Standardizing Produktiv’s Cloud Environment to Securely Scale A Governed RAG & AI Agent Platform

Produktiv is an enterprise AI company building Kynexa, a governance and control platform for RAG applications, copilots and AI agents. Kynexa connects structured and unstructured enterprise knowledge while governing what each user or agent can access, retrieve, remember and act on. It enables organisations to automate knowledge-intensive workflows while protecting sensitive information, enforcing role- and purpose-based policies and maintaining a complete audit trail runs an AI-powered platform delivered through a containerized microservices architecture. As the platform grew, Produktiv needed dedicated, consistently governed environments for development, staging, and production, each capable of scaling independently while meeting the same security and operational standards.

Produktiv's infrastructure needed to move to a well-structured multi-account AWS Organization, with clean separation between development, staging, and production and a consistent security, identity, and governance model applied across all three. The platform's containerized microservices needed to scale dynamically with demand while keeping compute costs under control, and the team needed a relational database layer that was highly available, encrypted, and recoverable without manual intervention. Traffic into the platform, covering the core application, an identity service, and a monitoring interface, needed reliable routing with TLS termination, and releases needed to move through source, build, and deploy stages automatically and consistently across environments. Underpinning all of this, Produktiv needed centralized audit logging, secrets management, and cost visibility that didn't depend on account-by-account manual effort.

Comprinno built a three-tier, multi-account AWS environment for Produktiv in the AWS Mumbai region, with dedicated VPCs for development, staging, and production, each following the same architectural pattern: public subnets, private application subnets, and private database subnets distributed across three Availability Zones. An Internet Gateway handles inbound traffic to the public subnets, while NAT Gateways in each AZ give private-subnet workloads controlled outbound access, and a bastion host in each public subnet is the sole path into the fully isolated private database subnets.

Key Actions:

• Organizational and Identity Foundation: AWS Organizations is structured with dedicated Organizational Units separating the Development, Staging, and Production environments, with consolidated billing managed centrally and AWS accounts aligned to their respective OUs. IAM Identity Center provides centralized single sign-on across all accounts, replacing per-account IAM users.
• Container Orchestration and Autoscaling: Production and Staging run on Amazon EKS, with compute organized into dedicated node pools separating backend, infrastructure, operator, and vault workloads for stronger isolation and resource governance. Node scaling is handled by Karpenter, which dynamically provisions and consolidates right-sized EC2 capacity to gracefully drain and reprovision nodes ahead of capacity events. Development runs on Amazon EC2 with a self-managed database, giving the team a lower-cost environment for early-stage testing.
• Traffic Routing and CI/CD Automation: An Application Load Balancer in each environment handles all inbound HTTP/HTTPS traffic, redirecting HTTP to HTTPS and using host-based routing to direct requests to the appropriate backend, the core application, the identity service, or the monitoring interface, via the AWS Load Balancer Controller in EKS, or directly to EC2 targets in Development. AWS CodePipeline and CodeBuild automate the build and deployment process end to end: source changes trigger the pipeline, container images are built and pushed to per-service Amazon ECR repositories, and updated services are rolled out to EKS, while frontend assets are published to Amazon S3 and served through Amazon CloudFront.
• Database and Storage Migration: The relational database layer was migrated to Amazon RDS for PostgreSQL using a dump-and-restore approach. Because the RDS instances sit in fully isolated private database subnets with no direct internet access, the migration was carried out through the environment's bastion host over an SSH tunnel, with post-migration validation performed to confirm data integrity, schema consistency, and application connectivity. Production data is encrypted at rest with a customer-managed AWS KMS key, backed by automated backups, point-in-time recovery, and Performance Insights for ongoing query visibility. Amazon S3 serves as the central storage layer across the environments used for database dumps, deployment artifacts, and infrastructure logs with versioning, encryption, and blocked public access enforced on every bucket.
• Security, Secrets, and Cost Governance: AWS Secrets Manager centrally stores and secures database credentials and third-party API keys, letting applications retrieve secrets at runtime through IAM roles rather than hardcoding them. AWS KMS encrypts data at rest across S3, EBS, and RDS with automatic key rotation, while AWS CloudTrail records a complete audit trail of account activity, including IAM changes, network changes, and database and secrets access and Amazon CloudWatch handles logging, metrics, and alerting. AWS Systems Manager enables secure, SSH-free remote access to EC2 instances alongside patch and configuration management, and AWS Security Hub aggregates findings across the security tooling into a single view of the account's security posture. AWS Budgets tracks both daily and monthly spend independently for each environment, with alerts at defined thresholds to catch cost anomalies early.

Architecture Overview

Produktiv's environments follow a high-availability-first design: each environment runs in its own VPC across three Availability Zones, split into public, private application, and private database subnets. In Staging and Production, traffic enters through an Application Load Balancer spanning all three zones, which routes it via host-based rules to the appropriate EKS-hosted service, while RDS PostgreSQL sits fully isolated in the private database subnets with no route to the public internet, reachable only through the bastion host. Development follows the same three-tier network pattern but runs on EC2 rather than EKS, keeping the environment lightweight for pre-production testing. NAT Gateways in each AZ let private-subnet workloads reach the internet, for example, to pull container images without exposing them directly, and Karpenter's SQS-backed interruption handling keeps node scaling resilient to capacity events. Shared services: IAM Identity Center, AWS Certificate Manager, CloudTrail, and centrally managed S3 buckets, operate at the account level, giving every environment the same consistent security and governance baseline.

Benefits

• Consistent, Governed Multi-Account Environment: A structured AWS Organization with dedicated OUs gives Produktiv clean separation between Development, Staging, and Production, backed by centralized billing and single sign-on, replacing fragmented per-environment account management with one governed control plane.
• Resilient, Highly Available Infrastructure: The three-tier VPC design spread across three Availability Zones in Staging and Production, combined with Multi-AZ-capable RDS and dynamic Kubernetes node scaling, gives the platform fault tolerance without over-provisioning.
• Automated, Low-Touch Deployments: AWS CodePipeline and CodeBuild automate the build-to-deploy pipeline end to end, reducing manual release effort and the risk of inconsistent deployments across environments.
• Cost-Aware Scaling: Karpenter's demand-based node provisioning keeps EKS compute costs aligned to actual usage, while independently tracked AWS Budgets across all three environments with alerts at set thresholds, give the team early visibility into spend before it becomes a problem.
• Secure by Design: Centralized secrets management, KMS encryption at rest, and a complete CloudTrail audit trail mean every environment inherits the same security posture without relying on manual, account-by-account enforcement.

Conclusion

By restructuring Produktiv's infrastructure into a governed, multi-account AWS environment, Comprinno gave the team a consistent, secure foundation to run development, staging, and production side by side. Combining container orchestration on Amazon EKS with demand-driven autoscaling, a managed and encrypted PostgreSQL database, automated CI/CD through CodePipeline, and centralized identity, secrets, and cost governance, Comprinno delivered infrastructure that supports Produktiv's platform today while giving the team room to scale each environment independently as the business grows.