SaaS on AWS: Series A to Series B Infrastructure Gates (2026)
Quick summary: On a B2B SaaS crossing Series A (~$18.5k/mo AWS), running the funding-stage gate checklist before the B round cut diligence prep from 11 weeks to 4. The work was an Organizations split, WAF, and a SOC2 evidence path, with no re-platforming.
Key Takeaways
- On a B2B SaaS crossing Series A (~$18.5k/mo AWS), running the funding-stage gate checklist before the B round cut diligence prep from 11 weeks to 4
- The work was an Organizations split, WAF, and a SOC2 evidence path, with no re-platforming
- AWS Activate offers up to $5,000 for self-funded Founders and up to $200,000 for Portfolio startups (Pre-Series B) with an investor Org ID, as of the July 2026 Activate credits page
- Credits offset infrastructure but do not replace funding-stage architecture decisions: the teams that burn runway on re-platforming at Series B usually skipped gates at Series A
- This post is funding-stage infrastructure gates: what to add at Seed, Series A, and Series B
Table of Contents
AWS Activate offers up to $5,000 for self-funded Founders and up to $200,000 for Portfolio startups (Pre-Series B) with an investor Org ID, as of the July 2026 Activate credits page. Credits offset infrastructure but do not replace funding-stage architecture decisions: the teams that burn runway on re-platforming at Series B usually skipped gates at Series A.
This post is funding-stage infrastructure gates: what to add at Seed, Series A, and Series B. It is not cost-optimized SaaS stack (component reference), not multi-tenancy models (silo vs pool), not startup cost explosion patterns (failure modes), and not the aws-startups industry hub (services overview).
Artifacts: series milestone checklist, infra cost gates worksheet CSV.
Three gates: run in order
| Stage | Revenue band (typical) | Non-negotiable gates | Defer until |
|---|---|---|---|
| Seed | Pre-PMF, < $50k MRR | Tags, budgets, Activate Founders, no IAM users | Multi-account |
| Series A | ~$50k–$200k MRR | Organizations (3 accounts), Multi-AZ, WAF, org CloudTrail | Savings Plans |
| Series B | ~$200k+ MRR | SCPs, SOC2 evidence baseline, SP/RI commit, DR doc | Multi-region active-active |
Opinionated take: Series A is the inflection. Seed is too early for account overhead and Series B is too late for clean evidence. Investors ask for cost attribution and security posture at A; enterprise pilots fail on single-AZ at B.
Seed: keep it lean and measurable
- Cost allocation tags on every resource (
environment,service,team) - Budget alerts at 80% and 100% of monthly cap
- AWS Activate Founders when you deploy (up to $5,000 credits)
- CI/CD via OIDC to IAM roles with no long-lived access keys
Do not split accounts at Seed unless compliance mandates it. One account with strict tagging beats three accounts with tag drift.
Series A: investor-ready infrastructure
- AWS Organizations: prod / non-prod / shared (ECR, DNS, log archive)
- Multi-AZ Aurora or RDS on production
- AWS WAF on public ALB: blocks scanner noise before SOC2
- CloudTrail organization trail → S3 with Object Lock or MFA delete
- Activate Portfolio credits (up to $200k) via investor Org ID before ML/GPU spikes
Series B: enterprise sales enablement
- SCP guardrails on production OU (region allow-list, instance size caps)
- SOC 2 Type II evidence: Config conformance packs, Security Hub, quarterly access reviews; start at A, audit at B
- Savings Plans only after 30-day stable baseline post account split
- DR strategy documented (pilot light minimum); enterprise RFPs ask
Per-tenant cost attribution for top 20% revenue customers: tag or application-level (FinOps tagging guide).
When NOT to escalate
| Situation | Stay at current gate |
|---|---|
| < $5k/mo AWS, < 10 customers | Seed checklist only |
| No enterprise pipeline | Defer SOC2 evidence sprint |
| Traffic doubles monthly | Defer Savings Plans |
| “Microservices for scale” with team of 4 | Modular monolith per monolith scale guide |
What to do this week
- Identify your funding stage and open the milestone checklist.
- Fill infra-cost-gates-worksheet.csv with current MRR and AWS spend.
- If Series A: create 3-account Organizations skeleton before next board deck.
- If Activate credits unused: apply at startups.aws before GPU experiments.
- Schedule WAF on ALB if public API exists, before first enterprise security questionnaire.
What this post doesn’t cover
- Component selection (ECS vs Lambda vs EKS): cost-optimized SaaS stack.
- Tenancy isolation (silo/pool/bridge): multi-tenancy guide.
- Activate application mechanics: AWS Startups portal; credits terms change, so verify before applying.
- Full SOC 2 implementation: SOC 2 on AWS checklist.
Related: Cost optimization services · Cloud security · AWS for startups
Frequently asked questions
When should a SaaS startup split into multiple AWS accounts?
When should we NOT apply for AWS Activate Portfolio credits?
What breaks if we defer multi-AZ until Series B?
How does this differ from the cost-optimized SaaS stack post?
When should we commit to Savings Plans?
What could go wrong during SOC2 prep at Series B?
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
