S2K DevOps

AWS Infrastructure

We are experts in delivering a complete Infrastructure As Code suite on AWS including auto-maintenance and auto-healing. Our max-automated approach help clients achieve highly reliable project infrastructure with resilience, Business Continuity, Disaster Recovery and Monitoring/Alerting bundled together, exploiting the full power of AWS/cloud technology.


  • Infrastructure created completely using code.
  • Fully and semi automated maintenance.
  • Auto-healing issues everywhere possible.
  • Virtual, Container based and hybrid solutions.
  • Zero downtime maintenance and deployment.
  • Follow, apply and provide consultation of best practices,
  • Provide proactive monitoring of all infrastructure components
  • Fully automated and efficient CI/CD pipeline
  • Highly modular and portable Infrastructure
  • Blue/Green/multi-stream deployment strategy


  • Infrastructure in minutes.
  • Modular design to easily switch between cloud providers.
  • Automation reduces manual efforts, time and errors.
  • Complete coding reduces thickness of user/developer manuals.
  • Proactive monitoring reduces incidents and downtime.
  • Multi-stream strategy facilitates zero downtime deployment/regression.
  • Dynamic auto-scaling to reduce operating costs.
  • IAC + automation +cloud approaches brings in high flexibility.


£650 to £1,200 a person a day

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at operations@s2ksystems.com. Tell them what format you need. It will help if you say what assistive technology you use.


G-Cloud 12

Service ID

6 5 1 7 5 3 3 4 9 3 3 1 4 7 7


S2K DevOps Srinivasan
Telephone: +447590310677
Email: operations@s2ksystems.com

Service scope

Service constraints
The solution(s) we provide are on AWS, a commercial cloud provider. Though we have no constraints on our services, we are constrained on the services provided by AWS; however our solutions will include all the necessary resilience, auto-healing, pro-active monitoring/alerting to minimise any impact on the business.
The customer is responsible for agreement and complying with AWS's client agreement and acceptable usage rights which can be found in https://aws.amazon.com/agreement/.
System requirements
  • Client pays licence of commercial software/tools *preferred* by them.
  • IAC on private cloud requires to be built on VMs.
  • Extension/Transformation of legacy systems require complete audit.
  • Client pays all the AWS charges
  • Client performs post-delivery AWS account maintenance (following our guidence)

User support

Email or online ticketing support
Email or online ticketing
Support response times
To be agreed with customer based on the project type, architecture, tools used and customer requirement/SLA.
User can manage status and priority of support tickets
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Yes, at extra cost
Support levels
Our service delivers auto-management and auto-healing capabilities with highest degree of pro-active monitoring and alerting, needing minimal support and maintenance. We provide complete support during the project delivery phase.

Beyond that, we provide highly flexible support model/levels, always tailored to suit the project architecture, tooling and customer requirement which will be discussed with the customer during the project delivery phase.
Support available to third parties

Onboarding and offboarding

Getting started
We aim to deliver projects with as much open source, community supported and popular tooling along with custom automation scripts and front-desk solutions. The actual training will be provided based on the project architecture and client requirements, as workshops, videos and/or live documentations (Wiki pages for example).
Service documentation
Documentation formats
  • PDF
  • Other
Other documentation formats
  • Wiki
  • Markdown
End-of-contract data extraction
Fully automated mechanisms, that will accept parameters, will be delivered part of the project, for Data extraction, which will be available throughout the life of the project. Clients will be able to perform incremental data extraction as the project runs. However, based on the nature of the project and client requirement, we will be able to assist the clients in the data extraction process.
End-of-contract process
Contracts include complete project delivery. Once all the agreed stories, for the given period/number of sprints are delivered, clients will be handed over with all the relevant documentation and access levels. Any additional costs will be discussed with the clients based on requirements.

Using the service

Web browser interface
Using the web interface
Based on the projects architecture and requirement there may be one or more web interfaces for users and project maintainers (of the the customer side) usually provided by the tooling deployed to make up the project.
Web interface accessibility standard
None or don’t know
How the web interface is accessible
Both access through browsers and through API calls will be made available, provided the underlying tool supports those facilities and are relevant to the project. Interface, where possible, will be tied up with a single sign-on system making onboarding new users quick and easy.
Web interface accessibility testing
No specific testings have been performed.
What users can and can't do using the API
API access will be made available to all the tools/systems involved in the project, provided the tools provide an API support and is relevant to the project.
API automation tools
  • Ansible
  • Terraform
  • Other
Other API automation tools
  • Packer
  • Bash
  • Python (with boto)
  • Jenkins (along with CI/CD, used as a frontdesk tool too)
  • Cloudformation
API documentation
API documentation formats
  • PDF
  • Other
Command line interface
Command line interface compatibility
  • Linux or Unix
  • Windows
  • MacOS
Using the command line interface
This will be based on the project architecture and the client requirement.


Scaling available
Scaling type
  • Automatic
  • Manual
Independence of resources
Our service will be per client service and may not be linked with other clients/users.
Usage notifications
Usage reporting
  • API
  • Email
  • Other


Infrastructure or application metrics
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
Other metrics
  • Application specific (error,warning and other) metrics
  • Replication lag (as applicable)
  • Any successful/unsuccessful login attempts
  • Instance restarts
Reporting types
  • API access
  • Real-time dashboards


Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
Encryption of all physical media
Data sanitisation process
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
In-house destruction process

Backup and recovery

Backup and recovery
What’s backed up
  • Files
  • Documents/Objects
  • Database
  • AMI
  • Docker Images
  • All configurations of all the tools
  • Log files
  • Application data (if not stored in the database)
Backup controls
All the process will be scheduled to run/to be triggered from one central location. Relevant interfaces (mostly web), with relevant user access, will be provided either from the underlying tooling or a custom developed front desk to tune/control the schedule and other parameters based on the project requirement.
Datacentre setup
  • Multiple datacentres with disaster recovery
  • Multiple datacentres
Scheduling backups
Users schedule backups through a web interface
Backup recovery
Users can recover backups themselves, for example through a web interface

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
Our solutions include various processes and techniques to ensure zero down time on planned and unplanned maintenance. We include maximum level of auto-healing and pro-active monitoring to eliminate any service unavailability due to Infrastructure faults.
Other SLAs and OLAs to be agreed with clients based on the architecture, requirements and other third party components that may have an impact on the delivered service.
Approach to resilience
Services are delivered on AWS and will be delivered to be running parallelly on multiple zones. Appropriate processes and configuration techniques will be developed and deployed to deliver a maximum level of resiliency mostly without impacting any running services.
Outage reporting
* Projects dashboard
* Email
* Text messages
* Instant Messaging services (eg. Slack)

Identity and authentication

User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
User onboarding process involves Role Based Access Control. Access to dedicated delivery managers, leads or scrum masters as agreed by the client.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
Devices users manage the service through
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
How long system logs are stored for

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
Other security governance standards
As implemented by the Amazon Web Services (AWS)
Information security policies and processes
Amazon Web Services have a number of connected governance frameworks in place which control both how they operate and the manner in which they deliver the cloud services to our clients. Most of them have been independently assessed and certified against ISO20000, ISO27001, ISO27017 and ISO27018. Integrated suite of information security policies have been deployed by the platform providers.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
All the configuration are treated similar to code and are maintained in the revision control. Changes will be reviewed and tested in various environments before rolling out into the prod. Every bit of the environment will be represented within the revision control; a Prod deployment will be an idempotent exercise to ensure the expected state.

Changes Requests will be raised as per the client requirement and will be rolled out with all the supplier approval. ITIL aligned Service Asset and Configuration Management (SACM) and Change Management processes will be followed.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
As a secure practise, we recommend clients to go through the deployment cycle continuously. Every deployment process will be a complete update of the underlying platform/operating system/software/other applications. Thorough testing will be performed in every environment before it reaches the Prod. This process will be developed to be a single push button one, and as per our principle motto, with no interruption to the services.

In addition, clients directions/advice will be included in the process.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Potential compromises will be sensed through our efficient protective monitoring capability built into our service.
Our services include controlled ingress and egress which will prevent intrusions and/or will prevent further compromises. Our preventive measures also include dynamic ip addresses for all the components in the system.
Mechanisms will be included as part of the service delivery to quickly disconnect the service from the external world. Given our solutions are delivered purely through code and fully automated, a very unlikely compromisation can easily be removed by completely destructing the whole infrastructure and bringing up a fresh one in no time.
Incident management type
Supplier-defined controls
Incident management approach
Incidents are generally identified by proactive monitoring through emails, Instant messaging and/or Text messages. Any other incidents need to be raised are through our emails or telephone.

Incidents are tracked using clients' or our own issue tracking system (Service Now, JIRA, Redmine, Gitlab, Github, Bitbucket - as per client requirement). Progress of the incident, workaround, resolution can be tracked using them. An appropriate problem database will be maintained, should there be a chance of re-occurrence of the incident, if no immediate resolution is available.

Our incident management process will also be connected to the underlying cloudproviders' one.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart
Who implements virtualisation
Third-party virtualisation provider
Amazon Web Services (AWS)
How shared infrastructure is kept separate
VPCs, Firewalls, Virtual LANs as implemented by the Platform Service provider

Energy efficiency

Energy-efficient datacentres
Description of energy efficient datacentres
AWS use 50%+ renewable energy to power their data centres; they are increasing this proportion every year through their stakes in renewable energy projects across the world.


£650 to £1,200 a person a day
Discount for educational organisations
Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at operations@s2ksystems.com. Tell them what format you need. It will help if you say what assistive technology you use.