Amazon cloud services (AWS), planned, secured and run under one SLA
Amazon cloud services are the computing, storage, database and networking products Amazon Web Services (AWS) rents by use from its data centres, including its Africa (Cape Town) region. Arke Technologies (Pty) Ltd, in Johannesburg, plans, migrates, secures and manages AWS for mid-sized and large organisations, public bodies and schools across South Africa.
AWS in South Africa, and for government
AWS runs its Africa (Cape Town) region from data centres in Cape Town, and CloudFront, its content delivery network, has points of presence in Johannesburg and Cape Town, so websites and front ends load close to South African users.
On Amazon Web Services for government: the gov cloud AWS operates, AWS GovCloud (US), is reserved for United States public-sector workloads, so South African departments, municipalities and state-owned entities use the standard regions with their own controls. AWS holds certifications including ISO/IEC 27001, 27017 (cloud security controls) and 27018 (personal data in public clouds). Those cover AWS's side of the shared-responsibility line, not your configuration. POPIA section 72 governs sending personal information abroad, so we keep data in the Cape Town region unless you decide otherwise and record where each copy lives. See IT for government and the public sector.
AWS networking: private subnets, PrivateLink and private connections
Every AWS environment we build starts with the network, because most cloud breaches begin with something exposed that should not be.
Private and public subnets in AWS. Public subnets hold only what must face the internet, such as load balancers; servers and databases sit in private subnets with no inbound route from the internet.- AWS PrivateLink. Interface endpoints let workloads reach AWS services, including S3, and other providers' services privately, without crossing the internet; for S3, a free gateway endpoint often does the job. AWS PrivateLink pricing is per endpoint, per Availability Zone, per hour, plus a charge per GB processed (AWS pricing, September 2026).
- AWS virtual private network. Site-to-Site VPN connects your offices to a virtual private gateway or a Transit Gateway; AWS virtual private gateway pricing is in practice VPN pricing, charged per connection-hour, plus data transferred out.
- Direct Connect. A dedicated line with a private VIF (private virtual interface) into your VPCs, for larger or latency-sensitive estates: an AWS private network from end to end.
- Written as code. VPCs, subnets and PrivateLink endpoints defined in Terraform or CloudFormation, so they can be reviewed, repeated and handed over.
For how a virtual private cloud differs from a private cloud, see private cloud and virtualisation.
AWS disaster recovery: strategy and Elastic Disaster Recovery
AWS describes four DR strategies, in rising cost and falling recovery time: backup and restore; pilot light, with core data replicated and servers off; warm standby, with a scaled-down copy running; and multi-site active-active. Choosing the AWS DR strategy for each system starts from how much data it may lose and how long it may be down.
AWS Elastic Disaster Recovery (AWS DRS, often called AWS elastic DR) replicates servers continuously into a low-cost staging area in AWS and launches them when needed, from on-premises or from another region. AWS Backup handles scheduled, immutable copies. We document, drill and report every AWS DR plan; see backup and disaster recovery.
Security and incident management on AWS
- Identity. Central single sign-on through AWS IAM with multi-factor sign-in, no long-lived access keys, least-privilege roles and the root account locked away.
- Encryption. KMS keys for every data store, with rotation and CloudTrail records of every key use.
- Detection. CloudTrail in every account, GuardDuty threat detection and Security Hub checks against CIS benchmarks.
- AWS incident management. Alerts raise tickets on our SLA clock, prioritised P1 to P4 with response and resolution targets agreed in your SLA, followed by a written post-incident review.
- Assurance. An AWS security consultant review before go-live, and penetration testing within AWS's published testing policy. See cybersecurity services.
Managed services in AWS
What we run for you, under one SLA:
- patching through AWS Systems Manager, in agreed maintenance windows;
- backups through AWS Backup, with restores tested and reported;
- monitoring every 15 minutes, with faults raised as tickets automatically;
- budgets, alerts and a monthly cost report by cost centre;
- access reviews, change control and a monthly service review.
Amazon has its own consulting arm, AWS Professional Services; many organisations also appoint an independent AWS consultant to run the environment day to day.
Buying AWS: pricing, private pricing and private offers
Last reviewed: September 2026.
AWS charges by the second, hour, gigabyte or request, with list prices in US dollars. Costs are driven by instance size and hours, storage and snapshots, data transferred out, NAT gateways, public IPv4 addresses and endpoints, Windows Server and SQL Server licences, disaster-recovery standby and the exchange rate. Savings Plans and Reserved Instances cut the cost of steady workloads in return for a one- or three-year commitment.
Large, committed spend can qualify for AWS private pricing, negotiated directly with AWS, and an AWS Marketplace private offer lets a software vendor give you negotiated prices billed through your AWS account. We do not publish hourly consulting rates. For context, published hourly rates for IT project work in South Africa run from about R550 to R750 ex VAT (matnet.co.za, September 2026). We quote a migration as a project and management under your SLA, after an assessment, with the consumption model on paper first. Cloud cost optimisation keeps spend in check afterwards.
Choosing among AWS consulting companies
AWS consulting services range from AWS's own team to independent AWS consulting companies. When you compare an AWS cloud consultant or AWS consulting company, ask who the named team is, whether everything is built in your own AWS account, what will be documented, how incidents are handled under an SLA, and how you would leave, for Azure, Google Cloud (GCP) or back on premises. Our Microsoft Azure and Google Cloud pages cover the alternatives.
Handover includes documentation and working sessions with your team. For formal Amazon cloud services training, AWS runs its own certification path, starting with Cloud Practitioner.
Governance, compliance, procurement and continuity
- One SLA: incidents prioritised P1 (critical outage) to P4 (low-impact request), with response and resolution targets agreed to your business impact; a monthly service review and report; logged, approved changes; ITIL-aligned practice.
- Compliance: POPIA sections 19 and 72 addressed through South African data residency, encryption and access logging; King IV Principle 12 and PFMA or MFMA reporting supported by architecture, change and access records kept ready for audit.
- Procurement: Level 1 B-BBEE contributor, giving 135% procurement recognition (sworn affidavit available on request); CSD number, SARS tax compliance status and company documents available on request; SBD forms completed where required. AWS consumption can stay in your own accounts, while our migration project and SLA are bought against your purchase order or a tender response; see procuring from Arke.
- Continuity: the AWS accounts, data and credentials are yours; we work through named, logged roles and document as we go. Adding an account or workload is a change to the SLA, and exit terms are written in from the first day.