The client, an on-demand agri-tech services platform operates a containerized application platform on AWS, deployed across separate Development, Staging, and Production environments to support independent release and testing cycles for the application.
The agri-tech client needed to migrate its existing infrastructure from Microsoft Azure to AWS with minimal downtime, while establishing a reliable, scalable, and highly available foundation across three environments. The target environment needed to run containerized application workloads with independent scaling and lifecycle management for worker nodes, apply consistent identity and access management across the Development, Staging, and Production accounts from a single place, and route traffic securely to multiple application services through a shared, centrally managed load balancer with automated certificate issuance and renewal. It also needed to keep DNS records synchronized automatically with application deployments rather than maintained manually, provide a managed, network-isolated relational database with automated backups and restricted access, and give the team full visibility into API activity and cloud spend across every environment.
Comprinno designed and built a three-tier AWS environment for the client, with each of the Development, Staging, and Production environments following the same architectural pattern: three public subnets, three private application subnets, and three private database subnets distributed across three Availability Zones. An Internet Gateway handles inbound traffic, and a NAT Gateway with an Elastic IP provides controlled outbound internet access for the private subnets. Interface VPC endpoints are deployed across all three private application subnets and secured by a dedicated security group that restricts traffic to HTTPS within the VPC.
The platform runs on a well-architected, three-tier VPC design replicated independently across Development, Staging, and Production environments, each distributed across three Availability Zones with public, private application, and private database subnets in every zone. An Internet Gateway handles inbound traffic, while a NAT Gateway with an Elastic IP provides controlled outbound access for the private application subnets, with separate route tables governing each subnet tier and interface VPC endpoints securing HTTPS traffic within the VPC. Inbound requests first pass through AWS WAF, which filters malicious traffic before it reaches a shared Application Load Balancer that terminates SSL/TLS using an ACM-issued certificate and routes validated requests to the appropriate backend service on Amazon EKS. EKS hosts all containerized workloads across the private application subnets in multiple Availability Zones, with AWS managing the Kubernetes control plane and node lifecycle, and container images sourced from dedicated Amazon ECR repositories. Amazon RDS for PostgreSQL runs in the private database subnets with public access disabled, reachable only from the EKS cluster security group, while Amazon S3 provides encrypted, access-blocked object storage for application files, CI/CD artifacts, and audit logs. Account-level governance is layered on top through AWS IAM, AWS Organizations, and AWS Control Tower for identity and multi-account management; AWS KMS, ACM, and AWS Secrets Manager for encryption and credential handling; and Amazon CloudWatch, AWS CloudTrail, AWS Security Hub, and Amazon GuardDuty for continuous monitoring, audit logging, and security findings across the environment.
By migrating the agri-tech client's infrastructure from Microsoft Azure to Amazon Web Services, Comprinno built a resilient, well-governed platform on Amazon EKS that supports independent Development, Staging, and Production environments from a consistent architectural foundation. Combining containerized compute on Amazon EKS, automated traffic and certificate management, a managed and network-isolated PostgreSQL database, and centralized identity, secrets, and audit controls, Comprinno delivered an infrastructure that the client can operate securely and scale as the platform grows.
Comprinno Achieves AWS Data and Analytics Competency | Read More →
