Hybrid, Multi-Region Networking for a Regulated Financial-Services Group

Aivar designed and delivered a network foundation in Mumbai (ap-south-1), with disaster recovery in Hyderabad (ap-south-2). The solution combined the following, delivered as Terraform code:

‍

• Per-domain Transit Gateways: one Transit Gateway per regulated domain per region, shared to workload accounts through AWS Resource Access Manager. A workload can route only within its own domain, and cross-domain calls pass through a single audited integration broker.
  ‍
• Active-active hybrid connectivity: the Azure VPN gateway was upgraded to active-active. Two customer gateways, two VPN connections and four BGP tunnels carry replication and application traffic for the whole migration period.
  ‍
• Secure egress: each domain has an egress VPC with NAT gateways in two Availability Zones behind AWS Network Firewall, which applies Layer 3 to Layer 7 inspection and domain allowlisting. Workload VPCs have no internet gateway, enforced by service control policy.
  ‍
• Graduated cutover: Route 53 weighted routing moved applications from Azure to AWS in four metric-gated steps, with a binary rollback trigger at each step. The database moved last, in its own window.
  ‍
• Disaster recovery: a configuration-identical network stack in Hyderabad, pilot-light compute that scales on failover, RDS cross-region read replicas, and S3 cross-region replication. AWS Backup copies recovery points to a backup vault in Hyderabad and restores AMIs into the pilot-light VPC during failover. Recovery objectives are an RTO of 2 hours and an RPO of 15 minutes; measured results are under Key Outcomes.
  ‍
• Governance and monitoring: AWS Control Tower account vending through Account Factory for Terraform, deny-by-default security groups, network ACLs, AWS Shield Standard, CloudWatch alarms on tunnel state, VPC Flow Logs, and a daily drift check.
  ‍

Alternatives were weighed against regulatory and migration constraints. A shared Transit Gateway was rejected because it makes cross-domain routes the default. The per-domain design costs more gateways, egress VPCs and KMS keys, and the customer accepted that cost. Application-layer failover was chosen over DNS-based egress failover, which was judged too slow and too opaque.

The architecture spans two regions. In the primary region, the application runs as an Amazon ECS cluster across three Availability Zones, behind an Application Load Balancer. Each Availability Zone has a database subnet holding an Amazon RDS instance. Shared services, including IAM, CloudTrail, Control Tower, KMS, GuardDuty, Security Hub, AWS Config, CloudWatch and ECR, support the VPC. The disaster-recovery VPC in Hyderabad holds three RDS cross-region read replicas, an S3 replica bucket, and AWS Backup copies of AMIs and database recovery points for restore during failover.

‍

‍

• Recovery: AWS Backup DR recovery to restore services in against a 2-hour RTO objective, against a 15-minute RPO objective.
  ‍
• Hybrid connectivity: VPN tunnel availability for a stated period, and the P95 application-to-database latency, with the Azure baseline for comparison. Both come from CloudWatch or your monitoring tool.
  ‍
• Cutover: the customer-facing downtime in minutes, the number of weighted steps completed, and the number of rollbacks.
  ‍
• Cost (business outcome): the actual monthly AWS bill for a stated month, compared with the previous Azure spend. Take this from Cost Explorer and the Azure invoices.
  ‍
• Availability (business outcome): the application’s measured uptime for the same period on Azure and on AWS.
  ‍
• Security score: the current AWS Security Hub score with its date.

• Fix the address plan before provisioning. A VPC's address range cannot be changed in place. Ratify non-overlapping ranges with the customer before any VPC is created. 
  ‍
• Load-test the hybrid link. Replication and database traffic depend on VPN throughput and latency. Measure both under production-shaped load before any production application relies on the link. 
  ‍
• Confirm DNS capabilities early. Graduated cutover needs weighted records and short TTLs. Confirm the DNS provider supports both, or move DNS to Route 53 first.
  ‍
• Treat isolation as a deliberate cost. The per-domain design uses more gateways, egress VPCs and KMS keys than a shared model. Document the trade-off so it is accepted as a regulatory decision.
  ‍
• Make recovery a tested deliverable. Provisioning a DR stack is not enough. Require a timed drill and runbooks the customer can execute on its own.