AWS VPC & Network Architecture
Subnets, routing and security groups laid out so the next person can read them.
From $349 2–4 days
EC2 Server Setup & Hardening
A server built the way you would build it on day 400, not day one.
Price and scope
From $199
Typically $199–$449, fixed in writing before anything starts.
What moves it up
- An existing box carrying live traffic, rather than a fresh instance
- Software already installed by somebody else, with no record of how
- A compliance requirement that dictates the disk encryption or the log retention
Some of this you can check yourself, right now, for free: Self-Managed VPS vs Managed AWS →
What actually goes wrong
Almost nobody builds an insecure server on purpose. What happens is that the first instance is a test, the test works, and the test becomes production without anyone deciding that it should. So it keeps the things a test can afford: port 22 open to the world because that was quickest, a key pair emailed to whoever needed access, an unencrypted root volume because the checkbox was on the next screen, and no patching schedule because it was going to be thrown away.
How I find it
aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,KeyName,PublicIpAddress]'aws ec2 describe-volumes --query 'Volumes[?Encrypted==`false`].[VolumeId,Attachments[0].InstanceId]'aws ssm describe-instance-information — which instances the agent can actually reachaws ec2 describe-security-groups --filters Name=ip-permission.from-port,Values=22
What you get
- SSM Session Manager working, so administrative access needs no open SSH port and no shared key
- An IAM instance role scoped to what the workload uses, replacing any credentials on disk
- Encrypted volumes, with the key and its rotation documented
- A patch baseline and a maintenance window, applied on a schedule rather than when somebody remembers
- CloudWatch agent shipping the logs and the metrics that matter, with disk space among them
Questions
Will I lose SSH access to my own server?
Only if you want to. Session Manager gives you a shell through IAM without an open port, which is strictly better, but the SSH path stays until you have used the new one and are happy with it. Removing it is a separate decision you make afterwards, not something that happens to you during the work.
Can you harden a server that is already serving traffic?
Yes, and most of them are. The work is ordered so that nothing which could interrupt a request happens without an agreed window — agent installation, IAM roles and logging go on live; anything touching the network path or requiring a reboot waits.
What about the software running on it?
This covers the instance: access, disks, patching, logging, the operating system. Your application on top of it is a different piece of work, and if what you actually need is the app hardened rather than the box, say so and I will quote that instead.
Do I need this if I am on Lightsail?
Some of it. Lightsail hides the parts of EC2 that make this straightforward — no instance roles, no SSM in the same way — so the answer is usually shorter and sometimes it is "move to EC2 first". I will tell you which before you pay for anything.
If this is not quite it
Website / Application Migration to AWS
Moved onto AWS with the cutover rehearsed, the DNS planned, and the old host still standing.
From $459 2–5 days
Want this done?
Tell me what you are running and I will come back with a fixed price and a date. If it turns out you do not need this, I will say that instead.
Prefer to talk? Book a free call ↗ · Or hire me on Upwork ↗ · Typical reply within one business day.
Before you enquire
When I answer
Sunday to Thursday, 09:00–18:00 EET. Outside that I will still look, but I will not promise a time.
No 24/7 desk, and I will not pretend otherwise
One person, one time zone. If round-the-clock cover is what you need, you need a team, and I will say so rather than sell you a plan that cannot deliver it.
Your AWS bill stays yours
You pay Amazon directly and you keep control of the account. Nothing here resells your infrastructure or sits between you and your own billing.
A price that starts with "from" is a starting price
Every service page lists exactly what pushes a quote above it, before you ask. You get a fixed number in writing before any work begins.