AWS runs the platform. We run what you built on it.
AWS managed services, 24/7, from a UK SRE team.
AWS keeps the data centres, the hardware and its own services running. Everything you build on top is yours to operate: the accounts, the workloads, the alarms, the access and the bill, at 3am as much as at 3pm. Critical Cloud takes that on. We operate your AWS estate around the clock, own every incident to resolution and fix the causes every month. AWS Partner, and the world's first Powered by Datadog accredited MSP.
Each of these feeds Datadog, so a CloudWatch alarm, a trace and a GuardDuty finding land in the same place when something goes wrong.
What is an AWS managed service provider?
An AWS managed service provider, often shortened to AWS MSP, runs your AWS environment day to day: monitoring the workloads, responding to incidents, operating security and cost controls, and improving the architecture over time. AWS stays responsible for the cloud itself. The provider takes on the running of what you have built in it.
Multi-account AWS, operated as one estate
Accounts, workloads, security findings and spend, run by the same on-call team and seen through the same Datadog account.
Accounts and landing zones
We operate across hub-and-spoke account structures built on AWS Organizations and Control Tower, and keep guardrails and access consistent as accounts are added.
Containers, serverless and databases
EC2, ECS, EKS, Lambda and RDS, monitored through CloudWatch and Datadog together. X-Ray and Datadog tracing follow a request from a container through a Lambda function to the database call behind it.
GuardDuty and Security Hub
Findings are triaged and escalated within contracted response times, and IAM Access Analyzer drives the access reviews in the monthly work. Security alerts get operational triage and containment. We are not a SOC.
AWS spend
Cost Explorer, the Cost and Usage Report and Compute Optimizer feed rightsizing and Savings Plans recommendations, delivered as monthly improvement work rather than a one-off report.
Change and recovery
Terraform and Systems Manager make changes repeatable and auditable. AWS Backup policies define what can be restored and from when. Material changes need your sign-off.
Well-Architected, applied monthly
Improvement engineering uses the AWS Well-Architected Framework to decide what to fix first and why. If you want a baseline before deciding, a Cloud HealthScan measures your estate against it, read-only.
AWS Support plans vs a managed service provider
The two get mistaken for each other. They do different jobs.
An AWS Support plan gives you access to AWS engineers when something on the AWS side needs investigating: a service behaving unexpectedly, a quota, a billing query, an architecture question. The higher plans add faster response targets and a technical account manager. It is good at that job.
It does not run your workload. AWS Support does not own your incidents, does not watch your application out of hours and does not carry out the fix. It advises, and your team acts. A managed service provider is the team that acts.
| AWS Support plan | Critical Cloud | |
|---|---|---|
| Scope | AWS services and how your account uses them | Your workload: accounts, services, alarms, access and cost |
| When production fails at 3am | You open a case, and AWS responds within your plan's target | Our on-call SRE responds when your alert fires |
| Incident ownership | Advisory. Your team carries out the fix | We own response and recovery |
| Proactive work | Guidance and automated checks | Monthly improvement engineering across six pillars |
| Monitoring | CloudWatch, configured by you | Datadog and CloudWatch, configured and run by us |
| Runbooks | You build and maintain them | We build, own and improve them |
| Postmortems | Not standard | Blameless postmortem for every SEV-1 |
The two work together. When the cause sits inside AWS, we handle the escalation to AWS and keep working the incident while it is investigated.
AWS Support answers the question. We act on it.
Three ways to hand over AWS operations
Each tier carries a contractual 15-minute response to SEV-1 incidents and runs on Datadog in your own account.
Critical Support for AWS
The flagship. We take the pager for your AWS estate 24×7 and spend agreed hours every month on reliability, security, cost, performance, automation and governance. Plans run from a single landing zone to five or more across AWS and Azure.
Critical Support for AWS →Critical Support Lite
For a single AWS environment with one landing zone and no dedicated ops team. Incident cover in the windows you choose, 8 to 24 hours of improvement engineering a month, and a clear step up to Critical Support.
Critical Support Lite →Critical Response
Incident cover only, for AWS teams who run the day-to-day themselves. Choose daytime, evenings and weekends, or 24×7. Detection, escalation and recovery, with no improvement backlog attached.
Critical Response →Datadog on AWS, from trial to steady state
For AWS teams where Datadog is new, half-configured, or running without an owner.
FETCH
Complimentary trial enablement. We connect your AWS accounts to Datadog, instrument the workloads that matter and build the first dashboards and monitors, so the trial answers a real question before you commit.
FETCH trial enablement →LaunchPad
A fully project-managed Datadog rollout across your AWS accounts, in three phases. Tagging standards, SLOs, alerting and team onboarding are set up once, and set up properly.
LaunchPad implementation →HyperCare
Two weeks straight after Datadog goes live on AWS. We fix misconfigured integrations, quieten noisy monitors and rebuild dashboards while the rollout is fresh, before bad habits settle in.
HyperCare post go-live →Catalyst
Backlog-led engineering for an existing Datadog estate on AWS: log strategy, alert noise, cost control and coverage gaps. Engineers who do the work, not a list of recommendations.
Catalyst improvement engineering →Managed Observability
Monthly management of the Datadog platform itself, also known as Managed Datadog: configuration governance, signal quality and cost, so your AWS engineers are not also the observability team.
Managed Observability →HealthScan
An independent, read-only review of a Datadog setup on AWS that has run for six months or more. Scored across coverage, signal quality, alert hygiene and cost, ending in a prioritised backlog. Newer setups are better served by HyperCare or LaunchPad.
HealthScan assessment →FAW / Hopp Studio: AWS with Critical Support
24×7 incident response plus proactive improvement for coaching systems and public websites running on AWS. Tighter Datadog monitoring, quicker recovery, and improved resilience during high-traffic events.
AWS managed services: common questions
What is an AWS managed service provider?
An AWS managed service provider, often shortened to AWS MSP, runs your AWS environment day to day: monitoring the workloads, responding to incidents, operating security and cost controls, and improving the architecture over time. AWS stays responsible for the cloud itself. The provider takes on the running of what you have built in it.
Is AWS Support enough?
For questions about AWS services, often yes. AWS Support gives you access to AWS engineers for problems on the AWS side, and the higher plans add faster response targets and a technical account manager. It does not run your workload, own your incidents or watch your application out of hours. A managed service provider does that part, and handles the escalation to AWS when the cause sits inside AWS.
Do you work in our AWS accounts?
Yes. We operate inside your AWS accounts and your own Datadog account, not copies on our side. You keep IAM and admin control, you approve our access, and material changes need your sign-off. If we part ways, the runbooks, dashboards and history stay with you.
Which AWS services do you manage?
EC2, ECS, EKS, Lambda and RDS workloads, across multi-account estates built on AWS Organizations and Control Tower. Around them we operate CloudWatch, X-Ray, GuardDuty, Security Hub, IAM Access Analyzer, Cost Explorer, Compute Optimizer, Systems Manager and AWS Backup, with Datadog across all of it.
Do you work with smaller AWS environments?
Yes. Critical Support Lite is sized for a single AWS environment with one landing zone and no dedicated ops team, and it steps up to Critical Support as the estate grows into more accounts.
AI workloads on AWS run on the same operated stack: part of the trust layer for AI operations. How we operate the trust layer →
Running production on AWS?
Tell us how many accounts you run, what runs in them and who is on call today. We'll recommend the right service.