Cloud-Native Foundation for a 3D Medical Imaging Platform

Aivar designed and implemented a phased cloud modernization engagement focused on Secure Multi-Account Governance, IoT Device Connectivity, and GPU-Accelerated Compute.
‍

• Infrastructure as Code (IaC) & Automation: AWS Control Tower and AWS Organizations establish a ten-plus account landing zone in us-west-2 with Service Control Policies and CloudFormation Guard guardrails, provisioned and version-controlled through Terraform.
  ‍
• Secure IoT Device Onboarding: AWS IoT Core with Just-in-Time Provisioning issues unique X.509 certificates to each deployed X-ray machine on first connection, routing raw DICOM/TIFF projection frames to secure S3 storage via IoT Rules without manual device configuration.
  ‍
• GPU-Accelerated Reconstruction Pipeline: the 3D reconstruction algorithm is containerized and deployed on Amazon EKS with GPU-enabled managed node groups, using Karpenter to scale GPU nodes to zero between reconstruction job batches.
  ‍
• DevSecOps CI/CD Pipeline: a GitOps-driven pipeline using GitHub Actions and Argo CD automates packaging and deployment, with security gates including Trivy, Checkov, Semgrep, Hadolint, and OWASP ZAP blocking promotion on critical or high severity findings.
  ‍
• Governance & Identity: AWS IAM Identity Center provides centralized SSO across all accounts, while AWS Config, GuardDuty, Security Hub, and organization-wide CloudTrail deliver continuous compliance monitoring and audit logging.

The solution combines governance, IoT, container, and security services into a layered environment purpose-built for a regulated medical device manufacturer:
‍

• AWS Control Tower and AWS Organizations, provisioned through Terraform, establish the secure Multi-Account Landing Zone — a ten-plus account structure with Service Control Policies and CloudFormation Guard guardrails enforcing governance across every environment.
  ‍
• AWS IoT Core with Just-in-Time Provisioning forms the device connectivity layer, issuing unique X.509 certificates to each X-ray machine and routing DICOM/TIFF projection frames into secure Amazon S3 storage via IoT Rules.
  ‍
• Amazon EKS with GPU-enabled managed node groups hosts the containerized 3D reconstruction pipeline as the core compute layer, with Karpenter scaling GPU nodes to zero between batches to eliminate idle cost.
  ‍
• A GitOps-driven CI/CD pipeline using GitHub Actions and Argo CD, gated by Trivy, Checkov, Semgrep, Hadolint, and OWASP ZAP, blocks promotion of any critical or high-severity finding before it reaches production.
  ‍
• AWS IAM Identity Center, AWS Config, GuardDuty, Security Hub, and CloudTrail deliver centralized identity, continuous compliance monitoring, and organization-wide audit logging across the entire landing zone.
  

• Governed Landing Zone Established: a fully governed, ten-plus account structure was deployed with preventive and detective guardrails before any clinical workloads were onboarded.
  ‍
• Zero-Touch Device Onboarding: automated JITP-based certificate issuance reduced per-device onboarding from 30–60 minutes of manual engineering effort to under 60 seconds.
  ‍
• Cost-Efficient GPU Compute: Karpenter-driven scale-to-zero autoscaling eliminated idle GPU costs between reconstruction job batches, replacing an always-on on-premises hardware model.
  ‍
• Validated Reconstruction Performance: achieved sub-60-second end-to-end wall-time for a complete 3D reconstruction job on GPU-enabled EKS nodes.
  ‍
• Security Gate Enforcement: the DevSecOps pipeline automatically blocks deployment of container images or infrastructure changes with critical or high severity findings across all environments.

• Pre-migration dependency mapping: validating that resources identified in the pre-migration inventory audit were genuinely safe to migrate or decommission required more coordination than anticipated due to undocumented dependencies; Aivar now includes a mandatory pre-migration dependency mapping workshop with explicit customer sign-off before any Management Account cleanup begins.
  ‍
• IoT policy design and tenant isolation: the initial Just-in-Time Provisioning template produced overly broad IoT topic permissions that required redesign after security review; Aivar now includes a dedicated IoT policy design and tenant isolation review phase in its discovery process for future medical device IoT engagements.
  ‍
• GPU driver and CUDA compatibility: containerizing the GPU reconstruction algorithm surfaced CUDA driver and toolkit version mismatches between the container base image and the target GPU nodes; Aivar now mandates a GPU driver and CUDA toolkit compatibility matrix review as a pre-containerization checklist item.