SaaS on AWS: Series A to Series B Infrastructure Gates (2026)
Quick summary: On a B2B SaaS crossing Series A (~$18.5k/mo AWS), running the funding-stage gate checklist before the B round cut diligence prep from 11 weeks to 4 — Organizations split, WAF, and SOC2 evidence path without re-platforming.
Key Takeaways
- On a B2B SaaS crossing Series A (~$18
- 5k/mo AWS), running the funding-stage gate checklist before the B round cut diligence prep from 11 weeks to 4 — Organizations split, WAF, and SOC2 evidence path without re-platforming
- AWS Activate offers up to $5,000 for self-funded Founders and up to $200,000 for Portfolio startups (Pre-Series B) with an investor Org ID — as of the July 2026 Activate credits page
- Credits offset infrastructure but do not replace funding-stage architecture decisions: the teams that burn runway on re-platforming at Series B usually skipped gates at Series A
- This post is funding-stage infrastructure gates — what to add at Seed, Series A, and Series B
Table of Contents
AWS Activate offers up to $5,000 for self-funded Founders and up to $200,000 for Portfolio startups (Pre-Series B) with an investor Org ID — as of the July 2026 Activate credits page. Credits offset infrastructure but do not replace funding-stage architecture decisions: the teams that burn runway on re-platforming at Series B usually skipped gates at Series A.
This post is funding-stage infrastructure gates — what to add at Seed, Series A, and Series B. It is not cost-optimized SaaS stack (component reference), not multi-tenancy models (silo vs pool), not startup cost explosion patterns (failure modes), and not the aws-startups industry hub (services overview).
Artifacts: series milestone checklist, infra cost gates worksheet CSV.
Benchmark pattern (not a cited client) — B2B SaaS, ~$18.5k/mo AWS at Series A close, ~120 paying customers, single account before gate run. After checklist: 3-account Organizations split, Multi-AZ Aurora, WAF on ALB, org CloudTrail — ~$19.4k/mo (+6%). Series B diligence prep 11 weeks → 4 weeks (SOC2 evidence path documented). No re-platform.
Three gates — run in order
| Stage | Revenue band (typical) | Non-negotiable gates | Defer until |
|---|---|---|---|
| Seed | Pre-PMF, < $50k MRR | Tags, budgets, Activate Founders, no IAM users | Multi-account |
| Series A | ~$50k–$200k MRR | Organizations (3 accounts), Multi-AZ, WAF, org CloudTrail | Savings Plans |
| Series B | ~$200k+ MRR | SCPs, SOC2 evidence baseline, SP/RI commit, DR doc | Multi-region active-active |
Opinionated take: Series A is the inflection — not Seed (too early for account overhead) and not Series B (too late for clean evidence). Investors ask for cost attribution and security posture at A; enterprise pilots fail on single-AZ at B.
Seed — stay lean, stay measurable
- Cost allocation tags on every resource (
environment,service,team) - Budget alerts at 80% and 100% of monthly cap
- AWS Activate Founders when you deploy (up to $5,000 credits)
- CI/CD via OIDC to IAM roles — no long-lived access keys
Do not split accounts at Seed unless compliance mandates it. One account with strict tagging beats three accounts with tag drift.
Series A — investor-ready infrastructure
- AWS Organizations: prod / non-prod / shared (ECR, DNS, log archive)
- Multi-AZ Aurora or RDS on production
- AWS WAF on public ALB — blocks scanner noise before SOC2
- CloudTrail organization trail → S3 with Object Lock or MFA delete
- Activate Portfolio credits (up to $200k) via investor Org ID before ML/GPU spikes
What broke — Series A startup, $22k/mo bill, investor asked for prod vs staging split in 72 hours. Single account — no tags on 40% of resources. Emergency tag campaign + Cost Explorer saved the meeting but delayed term sheet 2 weeks. Gate #1 (tags) exists because of this failure mode.
Series B — enterprise sales enablement
- SCP guardrails on production OU (region allow-list, instance size caps)
- SOC 2 Type II evidence: Config conformance packs, Security Hub, quarterly access reviews — start at A, audit at B
- Savings Plans only after 30-day stable baseline post account split
- DR strategy documented (pilot light minimum) — enterprise RFPs ask
Per-tenant cost attribution for top 20% revenue customers — tag or application-level (FinOps tagging guide).
When NOT to escalate
| Situation | Stay at current gate |
|---|---|
| < $5k/mo AWS, < 10 customers | Seed checklist only |
| No enterprise pipeline | Defer SOC2 evidence sprint |
| Traffic doubles monthly | Defer Savings Plans |
| ”Microservices for scale” with team of 4 | Modular monolith per monolith scale guide |
What to do this week
- Identify your funding stage and open the milestone checklist.
- Fill infra-cost-gates-worksheet.csv with current MRR and AWS spend.
- If Series A: create 3-account Organizations skeleton before next board deck.
- If Activate credits unused: apply at startups.aws before GPU experiments.
- Schedule WAF on ALB if public API exists — before first enterprise security questionnaire.
Reproduce this — Download infra-cost-gates-worksheet.csv. Fill
aws_monthly_spend_usdandfunding_stage. Mark gates complete in series-milestone-checklist.md. Do not skip Seed tags if you are pre-Series A.
What this post doesn’t cover
- Component selection (ECS vs Lambda vs EKS) — cost-optimized SaaS stack.
- Tenancy isolation (silo/pool/bridge) — multi-tenancy guide.
- Activate application mechanics — AWS Startups portal; credits terms change — verify before apply.
- Full SOC 2 implementation — SOC 2 on AWS checklist.
Related: Cost optimization services · Cloud security · AWS for startups
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
