You cannot optimize what nobody can describe. When we came in, a team that was no longer around had built the infrastructure at speed, so our first job wasn't cost-cutting; it was figuring out what existed, who could reach it, and which resources were genuinely serving traffic. So we started with:
- A full audit of the running environment: We inventoried the AWS accounts, mapped the VPC peering between them, and traced how the ECS services actually reach the database layer - through the main production endpoint, the read-only endpoint, and RDS Proxy. That map became the reference the client's own developers had been missing.
- Tightening access and codifying changes: We reviewed IAM roles and security group rules against least privilege, closed the gaps we found, and moved configuration into Terraform so that every subsequent change is version-controlled and reviewable. The point is that the next team to inherit this environment won't have to guess either.

