched at runtime is right. No ambiguity. 4. "What do you use for cost management and how do you report it?" No answer here is a significant yellow flag. Infracost in CI, tagged resources from day one, and regular FinOps reviews are table stakes for any competent cloud team. 5. "Which compliance frameworks have you audited against, and what was your role?" Distinguish between "we helped a client prepare controls documentation" and "we built the technical controls and supported the auditor evidence collection." 6. "What happens to the IP and documentation when the engagement ends?" All IaC code, architecture decision records, runbooks, and operational documentation should be fully owned by the client. Ambiguity on this point is a signal that lock-in is being built by another name.