AI-Powered Data Governance and Control Services | AWS Migration | Standardizing Produktiv’s Cloud Environment to Securely Scale A Governed RAG & AI Agent Platform

Solution

Comprinno built a three-tier, multi-account AWS environment for Produktiv in the AWS Mumbai region, with dedicated VPCs for development, staging, and production, each following the same architectural pattern: public subnets, private application subnets, and private database subnets distributed across three Availability Zones. An Internet Gateway handles inbound traffic to the public subnets, while NAT Gateways in each AZ give private-subnet workloads controlled outbound access, and a bastion host in each public subnet is the sole path into the fully isolated private database subnets.

Key Actions:

1. Organizational and Identity Foundation: AWS Organizations is structured with dedicated Organizational Units separating the Development, Staging, and Production environments, with consolidated billing managed centrally and AWS accounts aligned to their respective OUs. IAM Identity Center provides centralized single sign-on across all accounts, replacing per-account IAM users.
2. Container Orchestration and Autoscaling: Production and Staging run on Amazon EKS, with compute organized into dedicated node pools separating backend, infrastructure, operator, and vault workloads for stronger isolation and resource governance. Node scaling is handled by Karpenter, which dynamically provisions and consolidates right-sized EC2 capacity to gracefully drain and reprovision nodes ahead of capacity events. Development runs on Amazon EC2 with a self-managed database, giving the team a lower-cost environment for early-stage testing.
3. Traffic Routing and CI/CD Automation: An Application Load Balancer in each environment handles all inbound HTTP/HTTPS traffic, redirecting HTTP to HTTPS and using host-based routing to direct requests to the appropriate backend, the core application, the identity service, or the monitoring interface, via the AWS Load Balancer Controller in EKS, or directly to EC2 targets in Development. AWS CodePipeline and CodeBuild automate the build and deployment process end to end: source changes trigger the pipeline, container images are built and pushed to per-service Amazon ECR repositories, and updated services are rolled out to EKS, while frontend assets are published to Amazon S3 and served through Amazon CloudFront.
4. Database and Storage Migration: The relational database layer was migrated to Amazon RDS for PostgreSQL using a dump-and-restore approach. Because the RDS instances sit in fully isolated private database subnets with no direct internet access, the migration was carried out through the environment's bastion host over an SSH tunnel, with post-migration validation performed to confirm data integrity, schema consistency, and application connectivity. Production data is encrypted at rest with a customer-managed AWS KMS key, backed by automated backups, point-in-time recovery, and Performance Insights for ongoing query visibility. Amazon S3 serves as the central storage layer across the environments used for database dumps, deployment artifacts, and infrastructure logs  with versioning, encryption, and blocked public access enforced on every bucket.
5. Security, Secrets, and Cost Governance: AWS Secrets Manager centrally stores and secures database credentials and third-party API keys, letting applications retrieve secrets at runtime through IAM roles rather than hardcoding them. AWS KMS encrypts data at rest across S3, EBS, and RDS with automatic key rotation, while AWS CloudTrail records a complete audit trail of account activity, including IAM changes, network changes, and database and secrets access and Amazon CloudWatch handles logging, metrics, and alerting. AWS Systems Manager enables secure, SSH-free remote access to EC2 instances alongside patch and configuration management, and AWS Security Hub aggregates findings across the security tooling into a single view of the account's security posture. AWS Budgets tracks both daily and monthly spend independently for each environment, with alerts at defined thresholds to catch cost anomalies early.

Architecture Overview

Produktiv's environments follow a high-availability-first design: each environment runs in its own VPC across three Availability Zones, split into public, private application, and private database subnets. In Staging and Production, traffic enters through an Application Load Balancer spanning all three zones, which routes it via host-based rules to the appropriate EKS-hosted service, while RDS PostgreSQL sits fully isolated in the private database subnets with no route to the public internet, reachable only through the bastion host. Development follows the same three-tier network pattern but runs on EC2 rather than EKS, keeping the environment lightweight for pre-production testing. NAT Gateways in each AZ let private-subnet workloads reach the internet, for example, to pull container images  without exposing them directly, and Karpenter's SQS-backed interruption handling keeps node scaling resilient to capacity events. Shared services: IAM Identity Center, AWS Certificate Manager, CloudTrail, and centrally managed S3 buckets, operate at the account level, giving every environment the same consistent security and governance baseline.