Executive Summary

About Client

Custom Web App Development
Bayleys is a New Zealand-based, family-owned, operated real estate agency in New Zealand and Fiji. As the largest full-service real estate agency in the country, they offer a comprehensive array of property-related services and sector-specific expertise. Furthermore, Their business model is founded on trust, reliability, discretion, and exceeding our clients’ expectations. The in-depth experience, knowledge, and successful track record, therefore, are proven across our full-service business lines. They are committed to delivering world-class service and results.

https://www.bayleys.co.nz/
Location: New Zealand

Project Background

Bayleys envisioned an upgrade, seeking to replace their dated desktop application with a cutting-edge cloud-based alternative. Moreover,  Embracing modern technology, this transition aimed to enhance efficiency, accessibility, and collaboration within the organization, aligning seamlessly with contemporary industry standards. The move to a cloud-based app promises to revolutionize their operations, providing a flexible and scalable platform that empowers their team and, consequently, delivers an exceptional experience to their clientele.

Scope & Requirement For Custom Web App Development

During the 1st Phase of the web app development, we discussed the implementation as follows:

  • Review existing AWS environment 
  • Create a new web app for searching and adding new property details
  • Migrate data from existing database to AWS

Implementation

Click Here

Technology And Architecture Of Custom Web App Development

Read more on the key components that defined the Property search-Custom web app development for Bayleys

Technology/ Services used

The web app was deployed with the below technological component

  • Backend Code: .NET 6, C#
  • Web App code: Next.js
  • Database: PostgreSQL
  • Cloud: AWS

Integrations:

  • Google APIs 

Security:
  • AWS WAF service is used for the firewall
  • All API endpoints are token-based

Scalability

  • The application is designed to be running on serverless services so that it can easily scale up and down automatically based on usage. 

Cost Optimization 

  • Alerts and notifications are configured in the AWS to notify if the budget is being exceeded. 
  • Deployed on serverless infrastructure, the application does not incur any additional costs when it is not in heavy use.
  • Peritos, being a cloud partner, is managing the environment for the client, keeping a close watch on the cost, and finding ways to optimize the same 

Code Management, Deployment

  • CI/CD is implemented to automatically build and deploy any code changes

Challenges In Implementing Custom Web App Development

  • Reuse the existing code logic  
  • Map the complicated calculation logic from the existing app to the new app 
  • Retain all features yet give it a better User experience  

Project Completion

Duration Of Web App Development Implementation

May 2024 to Aug 2024

Deliverables for Custom Web App Development

  • A new modernized cloud-based app 
  • User Guide
  • Unit testing document  

Support for Web App Development

  • 1 month extended support 
  • A template for Cloud formation stack to create more AWS resources using the available stacks
  • Screen sharing sessions with demo of how the services and new workloads can be deployed. 

Testimonial

Awaited

Next Phase

Awaited

If You Are Looking For Similar Services? Please Get In Touch

Executive Summary

About Client

AWS Control Tower Setup

Wine-Searcher is a web search engine that helps find the price and availability of any wine, whiskey, spirit, or beer worldwide. It has been in operation since 1999 and has offices in New Zealand and the UK. In addition, They provide easy-to-use search engines, price comparison tools, an extensive database of wines and spirits, an encyclopedia, and news pages that aim to provide all “wine-finding” needs.

https://www.wine-searcher.com/
Location: New Zealand & UK

Project Background

Peritos expertly directed an AWS Control Tower setup for Winesearcher, thus optimizing their cloud infrastructure. Leveraging AWS Control Tower, the Peritos team streamlined governance and compliance, ensuring seamless scaling and enhanced security. This was needed as there were multiple different accounts the client wanted to consolidate accounts in addition to using organizations via the control tower. Additionally, Through meticulous configuration, we tailored the environment to Winesearcher’s specific needs, facilitating efficient resource management and cost control. With AWS Control Tower’s automation and governance features, Wine-Searcher gained a robust foundation for future growth, while Peritos provided invaluable expertise, empowering the company to focus on innovation and deliver an exceptional user experience in the dynamic wine market.

Scope & Requirement For AWS control tower Setup

Prerequisite: Automated pre-launch checks for your management account 

Step 1. Create your shared account email addresses 

Expectations for landing zone configuration 

Step 2. Configure and launch your landing zone 

Step 3. Then, review and set up the landing zone 

Implementation

Technology And Architecture Of AWS control tower Setup

Furthermore, read on the key components that defined the Architecture for the AWS Control Tower Setup for Wine-Searcher

Technology/ Services used

We used AWS services and helped them to setup below 

  • Cloud: AWS
  • Organization setup: Control tower 
  • AWS SSO for authentication using existing AzureAD credentials
  • Policies setup: Created AWS service control policies
  • Moreover, Templates created for using common AWS services 

Security & Compliance:

  • Tagging Policies
  • AWS config for compliance checks
  • NIST compliance 
  • Guardrails
  • Security Hub

Network Architecture 

  • Site to Site VPN Architecture using Transit Gateway
  • Distributed AWS Network Firewall
  • Monitoring with Cloud Watch and VPC flow logs. 

Backup and Recovery

  • Furthermore, Cloud systems and components used followed AWS’s well-architected framework, and the resources were all Multi-zone availability with uptime of 99.99% or more. 

Cost Optimization 

  • Alerts and notifications are configured in the AWS cost 

Code Management, Deployment

  • Cloudformation scripts for creating stack sets and scripts for generating AWS services were handed over to the client  

Challenges In Implementing AWS control tower Setup

  •  Landing Zone Drift
  • Role Drift
  • Security Hub Control Drift
  • Trusted Access disabled

Project Completion

Duration Of AWS control tower Setup Implementation

Aug 2023 to Sep 2023  ~ 4 weeks

Deliverables for AWS control tower Setup

1. Control tower implemented
AWS Control Tower is a service built with a solid architecture that can , thus, assist your organization in meeting its compliance requirements by establishing controls and implementing best practices. Moreover, third-party auditors evaluate the security and compliance of several services available in your landing zone as part of various AWS compliance programs, including SOC, PCI, FedRAMP, HIPAA, and more.

2. Business Benefits
Ensuring compliance, therefore, and implementing best practices is crucial for any organization. With our solution, you can, therefore, set up a well-architected, multi-account environment in under 30 minutes. Moreover, The creation of AWS accounts is automated with built-in governance, ensuring that the set standards and regulatory requirements are met. You can also enforce preconfigured controls to adhere to best practices. Additionally, our solution enables the seamless integration of third-party software at scale to enhance your AWS environment.

Support

  • 1 month extended support 
  • A template for Cloud formation stack to create more AWS resources using the available stacks
  • In addition, Screen sharing sessions with demo of how the services and new workloads can be deployed. 

Testimonial

Awaited

Next Phase

If You Are Looking For Similar Services? Please Get In Touch

Executive Summary

About Client

Managing AWS Environment 

Wine-Searcher is a web search engine that helps find the price and availability of any wine, whiskey, spirit, or beer worldwide. It has been in operation since 1999 and has offices in New Zealand and the UK. They provide an easy-to-use search engine, price comparison tools, an extensive database of wines and spirits, an encyclopedia, and news pages that aim to provide all “wine-finding” needs.

https://www.wine-searcher.com/
Location: New Zealand & UK

Project Background

As part of their plan to launch a full suite of digital products, Wine-Searcher chose AWS as their cloud environment. Strategic resource allocation and cost optimization are critical to ensure a cost-effective operation. Peritos helped as the reliable AWS partner on AWS Cost Explorer and AWS Budgets, like valuable tools for implementing ongoing discounted billing. Furthermore, leveraging reserved instances and spot instances and optimizing usage based on peak hours and demand patterns can result in significant cost savings. Experts from the Peritos team helped regularly monitor and fine-tune the AWS environment based on Winesearcher’s needs, allowing for continuous optimization while adhering to budgetary constraints and maintaining the required scalability and performance for their operations.

Scope & Requirement for Managing AWS Environment

In the 1st Phase of the AWS Environment Setup, implementation was discussed as follows:

  • Manage Billing  
  • Value added services  
  • Handling Complex environments   
  • Multiple AWS invoices   
  • Cost Optimization 
  • Cloud security optimization 

Implementation

Technology and Architecture of Managing AWS Environment

Furthermore, Read on the key components that defined the Architecture for managing the AWS Environment Setup for Wine-Searcher

Technology/ Services used

We used AWS services and helped them to setup below 

  • Cloud: AWS
  • Organization setup: Control tower 
  • AWS SSO for authentication using existing AzureAD credentials
  • Policies setup: Created AWS service control policies
  • Templates created for using common AWS services 

Security & Compliance:

  • Tagging Policies
  • AWS config for compliance checks
  • NIST compliance 
  • Guardrails
  • Security Hub

Network Architecture 

  • Site to Site VPN Architecture using Transit Gateway
  • Distributed AWS Network Firewall
  • Monitoring with Cloud Watch and VPC flow logs. 

Backup and Recovery

  • Cloud systems and components used followed AWS’s well-architected framework, and the resources were all Multi-zone availability with uptime of 99.99% or more. 

Cost Optimization 

  • Alerts and notifications are configured in the AWS cost 

Code Management, Deployment

  • Cloudformation scripts for creating stack sets and scripts for generating AWS services were handed over to the client  

Challenges in Implementing Managing AWS Environment

  • Collate all accounts together 
  • Understand and agree on how the account would be managed under the distribution model  

Project Completion

Duration of Managing AWS Environment Implementation

1st Sep 2021 to Current

Deliverables for Managing AWS Environment

  • Collate all accounts under the dsitrubution ECAM model  
  • Manage billing 
  • Provide support services as needed 
  • Ongoing discounted licensing  

Support

  • One month of extended support 
  • A template for Cloud formation stack to create more AWS resources using the available stacks
  • Screen-sharing sessions with demos of how the services and new workloads can be deployed. 

Testimonial

Awaited

Next Phase

We are now looking at the next phase of the project, which involves:

1. Implementing a control tower for the client.  

If You Are Looking For Similar Services? Please Get In Touch

Executive Summary

About Client

ABDM-Compliant Hospital Management Software for all-size hospitals.

 
Ekanshi Solutions Pvt Ltd offers expert management consultation services to healthcare organizations. They provide strategic guidance and support to help organizations achieve their goals. With the in-depth expertise and industry knowledge, they help organizations optimize their operations, make informed decisions, and achieve excellence in patient care.

 

https://ekanshisolutions.com/
Location: Lucknow, Uttar Pradesh, India

Project Background

Ekanshi Solution requires reviewing its clients’ hospitals and clinics to ensure they meet the compliance requirements. To achieve this, we recommended developing a software solution that meets the basic compliance requirements and also eases the operational burden on hospitals.

  • Registration and demographic data collection.
  • Patient history and medical record management.
  • Appointment scheduling and reminders.
  • Patient check-in and waiting list management.
  • ABDM Compliance M1  , M2 and M3 scenarios therefore create Verify ABHA and to manage patients records
  • The movement of this on-premise app to a cloud-based infrastructure is aimed at improving performance, ensuring data security, and enabling seamless integrations with other digital health services.
  • AWS Automated HIPPA Compliance check and aligned with best practices. 

Scope & Requirement for ABDM-Compliant Hospital Management Software

In the 1st Phase of custom application development, we discussed the implementation as follows:

  • A customized app, furthermore, helps to generate ABHA ID and integrates ABDM-compliant APIS 
  • The client hospital team should be able to view patient records easily and receive and send to the central server
  • Able to book appointments and moreover schedule reminders easily. 
  • We would create a Web version of the app to help manage the above functionality, which will replace the current paper-based and unorganized work the admin was doing. 
  • Plan and execute the migration of application code, data, and databases from the on-premise system to the selected cloud platform.
  • Ensure minimal downtime by utilizing cloud migration tools and strategies, such as database replication, to synchronize on-premise data with the cloud.
  • Compliance with HIPPA and using config rules to do ongoing monitoring of compliance 

Implementation

Technology and Architecture of Hospital Management Software

Read more on the technology and Architecture we used for AWS Custom Application Development using ESRI ArcGIS.

Technology/ Services used

The web app was deployed with the below technological component

  • Backend Code: .NET Core, C#
  •  Web App code: AngularJS
  • Database: PostgreSQL
  • Cloud: AWS

Integrations:

  • Google APIs 

  •  ABDM Integration

  • Auth0

  • SendGrid

Security:
  • AWS WAF service is used for the firewall
  • All API endpoints are token-based

Scalability

  • The application is designed to be running on serverless services so that it can easily scale up and down automatically based on usage. 

Backup and Recovery

  • Additionally, Automated backups are configured to backup the database and store multiple copies of the backup. 

Cost Optimization 

  • Peritos optimized costs for the ABDM-compliant hospital management software by architecting a scalable, cloud-based solution using serverless components and right-sized infrastructure.
  • Leveraging AWS tools like Cost Explorer and Trusted Advisor, we continuously monitored usage to eliminate waste and reduce expenses.
  • Automation through CI/CD pipelines, along with performance-tuned code and databases, ensured reliable delivery while minimizing operational overhead—resulting in a cost-effective, high-performance system for healthcare providers.

Code Management, Deployment

  • CI/CD is implemented to automatically build and deploy any code changes

Features of the Application

  • Integrated Patient Profile with NDHM: This application seamlessly integrates with NDHM, enabling the swift creation of ABHA IDs and facilitating the exchange of patient health data. By interfacing with the National Digital Health Mission, the system ensures that patient data is standardized, up-to-date, and easily accessible, fostering more informed medical decisions.
  • Multi-tenancy Architecture: The system’s ability to cater to multiple hospitals or health providers under a single unified platform is a significant advantage. Each hospital can manage its operations while benefiting from centralized updates and features, ensuring scalability and simplifying administrative tasks.
  • Data Encryption at Rest and In Transit: Implemented encryption using AWS Key Management Service (KMS) for both data at rest (S3, EBS, RDS) and in transit (SSL/TLS) to ensure compliance with GDPR and HIPAA requirements for securing sensitive data.
  • Identity and Access Management (IAM): Designed and enforced strict least-privilege access policies using AWS IAM. This included creating custom roles and policies with granular permissions for specific users and services, ensuring only authorized personnel had access to sensitive data.
  • AWS Config and Compliance Rules: Set up AWS Config to track and audit configuration changes across the environment. Applied AWS Config Rules to continuously monitor compliance against GDPR and HIPAA requirements, such as encryption enabled on S3 buckets and logging for API Gateway and Lambda.
  • Audit Logging and Monitoring: Configured AWS CloudTrail and Amazon CloudWatch for continuous logging and monitoring of API calls, changes, and actions within the AWS environment. This was crucial for meeting HIPAA requirements for audit trails and GDPR’s data access visibility.
  • VPC Flow Logs and Security Groups: Deployed Virtual Private Cloud (VPC) with properly configured flow logs to monitor and log network traffic. Used AWS Security Groups and Network ACLs to ensure secure network segmentation and prevent unauthorized access to sensitive resources.
  • Data Residency and Data Transfer Controls: Implemented controls to ensure data residency compliance by restricting data storage and processing to specific AWS regions as required by GDPR. Utilized VPC endpoints and AWS Direct Connect to secure data transfers and reduce the exposure to the public internet.
  • Backup and Disaster Recovery: Designed an automated backup strategy using AWS Backup to meet GDPR’s requirement for data recoverability, ensuring regular snapshots of critical databases (e.g., RDS, DynamoDB) and storing them in encrypted S3 buckets across different regions for redundancy.

Challenges in implementing ABDM Compliant Hospital Management Software

  • Integration with ABDM APIs is needed to achieve compliance; however, the API documentation was not up to date. Also, the API versions keep checking. During the app development from v1 to V3, we had to reach the APIs and perform code refactoring to ensure the utilization of the latest set of APIs.
    • Furthermore, Help from PWC team was provided and explained the API endpoints and the test scenarios to cover to ensure the app compliance checks can be passed. 
  • Testing of the application with multiple end users who were experts in their domain was a challenge.
    • We found the data quite complicated to understand and relied on the client’s team to test and inform us about the expected result in case of any issues. Additionally, we identified key users such as doctors, administrators, nurses, department heads, etc., to ensure coverage of all user scenarios.
  • Given the sensitive nature of medical data, ensuring robust security measures against breaches and unauthorized access is paramount.
    • The hospital management application ensured data security and privacy through end-to-end encryption for both data at rest and in transit. AWS’s suite of security tools, including IAM for access control, KMS for key management, and VPCs for network isolation, were leveraged. We fortified the APIs with security tokens and rate limiting and conducted regular training sessions for staff on security best practices.

Project Completion

Duration of Hospital Management Software Implementation

Jan 2023 – Dec 2023 ~ 1 year   months 1st Version 

@nd Version- Jan 2024 – Present Currently working on Reporting, Enhancements, and Billing , In patient and Out patient feature addition along with M2 Billing

Deliverables for ABDM-Compliant Hospital Management Software

Setting up the AWS environment for the client system

• Custom web application for two environments production and UAT system 

• We delivered the features as agreed in the scope 

  1. Registration and demographic data collection.
  2. Patient history and, furthermore, medical record management.
  3. Appointment scheduling and reminders.
  4. Patient check-in and waiting list management.
  5. ABDM Compliance M1, M2, and M3 scenarios to create Verify ABHA and to manage patients records
  6. HIPPA compliance report for managing workloads and following best practices for HIPPA and also ongoing monitoring report. 
  7. We developed the following set of core features. 
    User: Manages user registration, authentication, roles, and permissions.
    Hospital: Multi-tenant application to handle hospital registration, department management, and related configurations.
    Doctor: Manages doctor profiles, availability, specialties, and associated scheduling.
    Patient: In addition, Interfaces with ABDM for patient data operations, ABHA ID creation, and retrieval of patient health history.

Support

  • As part of the project implementation we provide 2 months of Ongoing extended support.
  • This also includes 20 hrs a month of development for minor bug fixes and an SLA to cover any system outages or high-priority issues.

Testimonial

After working for 6 months on the project, we took feedback from the Product owner whom we have worked closely for project execution:

Feedback image

Peritos and using AWS have been instrumental in transforming our hospital’s operations for clients. It empowered us to create a custom multi-tenant application that not only meets our current needs but also positions us for future growth and innovation to showcase this to our larger client base and prospects. With a solid system now, we have the confidence to continue our mission of providing exceptional healthcare services to our community, knowing that our technology backbone is secure, reliable, and ready to scale. Additionally, We are happy with the services and look forward to completing more projects in the future with Peritos team.

Akanksha Niranjan
OWNER, EKANSHI SOLUTIONS

Next Phase

We are now looking at the next phase of the project which involves:

1. Furthermore, Ongoing Support and adding new features every Quarter with minor bug fixes

2. Electronic Medical Records (EMR) Integration: Incorporate a system that not only stores patient data but also tracks their entire medical history, including medications, allergies etc

3. AI-Powered Predictive Analysis: Moreover, Use AI and machine learning to analyze patient data for potential health risks, helping doctors make informed decisions

If You Are Looking For Similar Services? Please Get In Touch

Executive Summary

About Client

Newzealand’s most awarded mortgage & insurance advisor Global Finance caters to about 1,500+ customers for their mortgage or insurance needs every year so that they can meet their financial goals. Global Finance offers more preference & freedom, with loan approvals from numerous lenders if chosen by the customers. Dealing with a large number of clients & team members, Global Finance was facing issues managing their unstructured data. As Peritos had already been managing their Dynamics environment, we successfully guided and supported Global Finance’s move from saving data from Azure Dataverse to Azure blob Storage which saved them 1500$ a month. 

Project Background

Global Finance has been offering smarter loans and insurance since 1999. Working as one of the best mortgage & insurance advisers in NZ, Global Finance helped clients to save on their loans, by avoiding unnecessary interest and getting mortgage-free faster. Since the beginning, they have helped some customers become mortgage-free in as little as 7 years rather than the standard 30-year term. Global Finance was already using Dyn365 and saving data from Azure Dataverse, now moving to Azure Blob Storage has optimized for storing massive amounts of unstructured data for them. 

Scope & Requirement

 

In the 1st Phase of the Windows Virtual Server Setup, implementation was discussed as follows:

  • Setting up for saving data from Azure Dataverse to Azure Blob Storage has sustained a lot of unstructured data for Global Finance
  • Setting up the demands for storing and analyzing large volumes of unstructured data have increased over the past decade & Azure Blob Storage is one solution that fulfills the enterprise needs accurately.

Implementation

Technology and Architecture

Read the technical components & Architecture for migrating from Azure Dataverse to Azure Blob Storage.

Technology 

The migration was deployed with the below technological component
• For Azure Dataverse-The underlying technology used was Azure SQL Database

• For Azure Blob Storage- It supported the most popular development frameworks including Java, .NET, Python & Node.js

Security & Compliance:

  • Tagging Policies
  • Azure config for compliance checks
  • NIST compliance 
  • Guardrails
  • Security Hub

Backup and Recovery

Azure Backup provided a simple, secure, cost-effective, and cloud-based backup solution to protect the business or application-critical data stored in Azure Blob in two ways- Continuous backups & Periodic backups

 

Network Architecture 

  • Site to Site VPN Architecture using Transit Gateway
  • Distributed Azure Network Firewall
  • Monitoring with Cloud Watch and VPC flow logs. 

Cost Optimization 

  • Alerts and notifications are configured in the Azure cost 

Code Management, Deployment

  • Cloudformation scripts for creating stacksets and scripts for generating Azure services was handed over to the client  

Challenges of Migrating from Azure Dataverse to Azure Blob Storage

  • It was a bit of a challenge to ensure the new environment after migration meets all of the compliance criteria and still remain cost effective.

Project Completion

Duration

July  2022 ~ 1 week 

Deliverables

  • Dynamics License 
  • Power App License
  • Power App per use License
  • Power App per app license 

Support for Dynamics Discounted Licensing

  • For all Licenses we implement we provide monthly billing with 20 days credit Terms. 
  • We provide Value added services by sending reports to the client on the license usage and last activity date for each user to help them manage their license cost and to get visibility 

Testimonial

  • Azure Blob Storage has a lot of organizational features that has solved the storage problem of Global Finance at a lower cost. Despite being developed for unstructured data, containers permit businesses to construct their preferred categories by uploading specific blobs to specific containers.
  • Shifting from Azure Dataverse to Azure Blob Storage has provided a free hand to Global Finance to access objects in Blob Storage via the Azure Storage REST API, Azure PowerShell, Azure CLI, or an Azure Storage client library.
Feedback image

Now Global Finance is securely connected to Blob Storage by using SSH File Transfer Protocol (SFTP) & mount Blob Storage containers by using the Network File System 3.0 protocol. Peritos handled the Microsoft Dynamics 365 domain for Global Finance and provided discounted licensing, which proved very cost-effective. 

Evania Fernandes
building Manager
ultimate property group

Next Phase

We are also  in discussion with other projects for the client

1. Dynamics CRM system Support 

2. O365 License Management 

If You Are Looking For Similar Services? Please Get In Touch

Executive Summary

About Client

Electric Kiwi is an autonomous online New Zealand electricity retailer. Established in 2014, Electric Kiwi uses cloud computing and intelligent meters to service customers nationwide in major urban areas. Its services depend on the presence of the smart meters in the customer’s home. For the client, we did the POC for integrating AWS Support Services with Datadog’s CloudFormation template.

http://www.electrickiwi.co.nz/

Location: New Zealand

Project Background

The case study of the project provides a synopsis of how we did the POC for the client for integrating AWS Support Services, an AWS account with Datadog employing Datadog’s CloudFormation template. Creating an IAM role and associated policy enables Datadog’s AWS account to make API calls for collecting or pushing data into your AWS account. Using the CloudFormation template supplies all the tools required to send this data to your Datadog account, and Datadog helps the CloudFormation template to provide the latest functionality. The template even deploys the Datadog Forwarder Lambda operation for sending logs to Datadog.

After setting the initial connection, enable the individual AWS service integrations appropriate to your AWS domain. With a single click, Datadog provisions the required resources in your AWS account and starts analyzing the metrics and events for the services you use. For general AWS services you are using, Datadog needs out-of-the-box dashboards providing prompt and customizable visibility. The project background demonstrates setting up the integration and establishing the Datadog Agent on an Amazon Linux EC2 instance and feeds a broad outline of the integration’s capabilities. Visit the Enable integrations for individual AWS service factions for a list of the general sub-integrations.

This procedure can be repeated for multiple AWS accounts as required, or you can also use the API, AWS CLI, or Terraform to set up various accounts simultaneously. For more details, read the Datadog-Amazon CloudFormation guide.

Scope & Requirement

The scope & requirements involved the following:

  • Datadog integration with AWS support services to measure and accomplish observability matrix 
  • Identified costing  
  • Updated pricing with partner discount as applicable  
  • Shortlisted services for which we did POC  
  • EC2, database Monitor Requirement, Steps, and Dashboard View  
  • Along with pricing and cost for using Datadog; for monitoring and analytical purpose

Implementation

Technology and Architecture

Technology/Services used 

We used Datadog integration with AWS services to masure and do observability matrix and helped them to setup below 

  • Cloud: AWS
  • Shortlisted services for which we did POC
  • Organization setup: Control tower 
  • Policies setup: Created AWS service control policies
  • Templates created for using common AWS services 

Security & Compliance:

  • Tagging Policies
  • Azure config for compliance checks
  • NIST compliance 
  • Guardrails
  • Security Hub

Backup and Recovery

AWS Backup provided a simple, secure, cost-effective, and cloud-based backup solution which was already implemented for the client

Network Architecture 

  • Site to Site VPN Architecture using Transit Gateway
  • Distributed Azure Network Firewall
  • Monitoring with Cloud Watch and VPC flow logs. 

Cost Optimization 

  • Alerts and notifications are configured in the AWS cost 
  • Identified Costing
  • Updated pricing with partner discount as applicable

Code Management, Deployment

  • Cloudformation scripts for creating stacksets and scripts for generating AWS services was handed over to the client  

Challenges

  • Access was not provided to the actual environment and setting up 
  • Complex environment setup and monitoring for production cost was only possible to evaluate if we have got the access for the actual environment from the client

Project Completion

Duration

15th May to 15th June 2022 ~ 1 month

Deliverables

  • AWS setup and architecture design and document   

Support

  • 1 month of extended support
  • A template for Cloud formation stack to create more AWS resources using the available stacks
  • Screen-sharing sessions with a demo of how the services and new workloads can be deployed.

Testimonial

Feedback image

We sought the services of Peritos Solutions to help with our Observability objectives. Peritos took the team through a phased process of uncovering exactly what we needed from observability. Through this discovery, we can understand that the solution that we thought we should be implementing didn’t fully match our requirements.  Without the work from Peritos we would have implemented something not fit for purpose and we are now in a great place to re-evaluate our objectives and requirements and make a more informed decision. The work Peritos performed was top notch and we look forward to more engagements with them.

Matt Kardos
Enterprise Architect

Next Phase

No new work identified  

If You Are Looking For Similar Services? Please Get In Touch

Executive Summary

AWS Environment Setup

About Client

AWS Environment Setup
Tonkin + Taylor is New Zealand’s leading environment and engineering consultancy with offices located globally. They shape interfaces between people and the environment which includes earth, water and air. They have won awards like Beaton Client Choice Award for Best Provider to Government and Community-2022 and IPWEA Award for Excellence in Water Projects for the Papakura Water Treatment Plan- 2021.

 

https://www.tonkintaylor.co.nz/
Location: New Zealand

Project Background

Tonkin + Taylor were embarking on the journey for launching a full suite of digital product and zeroed upon AWS as thier choice for cloud environment. They wanted to  create new applications and migrate to cloud services to improve their scalability, ensure availability, minimize latency and reduce costs. They were also looking to accelerate their digital transformation and add greater business value through AWS Development Environment best practices. Lastly with the new apps they wanted to monetize and create SAAS based offerings for the end users. For all this it was needed to do AWS Environment Setup which follows best practices and meets compliance which can be used as a base for implementing more applications.

Scope & Requirement

In the 1st Phase of the AWS Environment Setup, implementation was discussed as follows:

  • Setting up AWS environment for multi account, Multi environment setup
  • Ensure the all AWS accounts follow same set of policies and adhering to all legal and regulatory compliance. 
  • Setup connectivity between different AWS accounts and on-prem network
  • Setup AWS security hub to provide a comprehensive view of security state
  • The Tonkin + Taylor On-Premise to Cloud Migration project aims to modernize and optimize the company’s IT infrastructure by migrating its existing on-premise systems to a cloud-based environment. The key objectives include reducing operational costs, enhancing scalability, improving system performance, and ensuring business continuity through a secure, reliable, and accessible cloud platform.

Implementation

Technology and Architecture

Read more on the key components which defined the Architecture for AWS Environment Setup for Tonkin + Taylor

Technology/ Services used

We used AWS services and helped them to setup below 

  • Cloud: AWS
  • Organization setup: Control tower 
  • AWS SSO for authentication using existing AzureAD credentials
  • Policies setup: Created AWS service control policies
  • Templates created for using common AWS services 

Security & Compliance:

  • Tagging Policies
  • AWS config for compliance checks
  • NIST compliance 
  • Guardrails
  • Security Hub

Network Architecture 

  • Site to Site VPN Architecture using Transit Gateway
  • Distributed AWS Network Firewall
  • Monitoring with Cloud Watch and VPC flow logs. 

Backup and Recovery

  • Cloud systems and components used followed AWS’s well-Architected framework and the resources were all Multi-zone availability with uptime of 99.99% or more. 

Cost Optimization 

  • Alerts and notifications are configured in the AWS cost 

Code Management, Deployment

  • Cloudformation scripts for creating stacksets and scripts for generating AWS services was handed over to the client  

Challenges of AWS Environment Setup

  • It was a bit of a challenge to ensure the new environment meets all of the compliance criteria and still remain cost effective.
    • As per best practices we need to have a set of Unique machines and each may need to have its own VPC but that may incur a cost to the client. So we discussed and agreed for a specific 75% to be achieved which would be deemed as acceptable
  • We have some non compliance being generated by standard AWS services
    • We got below feedback from AWS support . “It was reported that there are some policies and roles which are created by control tower and are created using best practices and there is no harm or security issue which arises it. Sometimes the conformance pack you use does shows the by default created policies to be non-compliant and you can ignore that for the time being. To make it compliant we have to either delete or the modify these roles/policies and since these roles and policies managed by the Control Tower, it is recommended not to manually update/delete the roles attached. Diving deeper into the issue, I could refer that the Control Tower managed artifacts feature heavily on the compliance failure list and there is no way to specifically exclude Control Tower managed artifacts from the compliance checking. Checking further with the internal team, I found that they are aware of the issue and there has been an ongoing feature request to exclude Control Tower managed artifacts from the compliance checking to avoid these such security findings. ” So based on this feedback we ensured to make a note that the non compliance being shown may not be an accurate one and these would be treated as exceptions.

Project Completion

Duration

May 2024 to July 2024  ~ 3  months 

Deliverables

  • Implemented AWS Control tower with Org Unit structure and Service control policies 
  • Implemented AWS Config with NIST conformance pack
  • Implemented AWS Security Hub
  • Implemented Site to Site VPN using AWS Transit Gateway 
  • Handover and Support documents were provided 
  • Develop a detailed migration roadmap outlining timelines, key milestones, and risk mitigation strategies.
  • Plan for data migration, including data validation, security protocols, and minimal downtime during the migration process.
  • Establish contingency plans for legacy systems and ensure rollback strategies are in place specifically for multiple end user public facing apps they were planning to create. 

Support

  • 1 month extended support 
  • A template for Cloud formation stack to create more AWS resources using the available stacks
  • Screen sharing sessions with demo of how the services and new workloads can be deployed. 
  • Offer support during the initial transition phase post-migration.
  • Provide ongoing technical support, monitoring, and optimization services.

Testimonial

After we setup and enabled client to start using the newly built environment they were eager to get apps being rolled out using cloud resources. It was exciting to see client using the environment extensively. We also took Feedback from stakeholders as below:

Feedback image
Santosh Dixit
Digitization delivery lead

Next Phase

We are now looking at the next phase of the project which involves:

1. Launching new digital products with the help of AWS environments which have been setup

2. Any adhoc change requests for managing the cloud environment 

If You Are Looking For Similar Services? Please Get In Touch