The platform layer underneath everything else.
AWS and Azure as platforms, treated as peers. Containerisation that protects what matters most and keeps you able to change at will. DevSecOps grounded in everything as code, on GitHub.
Two clouds, treated as peers.
We hold senior engineers across both AWS and Azure and we have no commercial preference. The right cloud is the one your business is already on, run properly. Below is how the two clouds compare on the dimensions that matter most when we are scoping work.
Dimension
Compute
AWS
EC2, ECS, EKS, Lambda. Mature multi-account landing zones.
Azure
VMs, AKS, Container Apps, Functions. Tight tenant integration.
Dimension
Identity
AWS
IAM, IAM Identity Center (formerly AWS SSO). External IdP federation.
Azure
Entra ID (formerly Azure AD). Conditional access, PIM, B2B and B2C.
Dimension
Networking
AWS
VPC, Transit Gateway, PrivateLink. Region-rich, predictable patterns.
Azure
VNet, Azure Firewall, Private Endpoints. Strong hybrid posture.
Dimension
Storage
AWS
S3, EBS, EFS. Lifecycle policies, intelligent tiering.
Azure
Blob Storage, Managed Disks, Files. Lifecycle and immutable tiers.
Dimension
Observability
AWS
CloudWatch, X-Ray. OpenTelemetry-friendly, third-party rich.
Azure
Azure Monitor, Application Insights, Log Analytics. Native deep links.
Dimension
Sovereignty (AU)
AWS
Sydney (ap-southeast-2), Melbourne (ap-southeast-4). Mature.
Azure
Australia East (Sydney), Australia Central (Canberra). IRAP-aligned.
Dimension
Governance
AWS
Organizations, SCPs, Control Tower. Multi-account at the centre.
Azure
Management Groups, Azure Policy, Initiatives. Subscription-shaped.
Dimension
Cost levers
AWS
Savings Plans, Reserved Instances, Spot, Cost Allocation Tags.
Azure
Reservations, Savings Plans, Spot, Cost Management.
Dimension
When we lean here
AWS
Multi-account, region-diverse estates. Engineering-led, cloud-native.
Azure
Microsoft estates, Dynamics, .NET, Entra-anchored identity.
The honest pattern is that most Australian businesses are already on one of the two and should stay there. Cross-cloud migrations are rarely the right call. We will say so plainly when they are not.
Containers are a boundary, not a banner.
We are not interested in containerising for its own sake. The principle is to use boring, proven foundations to protect what matters and keep the operating decisions reversible.
Not inventing the wheel.
We use proven, boring foundations. Containers, Kubernetes where it earns its keep, managed runtimes where it does not. We do not invent platforms when an open one already solves the problem. The novelty is in the model, the reliability is in the boring engineering underneath.
Protecting what matters most.
Containers are a boundary. We use them to isolate the parts of the system that carry risk: data, secrets, regulated workloads, third-party integrations. The blast radius of a failure stays inside the container. The audit trail does not.
Able to change at will.
Containers preserve optionality. Workloads stay portable across AWS and Azure, across managed and self-hosted, across model vendors and database engines. We design so the operating decisions you make today do not become the operating constraints you regret in three years.
We code. We build. We ship. Everything as code.
Security and policy are not a checklist at the end of the pipeline. They are written as code alongside the application and run on every change.
- 01 · We code
Code
- Application code, in version control
- Infrastructure as code (Terraform, Bicep, CDK)
- Policy as code (OPA, Azure Policy, SCPs)
- Tests as code, including security tests
- 02 · We build
Build
- Containerised builds in GitHub Actions
- SAST, dependency, and container image scans
- Signed artifacts (cosign, SLSA provenance)
- Compliance gates that fail loud, not silent
- 03 · We ship
Ship
- GitOps deploys, environment promotion
- Runtime guardrails (Pod Security, Azure Policy, AWS GuardDuty)
- Audit trails your compliance team can defend
- Rollback as a first-class operation, not a fire drill
Security and policy, baked in at every stage.
Same posture across AWS and Azure. Audit trails on by default. Compliance fails loud, not silent.
Every Artrilogic engagement ships on this practice. We do not run cowboy releases and we do not hand over a codebase your team cannot maintain. The pipeline is the artefact, and the pipeline lives in the same repo as the application.
Want this run on your estate, not just designed for it?
This page is the architectural lens. Our Infrastructure pillar is the operational lens. Most engagements engage both.