Cloud Migration & Architecture
Cloud Migration & Architecture
Moving to AWS is rarely the hard part. Getting the account structure, the network, and the ownership boundaries right — before you move — is what separates a clean migration from months of firefighting.
I design and deliver cloud-native and hybrid architectures on AWS, and lead migrations of real workloads from on-premises and SaaS platforms into production.
What I Deliver
Solution Architecture (Well-Architected)
Target architectures designed against the AWS Well-Architected Framework — not just a diagram, but decisions you can defend.
- Multi-account organization and landing zone design
- Compute selection: EC2, ECS, EKS, Lambda — matched to the workload, not the hype
- Data and storage: RDS, S3, lifecycle and retention strategy
- Edge and delivery: CloudFront, API Gateway, Route 53
- Reliability, security, cost, and operational-excellence trade-offs made explicit
Workload Migration
Phased migration from on-premises or SaaS platforms into AWS, with a cutover plan and a rollback plan.
- Discovery and current-state assessment before anything moves
- Staged cutover with validation gates at each phase
- Rollback safety and metadata preservation (learned the hard way, applied by default)
- Example: on-prem/SharePoint-to-S3 archival pipeline for a government client
Cloud Networking
The part most migrations underestimate.
- VPC design, segmentation, and routing
- Transit Gateway topologies for multi-account connectivity
- Site-to-Site VPN, Client VPN, and FortiGate SSL-VPN integration
- Hybrid connectivity and DNS (Route 53 / Resolver, split-horizon)
- Diagnosing “the route exists but traffic blackholes” — return-path, security-group, and NACL issues
Security & Review
- IAM and SSO design, least-privilege boundaries
- Segmentation, WAF/Shield posture review
- Architecture and security reviews of existing environments
- Incident response and root-cause analysis against live CloudWatch, CloudTrail, and ALB evidence
How Engagements Work
-
Discovery & Assessment — Current-state review of your workloads, accounts, and network. Delivered as a findings report with a recommended target architecture.
-
Reference Architecture & Runbook — A documented target design plus a step-by-step migration runbook your team can execute.
-
Hands-On Migration — I run the migration alongside your engineers, phase by phase, with validation and rollback at each gate.
-
Architecture Review — Async review of an existing AWS environment against the Well-Architected Framework, with a prioritized remediation list.
Who This Is For
- Teams moving on-premises or SaaS workloads to AWS for the first time
- Organizations with sprawling multi-account setups where connectivity has become fragile
- Enterprises and government clients that need a defensible, documented architecture
- Teams that have “finished” a migration but are now firefighting networking and cost
Why Work With Me
- Real migrations, government and enterprise — Not reference diagrams; production cutovers with rollback plans
- Networking depth — Transit Gateway, VPN, hybrid, and the diagnosis skills for when it breaks
- Former AWS Authorized Instructor (2022–2025) — I explain architecture decisions clearly to engineers and non-technical stakeholders alike
- 5 AWS certifications — Solutions Architect, SysOps, Developer, Cloud Practitioner
- Backend-to-architecture — 10+ years building the workloads first, so I design for how systems actually behave under load
Next Step
Tell me what you’re migrating, where it lives today, and what the deadline looks like. I’ll give you an honest initial assessment — including whether the timeline is realistic — in the first call.
Contact: toni@kusnandar.dev or LinkedIn
Pertanyaan yang Sering Diajukan
-
What kinds of migrations have you actually done?
- Real engagements, not slideware. Recent work includes an on-premises/SharePoint-to-AWS archival pipeline for a government client — staged cutover with rollback safety and metadata preservation — plus multi-account networking and connectivity design across dozens of accounts (Transit Gateway, Site-to-Site and Client VPN, FortiGate SSL-VPN, hybrid routing). I migrate workloads with a plan for the day something goes wrong, not just the happy path.
-
Do you design the target architecture or just execute?
- Both, depending on what you need. I can deliver a reference architecture and migration runbook for your team to execute, run the migration hands-on alongside your engineers, or review an architecture you already have against the AWS Well-Architected Framework. Most engagements start with a discovery and current-state assessment before anything is committed.
-
How do you handle networking across multiple accounts?
- Networking is where most cloud migrations quietly break. I design VPC layouts, Transit Gateway topologies, Site-to-Site and Client VPN, DNS (Route 53 / Resolver), and cross-account connectivity so the pieces actually route end to end — and I can diagnose an existing setup where 'the route exists but traffic still times out,' which is a different problem from no route at all.
-
What does an engagement cost?
- Migration and architecture work is scoped project-based after a discovery call, because the number depends on workload count, data volume, and how much hands-on execution you need versus guidance. You get a fixed-scope proposal with milestones before any contract is signed — no open-ended hourly billing.
Technologies
