Managed DevOps for startups: production on AWS, looked after every month.
Managed DevOps means someone is responsible for how your software reaches production and stays up: deploys, monitoring, backups, access, patching and the AWS bill, every month, for a flat price. You keep the accounts, the code and the decisions. We do the operating.
Three plans, response times in the contract, no setup fee. Most teams start with the five-day readiness review; its fee comes off the first month.
The same list, in more detail, is the readiness checklist. On a managed plan we're the ones ticking it.
What "managed" covers, area by area.
| Area | What happens every month | What you see |
|---|---|---|
| Deploys and CI | Pipelines kept green, rollbacks kept working, failed deploys fixed the same day. | A deploy log, and releases that stop being an event. |
| Monitoring and alerts | Alerts for the five or six things that actually take you down, tuned so they stay quiet otherwise. We answer them in support hours. | Fewer pages, each one real. |
| Backups and restores | Retention checked. On Growth and Scale, a restore drill every quarter, into staging, timed. | A dated note saying the restore worked and how long it took. |
| Access and keys | Single sign-on with MFA, leavers removed, long-lived keys retired, a quarterly access list. | An access list you could hand to an auditor or an investor. |
| Patching and upgrades | AMIs, agents, dependencies and database minor versions. Kubernetes upgrades on Scale. | A version table in the monthly report. |
| Infrastructure as code | Every change in Terraform, in your repository, as a pull request with the plan attached. | A repo that can rebuild your environment. |
| The AWS bill | A cost check with the savings applied, monthly on Growth and Scale, on request on Essentials. | The bill, explained, with what changed and why. |
| Incidents | Acknowledged within the plan's response time, fixed, and written up within two working days. | A write-up: cause, fix, what we changed so it doesn't repeat. |
The month ends with a one-page report written for the founder, not the engineer: what changed, what broke, what it cost, what we'd do next. If nothing broke, it says so.
Fig. 1
One month on the Growth plan. The incident is invented; the routine is not.
What a month of managed DevOps looks like.
Every Monday starts with the same check: what paged, what the backups did, what needs patching. The rest of the week follows your product. When you ship, we're on the deploy. When a Terraform change goes up, we read the plan before it merges.
Week two has the cost check. Week three is access and a restore drill. Week four is upgrades and the report. An incident lands wherever it lands; the picture shows one on a Friday afternoon, acknowledged in twelve minutes and fixed in under an hour, with the write-up on Monday.
In a quiet month the routine takes about a third of the Growth plan's 40 hours. The rest goes where your team points it: a staging environment that matches production, a queue, a VPC endpoint that removes a NAT gateway bill. Nothing in the routine is skipped to make room; if the two collide, we tell you before the month ends, not after.
Fig. 3
Responsibility on a managed plan. Orange marks the two things we never take over: your accounts, and AWS itself.
You keep the product and the keys. We run the plumbing.
AWS's shared responsibility model says Amazon secures the cloud and you secure what you put in it. A managed plan takes the second half off your developers without taking it away from your company. The root account, the domain, the billing relationship and the data stay yours. We work through roles you created and can delete.
The rows in the middle are where small companies get hurt. In Verizon's 2026 breach report, 31% of breaches started with an exploited vulnerability, and stolen or misused credentials appeared at some point in 39% of them (Verizon DBIR 2026). Patching and access reviews are dull, which is exactly why they slip when nobody owns them.
The test we'd apply to anyone running your infrastructure, including us: if they vanished tomorrow, what stops? With us, nothing. The Terraform is in your repo, the runbooks are in your wiki, and the next engineer can read both.
Fig. 2
Our own survey of managed DevOps pages, 21 Oct 2026. How we counted is under the chart; the full table is yours on request.
We read 92 managed DevOps pages before writing this one.
We opened 92 provider pages one by one: AWS partners, agencies in the US, the UK and Europe, and the small firms that sell to startups. Most of them describe the same six things, CI/CD, infrastructure as code, Kubernetes, monitoring, security and cost, and then ask you to book a call to find out the rest.
Fewer than one in four publish a price. Of the few that also say how many hours you get, 40 hours a month costs between $2,500 and $8,500. Our Growth plan is $4,900 for 40 hours. We're not the cheapest on that list and we don't try to be; per hour, offshore teams will always win.
Only about one in six put a number on how fast someone answers an incident, though many more say "24/7". Where a number appears, it is usually 15 minutes for the worst kind of outage, attached to a plan with a staffed night shift that costs several times ours. And exactly one page in the set said who the service was not for.
The five questions below are the ones the pages avoided. Ask them of anyone you talk to, us included.
Five questions to ask any provider, with our answers.
What does "response time" mean, and who is on the other end?
For us: a named engineer has seen the alert, is working on it, and has told you so in your channel, within the time on the plan. Response is not resolution; nobody can promise a fix time honestly. Outside support hours, nothing happens unless you've bought the on-call add-on, and we say that in the contract rather than implying 24/7 with a logo.
Who owns the Terraform, the accounts and the runbooks?
You do, from the day each one is merged. There is no OpsRunway tooling between you and AWS, and no portal you'd lose access to on the way out.
What is the price, before a call?
$2,900, $4,900 or $7,900 a month, on this page and on the pricing page. A quote only replaces the board when something is unusual, and we list what counts as unusual.
What happens in month four?
Plans run three months, then month to month with 30 days' notice. No annual contract, no auto-renewal into a longer term.
What won't you do?
Build Kubernetes for a team that doesn't need it, run a 24/7 operations centre, write your application code, or be the only people who understand your system. The full list is in how we work.
Support hours: the UK working day and the US East Coast morning.
What our response times mean, exactly.
| Essentials | Growth | Scale | |
|---|---|---|---|
| Price per month | $2,900 | $4,900 | $7,900 |
| Engineering hours | up to 20 | up to 40 | up to 80 |
| Production incident, acknowledged | Next business day | Within 4 business hours | Within 1 hour, in support hours |
| Everything else | Scheduled into the week, in the order you set | ||
| Out of hours | Add-on, quoted once we've seen your alert volume. We reduce the noise first. | ||
A production incident is when customers can't use the product, or data is at risk. Acknowledged means a named engineer is on it and has said so. From there you get updates in the channel until it's fixed, and a written post-mortem within two working days: what happened, why, what we changed.
Why not 24/7 by default? Because at seed stage a staffed night shift costs more than the outage it prevents, and most night pages are noise. We'd rather fix the noise in month one and then quote on-call for the alerts that are left. Teams that need it have it; teams that don't aren't paying for it.
For a sense of scale: AWS's own Enterprise Support promises a response in under 15 minutes when a business-critical system is down, and starts at $5,000 a month or 10% of your AWS bill, whichever is greater (AWS Support pricing). Activate credits can't be spent on it. That plan answers questions about AWS; it doesn't look after your deploys, your Terraform or your bill.
If you've had the readiness review, week one is already done and the $1,900 comes off the first month.
The first thirty days.
- Access, inventory, baseline.
You create the roles from a Terraform snippet we send. We list what runs, what pages, and what would hurt if it broke. The first Monday check happens this week.
- The things that lose data or customers.
Backups confirmed and one restored. Former staff and long-lived keys removed. The riskiest click-built pieces imported into Terraform.
- Deploys and alerts made boring.
CI deploys with short-lived credentials. Alerts cut to the ones that matter, routed to a channel someone reads. The cost baseline recorded.
- Runbooks and the first report.
A runbook for each of the top five failure modes, written for someone reading it at 3am. Then the first monthly report, and a plan for month two.
The market uses four or five terms for similar things. Here is how we use them.
Managed DevOps, fractional DevOps, DevOps as a service, an MSP or a hire.
Managed DevOps (this page): we are accountable for production staying up and shipping, inside agreed hours and response times. The hours are the budget; the outcomes are the point.
Fractional DevOps: the same engineers and the same plans, but you direct the hours. Right when you have a list of projects and someone on your side to own the running of things.
DevOps as a service: the industry's name for roughly what this page describes, usually sold as a retainer. We don't use it because it tells you nothing about hours, response times or who owns what, which are the only three things that matter in the contract.
A cloud MSP: a 24/7 operations centre, often priced as a percentage of your AWS bill, built for companies spending tens of thousands a month. Excellent when you're there, and the wrong shape before it.
A hire: right when infrastructure work fills a week, every week, for a few months running. Until then the arithmetic is hard to argue with. The advertised UK median for a DevOps engineer is £70,000 (ITJobsWatch, six months to 20 Oct 2026); in the US, Indeed puts the average base at $134,811. On top: employer National Insurance at 15% in the UK, benefits at around 30% of total pay in the US (BLS, June 2026), and an agency fee that one large UK recruiter publishes at 22% to 27% of first-year pay. And the wait: technical roles take a median of 75 days to first fill in Ashby's 2026 data (Ashby). Our hiring guide has the full comparison, and we help with the handover when you get there.
Blue strips are monthly. Prices in USD, excluding tax.
Three plans. The difference is hours and how fast we answer.
Three months, then month to month with 30 days' notice. No setup or onboarding fee. The $1,900 review fee comes off month one if you start within 30 days. Plan by plan detail and everything else we sell.
Questions founders ask about managed DevOps services.
What is managed DevOps?
A monthly service where an outside team runs the infrastructure and delivery side of your product: deploys, monitoring, backups, access, patching, cost and incident response, with response times agreed in writing. The provider is accountable for the running of things, not just for hours worked.
What is the difference between DevOps consulting and managed DevOps?
Consulting is a project with an end: build the pipeline, migrate the database, write the report, leave. Managed DevOps is the month after that, and every month after: someone keeps the pipeline green, answers the alert and reads the bill. Most of our clients have both: the readiness review or a migration first, then a plan.
Does a startup need DevOps?
It needs the work done, not necessarily a person. Something has to deploy your code, keep backups restorable, remove leavers' access and tell you before the bill doubles. At two or three engineers the CTO usually does it in a few hours a week. When that becomes a day a week, or something breaks that nobody saw coming, it's time for outside help or a hire.
Should a startup invest in DevOps before Series A?
In the basics, yes, because Series A technical due diligence asks about them: who has access, whether backups have been restored, how deploys happen and what the cloud costs per customer. Not in platform engineering, Kubernetes or a staffed night shift. Our Series A prep guide lists what reviewers ask.
Is DevOps as a Service suitable for startups?
It can be, if the plan is sized for a startup. Many DevOps-as-a-service offers are built for companies with large AWS bills: priced as a share of spend, with minimums and annual terms. Look for published hours, response times in the contract and month-to-month terms after a short start.
Which is better for a startup: in-house DevOps or an outsourced service?
Outsourced while the work is part-time, in-house once it fills a week every week. A first hire costs £70,000 or about $135,000 in base pay before overheads and fees, and takes months to find. Our Growth plan is $4,900 a month. The crossover, and when hiring wins, is in the hiring guide.
How much do managed DevOps services cost?
With us, $2,900, $4,900 or $7,900 a month for 20, 40 or 80 hours. Among the providers we surveyed that publish hours, 40 hours a month costs between $2,500 and $8,500. Plans priced as a share of your AWS bill, or with a 24/7 operations centre, usually start higher.
What is included in a managed DevOps retainer?
With us: everything in the table at the top of this page, the monthly report, and the plan's hours for whatever your team points us at. Not included: application code, 24/7 on-call unless you add it, and your AWS bill or tool licences, which you pay directly and we never mark up.
Does a seed-stage startup need 24/7 cover?
Usually not yet. If your customers are businesses in your own time zone and your product tolerates an hour of downtime at 3am, a staffed night shift is money better spent on the product. If you serve consumers worldwide, or an outage breaches a customer contract, you need it, and the add-on exists for that. We'll tell you which you are after the first month of alert data.
What access do you need?
IAM roles you create, scoped to the work, plus access to the repositories and the monitoring. No passwords, no root, no long-lived keys. Production write access only when a change needs it, and every change arrives as a pull request. The detail is in how we work.
We already have one engineer who does some of this. Can you work alongside them?
Yes, and it usually goes well: they keep the parts they like, we take the routine and the on-call in support hours, and everything we do is written down so they can see it. We'll agree in week one who is paged for what.
Do you manage Kubernetes?
On the Scale plan, yes, including upgrades. On smaller plans we'd ask why you have it first; for most teams under fifteen engineers, ECS or Fargate does the job for less. Our ECS vs EKS guide is the honest version of that conversation.
How do we leave?
Thirty days' notice after the first three months. We do a handover month: shared on-call, a walkthrough of every repository and runbook, and a written list of anything unfinished. Then we remove our own access and send you the list of what we removed.