About Customer
Tesser Insights is an analytics firm headquartered in Alpharetta, GA, with additional offices in Portland, OR, and Orlando, FL, and offshore centres in Bangalore and Chennai, India. Their platform product, Spoggle, empowers hypergrowth companies by providing a comprehensive, ready-to-use analytics ecosystem. The analytics platform that Tesser developed using AWS technologies is now available in the AWS Marketplace.
Tesser initially operated on Azure but sought to migrate to AWS to leverage its advanced services and scalability. The goal was to establish a secure, scalable, multi-account AWS environment that adhered to best practices for managing user identities, permissions, and compliance. A significant aspect of this transition involved using Infrastructure as Code (IaC) with Terraform to maintain consistent configurations across various environments. Key priorities included implementing robust security controls, ensuring high availability and scalability of
Applications on Amazon ECS and developing a streamlined CI/CD pipeline to enhance their deployment processes.
Tesser's migration to AWS involved setting up a secure and scalable multi-account structure using AWS Control Tower. This approach ensured that all new AWS accounts were created following best practices, with consistent governance and security controls across the organization. The multi-account setup enabled Tesser to manage its environment effectively, ensuring compliance and security measures were uniformly applied.
Comprinno implemented a comprehensive Infrastructure as Code (IaC) solution using Terraform to manage Tesser’s AWS infrastructure. This solution allowed Tesser to define, deploy, and manage their cloud infrastructure consistently across various environments. All critical infrastructure components were codified by leveraging Terraform, ensuring consistency and reducing the risk of configuration drift.
Custom IAM policies and roles were developed to ensure secure access to AWS resources, effectively managing permissions and user access across Tesser’s AWS environment. Additionally, the AWS Web Application Firewall (WAF) and associated managed rules were deployed to protect web applications from common security threats, bolstering Tesser’s overall security posture.
Comprinno implemented autoscaling for Tesser’s ECS services, ensuring that their applications could scale automatically in response to demand. Health checks and failover mechanisms were also established to minimize downtime and ensure the high availability of Tesser’s applications.
Comprinno provided a robust Continuous Integration and Continuous Deployment (CI/CD) solution to streamline Tesser's development lifecycle using AWS CodePipeline and AWS CodeBuild. This setup automated the build, testing, and deployment stages, allowing Tesser to release updates quickly and reliably across all critical infrastructure components. The CI/CD pipeline was designed to cover key areas, ensuring seamless integration of new features into the system.
The solution integrates Amazon Cognito, API Gateway, and IAM to implement fine-grained authorization based on user groups. It enables dynamic access control by mapping Amazon Cognito user groups to IAM policies, granting specific access rights to each group.
The following figure shows the basic architecture and information flow for user requests.
A user logs in through an Amazon Cognito User Pool and receives a JWT (ID token, access token, refresh token).
The user makes an API request to API Gateway and passes the access token as a Bearer Token in the headers.
API Gateway forwards the request to a Lambda authorizer, which verifies the JWT using the Amazon Cognito public key (cached for efficiency).
The Lambda authorizer checks the Cognito group of the user from the JWT, then performs a lookup in Amazon DynamoDB to retrieve the associated IAM policy for that group.
This approach provides a scalable, secure, and dynamic method for controlling user access to APIs, leveraging the capabilities of Amazon Cognito, API Gateway, and IAM.
This solution involves sending application user activity logs to Amazon CloudWatch and leveraging CloudWatch Log Insights for querying and analytics. The queried data is then processed and stored in RDS for further analysis.
The application sends user activity logs to a CloudWatch log group.
CloudWatch Log Insights is used to perform queries on the logs, extracting relevant data or insights.
The Lambda function writes the processed log data to an RDS database, where it can be analyzed further or integrated with other analytics tools.
This approach ensures efficient log management and advanced analytics capabilities using AWS services
Tesser now operates within a secure and compliant multi-account AWS environment, benefiting from continuous monitoring and automated enforcement of security policies. This setup ensures that all security measures are consistently applied across the organization, reducing vulnerabilities and enhancing overall security posture.
With the Terraform and CI/CD pipeline implementation, Tesser has significantly reduced the time required for infrastructure provisioning and application deployment. The automation of these processes minimizes the risk of human error, leading to more reliable and efficient infrastructure management.
Tesser’s applications are now capable of scaling automatically in response to demand, ensuring high availability and optimal performance even during peak usage times. This scalability ensures that Tesser can effectively meet customer needs without compromising performance.
Permissions are mapped based on user groups, allowing fine-grained access control.
JWT tokens ensure secure and scalable authentication.
Cached public keys and the separation of policy fetching and evaluation improve performance.
CloudWatch Log Insights offers powerful querying capabilities directly on CloudWatch logs.
Lambda automates the data retrieval, processing, and storage, creating a seamless pipeline for analytics.
Storing logs in RDS enables deeper analysis, complex queries, and integration with BI tools.
Comprinno Achieves AWS Data and Analytics Competency | Read More →
