We design, build, and operate cloud platforms on AWS for enterprise and banking customers across the region. Our work spans three pillars — Landing Zone, Data, and AI — delivered as Infrastructure as Code, reusable platforms, and production-grade AI runtimes.
Most repositories are private (customer engagements). This page maps what we build to the AWS services behind it, so new engineers and partners can find the right starting point.
Secure, multi-account AWS foundations built with Terraform / Terragrunt and AWS Control Tower — the base every workload lands on.
What we build
- Multi-account org structure, guardrails, and account vending (Account Factory for Terraform)
- 3-tier IaC architecture: Stack → Unit → Module (Terragrunt monorepo, shared module catalog)
- Networking, identity, logging, and cost/governance baselines aligned to the AWS Well-Architected Framework
Core AWS services
| Area | Services |
|---|---|
| Multi-account & governance | AWS Organizations, Control Tower, Account Factory for Terraform (AFT), Service Catalog, Config, CloudTrail |
| Identity & access | IAM, IAM Identity Center (SSO), Permissions Boundaries, SCPs |
| Network | VPC, Transit Gateway, PrivateLink, Route 53, Direct Connect / VPN |
| Compute & delivery | ECS/Fargate, EC2, Lambda, ALB, CloudFront, WAF |
| Security & ops | KMS, Secrets Manager, GuardDuty, Security Hub, CloudWatch, Budgets |
| IaC | Terraform, Terragrunt, CloudFormation |
Data platforms, retrieval systems, and knowledge bases — from ingestion and extraction to graph-augmented retrieval on AWS.
What we build
- GraphRAG knowledge platforms (hybrid lexical + vector + graph retrieval) with ACL, PII masking, and multi-tenant namespaces
- Document/PDF extraction and OCR pipelines feeding enterprise knowledge bases
- ML workloads and experimentation on SageMaker
Core AWS services
| Area | Services |
|---|---|
| Knowledge & retrieval | Amazon Bedrock Knowledge Bases, Neptune Analytics (GraphRAG), OpenSearch, Kendra |
| ML platform | Amazon SageMaker (training, endpoints, notebooks) |
| Storage & catalog | S3, Glue, Athena, Lake Formation |
| Data movement | Kinesis, DynamoDB, RDS/Aurora (PostgreSQL) |
| Document AI | Amazon Textract, Bedrock Data Automation |
Enterprise AI gateways and agent runtimes on Amazon Bedrock — OpenAI/Anthropic-compatible proxies with routing, guardrails, budget control, and observability.
What we build
- Enterprise AI Gateways — OpenAI/Anthropic-compatible proxy in front of Bedrock: model routing, guardrails, per-team budget control, key lifecycle, usage attribution (LiteLLM-based and custom runtimes)
- AI runtimes — DAG workflow engine, multi-agent orchestration, MCP client, streaming, RAG, multi-tenant workspaces + RBAC
- AI agents & MCP tools — helpdesk, use-case galleries, pricing/estimation agents, MCP servers
- Load & reliability testing for gateways (TTFT, connection resets, capacity)
Core AWS services
| Area | Services |
|---|---|
| Foundation models | Amazon Bedrock (Claude, Titan), Bedrock Guardrails, Global Inference Profiles |
| Runtime & serving | ECS/Fargate, Lambda, API Gateway, ALB + CloudFront (SSE streaming) |
| State & cache | Aurora PostgreSQL, ElastiCache (Redis), DynamoDB |
| Ops & cost | CloudWatch, SNS, Cost Explorer, Budgets, WAF |
Reusable Agent Skills and tooling we've open-sourced — compatible with Claude Code, Cursor, Kiro, and 40+ agentic clients.
| Repo | What it is |
|---|---|
dev-kit |
Lifecycle-driven dev workflow skill (brainstorm → plan → implement → review) |
qa-testing-kit |
Manual & automation testing skill (Playwright, Selenium, Appium) |
ba-kit |
Business Analysis skill (intake → FRD/SRS → user stories → handover) |
swo-agent-toolkit |
Agent toolkit utilities |
quick2cowork |
Skill-format conversion set |
- IaC first — Terraform/Terragrunt, 3-tier Stack→Unit→Module, shared module catalogs.
- Well-Architected — security, reliability, cost, and operational excellence as guardrails, not afterthoughts.
- Lifecycle-driven delivery — requirements → design/spec → build → test → handover, with traceable artifacts.
- Region default —
ap-southeast-1(Singapore), multi-region where the workload requires it.
SoftwareOne AWS Team. For access to a private repository or a customer engagement, reach out to your SoftwareOne contact.