Five things a cloud architecture audit finds, and why 2027 is the year to look

Most cloud estates were never designed. They accreted. Someone spun up a region for a proof of concept in 2021, someone else added a managed service because it was faster than asking, and the person who knew why the staging cluster is the size of production has left. None of that is negligence — it is what shipping under deadline looks like. But it compounds, and the bill is the last place it shows up honestly.

A cloud architecture audit is the cheapest way to find out what you actually run. Ours is read-only, fixed-price, and takes two to three weeks. This is what it looks for, and what it usually finds.

Why 2027 changed the calculation

For a decade, the honest answer to “should we move this?” was “probably, but the exit cost eats the saving.” Egress fees made leaving expensive enough that inertia was rational.

That is ending on a specific date. The EU Data Act has applied since 12 September 2025, and its cloud-switching provisions are aimed squarely at lock-in: providers must remove obstacles to switching, and from 12 January 2027, charges for the switching process — including the data egress involved in moving out — are banned outright.

1. The boring cost findings are the expensive ones

Nobody wants the cost section to be interesting. It rarely is. The recurring pattern across estates is the same three items, in roughly this order of value recovered:

Idle and over-provisioned compute. Non-production environments running 24/7 for a team that works 40 hours a week. Instances sized for a load test that ran once. Managed database tiers picked during a migration and never revisited.

Spend nobody owns. If resources are not tagged to a team or a service, no one is accountable for them, and nothing gets switched off. The audit’s first cost deliverable is usually not a saving — it is an allocation map, because you cannot decide what to cut until someone owns each line.

Egress paid at list price. Data transfer out of a hyperscaler is priced around $0.09/GB for the first tier to the internet, and inter-region and inter-AZ traffic quietly add up on chatty architectures. Most estates have at least one pipeline that crosses a boundary it does not need to cross.

2. Sovereignty is a control question, not a map question

This is where audits most often contradict what a company believes about itself. The belief is “our data is in Frankfurt, so it is in Europe.” The legal reality is different, and it turns on control rather than geography.

The US CLOUD Act lets US authorities require a provider subject to US jurisdiction to produce data in its “possession, custody, or control” — regardless of where that data is physically stored. A European region operated by a US-controlled entity does not remove that exposure. It is a real architectural property with a real answer, and the answer is not on the region selector.

The audit maps each data category to where it lives, who operates that infrastructure, and which legal regime that operator answers to. For most estates the result is a short list of genuinely sensitive workloads and a much longer list where the exposure does not matter.

3. Infrastructure-as-code coverage predicts everything else

If we could keep only one finding, it would be this one. The percentage of your estate that is actually defined in Terraform, Pulumi or CloudFormation — and reconciled, not just committed once — is the single best predictor of every other problem.

The reason is mechanical. Resources created by hand never go through review, appear in no documentation, and cannot be recreated. They drift from whatever the code claims. And when something breaks at 03:00, the gap between what the repository says and what is running is exactly the gap you have to debug in.

The audit measures three things here, and they are not the same:

1. 01

2. 02

3. 03

A repository full of Terraform and a plan that shows forty changes is not coverage. It is a second source of truth that disagrees with the first.

4. What a single credential reaches

Access findings are rarely dramatic and almost always uncomfortable. The recurring shapes: a CI role with broad write permissions because narrowing it once broke a deploy; long-lived access keys where a short-lived role would work; a single account holding both production and everything else, so every boundary is a policy rather than a wall.

This matters more than it did two years ago, because more things now hold credentials. An agent, a scheduled job, or a third-party integration with an over-scoped role is the same problem with more ways to trigger it.

5. Could you actually leave?

The last section is the one the Data Act just made concrete. Independent of whether you intend to move, exit readiness is a measure of how much of your architecture is a decision versus a dependency.

Concretely: how much of the estate is portable infrastructure that happens to run on this provider, and how much is wired into managed services with no equivalent elsewhere? Both are legitimate — managed services buy real time. But the ratio should be known, and priced, rather than discovered during a renegotiation.

What you get, and what it costs you to find out

The output is a written architecture recommendation and an implementation roadmap, ordered by payback. Not a slide deck, and not a list of everything that is imperfect — a sequence, with the cheap high-value items first and an honest note where the right answer is “leave it alone.”

The audit is read-only by design. We take billing exports, read roles, and your IaC repositories, and we talk to the people who remember why. We do not change anything, which means it can run alongside delivery without a freeze.

The roadmap is yours whether or not we build any of it. Plenty of clients take the document and execute it in-house, which is a perfectly good outcome — the expensive thing was never the implementation, it was not knowing which of the five sections above was actually costing them money.

If that sounds like your estate, the cloud architecture audit is a fixed price and a defined end.