Cloud Services

Cloud Managed Services: Get the Environment Right on the Day It Is Created

Almost every expensive cloud problem was created in about ninety seconds, by someone with legitimate access, doing something entirely reasonable. A resource gets spun up for a project. It does not get tagged, because tagging was not enforced at creation. It outlives the project, because nothing records what it was for. Eighteen months later it is a line on an invoice nobody can explain, sitting in a security group somebody widened once for a demo.

Facet Interactive delivers cloud managed services as governed Agent Loops across AWS, Azure, GCP and Cloudflare — environments stood up to a standard, and held to that standard as they grow. The distinction matters, because the cost of getting this right is paid once, at creation, and the cost of getting it wrong keeps invoicing for as long as the resource exists. We had to solve this on our own infrastructure before we sold it, and we had to solve it sooner than most firms do, for a reason that is specific to how we work.

We hit the provisioning problem early, because agents provision faster than people

Facet's own delivery — engineering, research, quality review and reporting — runs through Agent Loops under human command. That is the credibility claim on this page, and it has a consequence that is unusual and worth being direct about: a delivery model that runs on agents creates cloud resources at a rate a human-paced firm does not. Environments get stood up, used and abandoned far more often. Whatever drift a traditional shop accumulates in two years, we accumulate considerably faster.

So the governance had to come first, on us, before it was anything we could sell.

• Enforcement at creation is the only control that survives volume. A quarterly cleanup works when a handful of resources appear each quarter. It does not work when provisioning is continuous, and we found that out on our own bill rather than on a client's. Every rule on this page is applied at the moment a resource is created, because that is the only moment when applying it is free.
• The failure mode is a resource nobody can name. Not a breach, not an outage — an orphan. It is boring, it is invisible, and it is where most cloud waste and a meaningful share of cloud exposure actually lives. We built the intake and inventory discipline to stop producing them ourselves.
• A person still holds the key decisions. Agents apply the standard, inventory what exists and flag what does not match. A named Facet engineer decides what the standard is, approves exceptions, and signs off before anything in your environment is changed or removed.

You can read the longer version of how our own operation is structured in We Run Our Own Business on Agents. This service is one of the parts we needed working before the rest of it could run.

Why hire a cloud managed services partner?

Because cloud is not an infrastructure purchase, it is a permissions model. Anyone with an account can add cost, add surface area and add an undocumented dependency, and nothing in the platform stops them.

Traditional IT managed services were built for static estates: keep the servers up, patch them, answer tickets. A cloud environment changes shape weekly. Every new workload, every engineer with console access, every project that wrapped without a decommission step leaves something behind — and none of it announces itself.

The three things that actually go wrong are all creation-time failures.

• Untagged resources make the bill unreadable. You cannot allocate cost you cannot attribute, and you cannot attribute cost that was never labelled. Retrofitting tags across an aged estate is archaeology — somebody has to work out what a resource was for, from evidence, months after the person who created it moved on.
• Baseline security drifts from the moment it is set. Security groups get widened for a specific reason and never narrowed. Roles get over-permissioned because the precise permission was not obvious under time pressure. Every one of those is defensible individually and indefensible in aggregate.
• Nobody owns decommissioning. Projects end. Resources do not. There is no natural moment where somebody is accountable for turning things off, so nothing gets turned off.

Size your own version of this before you talk to anyone. Open your cloud console and count the resources created in the last ninety days. Then count how many carry an owner or a project tag. The gap between those two numbers is your provisioning governance problem, and it is what this engagement is scoped against — not a percentage taken from somebody else's estate.

How could AI agents run your cloud provisioning? Book the cloud environment and governance review — one session, fixed scope, against your real accounts. You leave with your current tagging and ownership coverage measured, your baseline security standard written down, and a plain list of what a governed intake would change.

What the loop actually does

This page is about standing environments up correctly and keeping them to standard as they grow. Watching a running environment for health, cost and security signal — and responding to it at 3am — is a different job with its own operating model, and it lives on Cloud Management & Monitoring. Most clients end up wanting both. They are not the same loop.

The passes below are agent work for an unglamorous reason: each one is high-frequency, mechanically checkable against a written standard, and finds nothing the overwhelming majority of the time. That combination is exactly what a person stops doing by week three.

• Apply the standard at creation, every time. Tagging, naming, baseline security group rules and required metadata are applied as the resource is provisioned, not audited afterwards. A request that cannot supply an owner does not complete.
• Inventory the estate continuously and reconcile it against the template. Everything that exists is compared to the standard it should have been created under. Resources that predate the standard surface as a finite, shrinking backlog rather than an open-ended cleanup.
• Flag resources whose project has ended. Cross-referencing tags and activity to surface the candidates for decommissioning — the single most reliable source of recoverable spend in most estates, and the one nobody schedules.
• Detect configuration drift from the baseline. Where a security group, role or policy no longer matches what it was created as, with the change and its timestamp attached, so the conversation is about a specific edit rather than a general suspicion.
• Keep cost allocation real. Every dollar mapped to a team, project or workload, checked continuously — so the cloud bill becomes a management instrument instead of a monthly surprise.

What a person still decides

Nothing in your environment is created, changed or removed because a loop concluded it should be.

• What the standard is. Which tags are mandatory, what a baseline security group looks like for your risk profile, and which naming convention your team will actually follow. That is a decision about your organization, not a template we import.
• Every exception, and for how long. Real work sometimes needs a resource that breaks the rule. The question is whether the exception is recorded with an owner and an expiry, or whether it quietly becomes the new normal.
• What gets turned off. An agent can tell you a resource has had no activity for ninety days. It cannot tell you it is the disaster-recovery standby. Decommissioning is always a conversation, never an automation.
• Who is allowed to provision at all. Widening console access speeds teams up and widens exposure at the same time. Where that line sits is a business judgment about how much autonomy your teams need.

What we cover

Provisioning and environment build-out. Governed intake for new resources across AWS, Azure, GCP and Cloudflare, with tagging, naming and baseline security applied as part of creation rather than as a later audit.

Cost allocation and decommissioning discipline. Continuous attribution of spend to teams and projects, plus a standing process for identifying and retiring resources whose work has finished.

Baseline security posture. A written standard for roles, groups, encryption state and network exposure, applied at creation and checked against continuously, with human review before any change.

Multi-cloud consistency. One policy model applied across providers, so a workload on GCP and a workload on Azure are governed the same way and reported in the same terms. Platform coverage includes AWS (EC2, RDS, S3, Lambda, IAM, VPC), Azure (Virtual Machines, Entra ID, Blob Storage, Microsoft 365 integration), GCP (Compute Engine, Cloud SQL, GCS, IAM) and Cloudflare (DNS, CDN, WAF, Zero Trust access).

Where cloud services go next

A ladder, not a bundle. A governed environment that never goes further is a complete outcome.

• Cloud Management & Monitoring — the ongoing watch. Once the environment is to standard, this is the loop that catches what happens to it afterwards and responds outside business hours.
• Cloud Migration — the layer before this one, if the environment you need governed does not exist on the platform yet.
• IT Managed Services — the endpoints, identity and helpdesk surface around the infrastructure.
• Agentic Engineering and AI Managed Services — the build and run layers above infrastructure, for when the governed environment is the foundation for agents doing your actual operational work. The Agentic Operating System explainer is the best starting read while those service pages are in production.

Why Facet

Facet Interactive has been a boutique systems integrator since 2014, and CIOReview named us a Top 10 Digital Transformation Services Company in 2021. Our team of 40 spans 9 timezones and 6 continents, backed by a network of 500+ open-source, cloud and IT specialists.

We work across AWS, Azure, GCP and Cloudflare with no platform partnerships that create an incentive to recommend one over another. You will not find an industry benchmark anywhere on this page either. Your estate — its age, its size, how many people hold console access, what discipline already exists — determines what is recoverable and how fast. A percentage drawn from somebody else's environment tells you nothing about yours, and the review produces your number instead.

Start with a cloud environment and governance review

How could AI agents run your cloud provisioning? Book the cloud environment and governance review — one session, fixed scope, against your real accounts. We measure your current tagging and ownership coverage, document the baseline security standard your environment is actually running at, identify the resources nobody can account for, and give you a written intake standard you can hand to your own team. The standard is yours whether or not you engage Facet afterwards.

Sometimes the honest answer is that you do not need this yet. If your footprint is one account, a few dozen resources, and one engineer who genuinely knows all of them, a governance layer is overhead rather than protection. We will tell you to come back when a second team starts provisioning — and that conversation costs us the engagement, which is precisely why it is worth having before you buy rather than after.

How pricing works. Fixed fee, scoped and quoted after the review, with ongoing governance priced monthly on estate size, the platforms covered and how much of the intake you want us to run versus your own team. We revisit that quarterly as the environment changes. There is no standard price list, because no two cloud estates are the same.

The one cloud decision that gets more expensive every single day

Most infrastructure decisions can wait without penalty. A platform choice is roughly as good next quarter. A monitoring deployment costs about the same whenever you do it.

Provisioning governance is not like that, and it is the only part of cloud work that is not. Applying a tag at the moment a resource is created costs nothing — it is a required field on a form. Applying that same tag two years later means finding out what the resource was for, from logs and billing records and a conversation with someone who may have left, and then deciding whether it is safe to touch. The work does not merely get harder; it changes category, from configuration into investigation.

Every resource created between now and the day you fix this is created on the wrong side of that line. That is the whole argument, and it is the reason this is the rare piece of infrastructure work where the date you start is a bigger variable than the scope you buy.