Governed, cost-optimized cloud for a healthcare platform, CloudMaven

This platform was already live on Google Cloud, but it had grown faster than its foundations. Changes were made by hand in the console, cloud spend crept up quietly, and a single service-account key rotation was enough to take the whole delivery pipeline down. Our job was to put governance, reliability and cost discipline back in place, without slowing the team down.

The challenge

Infrastructure was being changed directly from the cloud console, so the running state drifted away from what was defined in code.
A service-account key rotation destroyed old keys and broke multiple CI/CD pipelines with authentication failures.
There was no disaster-recovery or reliability configuration, leaving application availability exposed to any failure.
Idle resources ran through weekends and non-business hours, and Kubernetes workloads were over-provisioned, driving up cloud spend.
IAM access was over-permissioned, with several users and accounts holding more than they needed.

How it fits together

Author

Terraform modules + drift detection

Helm app packaging

Deliver

GitHub Actions lint · test · deploy

Run on Google Cloud

GKE right-sized nodes

Cloud Run managed services

Governed throughout: drift detection, least-privilege IAM, and GKE + VM rightsizing for cost.

Our approach

Standardized everything in Terraform, with drift-detection workflows plus lint and validation checks to keep design and governance consistent.
Introduced a project-wise folder structure so resources are organized and managed cleanly per project.
Rebuilt CI/CD on GitHub Actions with automated linting and test validation before every deployment, and success and failure notifications in Slack.
Tightened IAM toward least privilege to close over-permissioned access.

What we built

Reusable Terraform modules on Google Cloud to standardize provisioning, cut duplication and simplify multi-project management.
Shared GitHub Actions workflows for Cloud Run deployments, centralizing CI/CD logic and reducing repeated pipeline configuration across applications.

The result

Lower cloud spend through GKE node optimization and VM rightsizing.
Improved scalability and resource efficiency with better autoscaling on GKE and Cloud Run.
Migrated AWS-based configurations and integrations for GKE apps to native GCP services, reducing operational complexity.
Consolidated domains and DNS from AWS onto Google Cloud DNS for centralized, maintainable management.
A single governed source of truth for infrastructure, with reliable, repeatable pipelines.

Where it goes next

From here, the focus moves to internal R&D: regular infrastructure audits on Google Cloud, continuous auditing of GKE resource usage to keep performance and cost in balance, and automated security workflows that scan the environment for IAM risks, misconfigurations and public exposure, then generate remediation recommendations.

Where AI fitsAI-assisted security remediation can identify and fix misconfigurations automatically, and AI-assisted CI/CD failure analysis in GitHub Actions can read logs, detect root causes and suggest fixes, cutting troubleshooting time and improving reliability.

What we took away

Reusable automation, shared CI/CD workflows and Terraform modules, pays off quickly across projects.
Continuous GKE rightsizing and autoscaling tuning is where sustained cost savings come from.

Have a similar challenge?

Let's scope it together.

Tell us where your platform hurts and we'll come back with a plan. The first assessment is free.

Book a free assessment → See more stories

Governed, cost-optimized cloud for a healthcare platform