Aivar designed and delivered a dual-region AWS infrastructure across Singapore (ap-southeast-1) and N. Virginia (us-east-1), architected around the four Infrastructure Protection pillars. All resources are provisioned using Terraform, ensuring consistent, auditable, and reproducible security configuration across both production regions.
Trust Boundaries
Each production region hosts a VPC with three-tier subnet isolation: public subnets for NAT Gateways only, private subnets for Amazon EKS workloads, and data-tier subnets for RDS PostgreSQL, ElastiCache Redis, OpenSearch, and DynamoDB. All data-tier resources carry zero public IP addresses and zero internet gateway routes. Inter-region VPC Peering with controlled route tables provides the only cross-region connectivity path, and AWS Site-to-Site VPN provides the only hybrid path to Azure during migration.
System Security Configuration and Maintenance
All infrastructure is defined in Terraform and stored in version control — no manual console changes are permitted in production. AWS Security Hub was enabled and audited before production cutover, with mandatory remediation of all critical and high findings as a go-live gate. Amazon ECR repositories are configured with scan-on-push, preventing container images with known high or critical vulnerabilities from reaching EKS. Encryption at rest is enforced across all data services: S3, RDS, ElastiCache Redis, DynamoDB, and EBS volumes.
Authentication and Authorization
AWS IAM Identity Center provides centralized, MFA-protected console access. Programmatic access uses STS-issued temporary credentials derived from IAM roles — no long-lived IAM user access keys exist for human access. IRSA (IAM Roles for Service Accounts) enables pod-level least-privilege for EKS workloads, eliminating static credentials from Kubernetes manifests and environment variables. All secrets previously stored in Azure Key Vault were migrated to AWS Secrets Manager with automatic rotation policies. Every individual accesses the environment through dedicated, uniquely attributable credentials with a full CloudTrail audit trail.
Infrastructure-Level Policy-Enforcement Points
VPC Endpoints (Gateway for S3 and DynamoDB; Interface for ECR, Secrets Manager, and CloudWatch) are deployed in both regions, forcing all AWS service traffic onto the AWS backbone and eliminating internet exposure for sensitive service interactions. Security Groups act as stateful enforcement points at every resource — denying all traffic not explicitly permitted. NACLs provide a stateless enforcement layer at every subnet boundary, independent of Security Group rules. One NAT Gateway per VPC serves as the sole controlled outbound internet path from private subnets. AWS Client VPN provides authenticated, encrypted developer access to private resources with no management interfaces exposed to the internet.
Aivar conducted a Total Cost of Ownership analysis to validate the cost-optimized dual-region architecture: right-sizing EKS node groups, RDS instance classes, and ElastiCache nodes to the Client's live traffic patterns, and converting on-demand compute and database spend into committed-use pricing through AWS Compute Savings Plans and RDS Reserved Instances — targeting a 30–40% cost reduction versus on-demand pricing once post-cutover traffic patterns stabilized.
1. DMS Replication Lag Risk: DMS CDC replication lag spikes due to Azure PostgreSQL write volume were identified as a high-likelihood risk. Mitigation included sizing the DMS replication instance with headroom, monitoring lag continuously via CloudWatch, and enforcing a cutover gate requiring lag = 0 sustained for one hour. This has been adopted as a standard methodology element for future Azure-to-AWS migrations.
2. VPN Bandwidth for Large Storage Transfers: Site-to-Site VPN bandwidth constraints for large Blob-to-S3 data transfers were addressed by scheduling bulk sync during off-peak hours, tuning AzCopy parallel thread count, and enabling S3 Transfer Acceleration. Bandwidth assessment during discovery is now a standard step before committing to migration schedules.
3. Security Hub Early Enablement: Enabling Security Hub during Week 4 of a five-week programme left limited time for finding remediation before cutover. Future engagements enable Security Hub at the end of Week 2 to allow a full two-week window for identification and remediation before the cutover window.
.svg)
.svg)
.svg)
.svg)
