Case Study
A wealth management firm needed its development team to deploy containerized applications on Azure quickly and autonomously, without being given access to the infrastructure. Junior and mid-level engineers weren't supposed to touch Terraform or operate Azure resources directly, but they couldn't be left blocked waiting on the infrastructure team either. Until then, every application was deployed manually, one case at a time, from the Azure portal, with no declarative state and no versioned releases — which left environments inconsistent and no auditable record of which version was running where, a serious problem for a financial firm with real governance requirements.
Renaiss built a private, multi-environment, self-service Azure platform resting on three pieces: a declarative YAML catalog, a library of Terraform modules on top of Azure Verified Modules, and a deliberately decoupled CI/CD. The catalog is the boundary between teams: developers declare their application in a YAML file and open a pull request, without writing Terraform or logging into the Azure portal; on the other side, Terraform resolves the configuration and provisions the resources, keeping infrastructure ownership with the platform team.
GitHub Actions builds and validates; Azure DevOps deploys — with a single coupling point between the two, an Azure Container Registry webhook. The entire topology is private end to end, with secrets resolved through Key Vault and managed identity, and observability integrated with Datadog.
Adding an application went from a manual process coordinated across teams to a YAML file and a pull request. Developers never touch Terraform or operate Azure directly, and they don't depend on the infrastructure team to move forward. The platform is now reproducible and auditable: environments are built from the same code, deployments ship as versioned artifacts, and click-ops is gone from the workflow entirely — without giving up the security and governance a regulated financial firm demands.
Adding a new application went from requiring manual coordination with infrastructure to a YAML file and a PR.
Every infrastructure change is versioned and reviewable through a PR — nothing is applied by hand from the portal.
The entire platform runs inside a virtual network, with no publicly exposed resources and secrets managed through Key Vault.
GitHub Actions and Azure DevOps talk only through a webhook, so either one can be replaced without touching the other.
Dev and production are built from the same declarative code, eliminating drift between environments.
Every deployment is tied to a versioned artifact, so you know what runs where and can roll back in a controlled way.
Mapping the Boundary Between Teams
We found that the real challenge wasn't technical but organizational: figuring out where to draw the line between what a developer can request and what the platform team controls.
Declarative Catalog Design
We built a YAML catalog where each application is declared along with its environments, resolved by Terraform with clear, consistent configuration precedence.
Terraform Modules on AVM
We developed a library of in-house modules on top of Azure Verified Modules, with strict separation between modules and environments, and versioned remote state.
Private Network Topology
We designed a fully private architecture, with a VNet, segmented subnets, Private DNS, and APIM as the single entry point to the services.
Decoupled CI/CD
We set up GitHub Actions as the build runner and Azure DevOps as the deployment orchestrator, connected only by an Azure Container Registry webhook.
Audience-Specific Documentation and Handoff
We delivered sectioned documentation: one surface for the development team, scoped to the catalog workflow, and another for the infrastructure team covering how the platform actually runs.
Nearshore means hiring a tech team in a country geographically and culturally close to yours — typically within 1–3 time zones. For US companies, that means Latin America. You get real-time collaboration, overlapping work hours, and engineers who operate in English, without the communication friction that comes with offshore teams 10+ hours away.
We're based in Argentina — UTC-3. That means 4–5 hours ahead of the US West Coast and 2 hours ahead of the East Coast. In practice, we maintain a daily overlap of 4–6 hours with most US-based teams, which covers standups, code reviews, and real-time problem-solving without anyone working at midnight.
Our work sits at the intersection of cloud infrastructure, application architecture, and AI. Concretely: cloud-native architecture design, infrastructure automation, platform engineering, data pipelines, and GenAI integration. We don't do generic cloud support — we build and run systems that need to scale.
Our primary depth is in AWS. We also work with Azure and GCP depending on the client's existing stack — the goal is always to work within your environment, not to push a preferred vendor.
Yes — and it's one of the problems we work on most. App modernization usually means one or more of the following: breaking a monolith into services, re-platforming to cloud-native infrastructure, replacing outdated dependencies, or improving the CI/CD pipeline so your team can ship faster. We start with a technical assessment before recommending any approach.
© 2026 - Renaiss with love
