Engagement · Tolling Infrastructure

A shared cloud foundation. Purpose-built tolling integrations.

Multiple electronic tolling projects relied on independently built AWS environments to support toll collection and roadside infrastructure. Each had its own operational and compliance requirements. A shared, layered landing zone across 40+ accounts standardized networking, security, and provisioning. On that foundation, purpose-built API integrations supported service-management workflows and image handling.

Role
Lead architect — landing zone, networking, and CI/CD
Scope
40+ AWS accounts, primary + DR region
Stack
Terraform · AWS Organizations · Transit Gateway · API Gateway · Amazon S3 · EKS
Case study details

One project story. 11 architecture decisions.

This project case study explains the context, architecture scope, and the outcome. The linked technical case studies show how the platform was designed in practice — the constraint, the approach, and the trade-offs behind each decision.

01 / FoundationStandardize the cloudA four-layer landing zone, one hub-and-spoke network, and a CI/CD pipeline where an unintended apply is structurally impossible. → 02 / Network architectureConnect accounts through Transit GatewayConnecting shared services, workload accounts, security inspection, and a recovery region through one governed Transit Gateway, not a full mesh of VPC routes. → 03 / Data resilienceKeep Aurora DR in configuration parityClosing the two gaps that can make a replicated Aurora environment fail differently in recovery: secondary parameter-group drift and missing regional secrets. → 04 / Incident responseTrace an EKS ingress incidentA structured RCA pattern for an EKS ingress failure that separates DNS, load-balancer, routing, network-policy, and application causes, not just "5xx." → 05 / CI/CD architectureBuild the delivery engineBootstrapping AWS OIDC roles once with SSO, then reusing one GitHub Actions engine for speculative plans and gated, single-environment Terraform deploys. → 06 / Security architectureProtect CloudTrail evidenceCentralizing CloudTrail events in a separately governed archive account, with encryption, a restrictive bucket policy, retention controls, and change alerting. → 07 / Identity integrationFederate WorkSpaces with EntraSeparating Entra authentication from AD machine operations so Personal and Pool WorkSpaces get corporate sign-in without weakening the domain boundary. → 08 / Service integrationConnect JSM to private servicesA layered, authenticated path from Jira Service Management into a private service, using CloudFront and a Lambda authorizer because simpler options don't work. → 09 / DNS architectureShare DNS across environmentsSeparating public internet resolution from private VPC resolution, then associating one centrally managed hosted zone with shared and environment VPCs. → 10 / Image handlingUpload and retrieve imagesRemoving a load balancer and a Lambda proxy from the image path, leaving API Gateway talking to S3 directly through one shared private endpoint. → 11 / Storage operationsS3 migration at scaleMoving 225 GB of data across 1.48 million small objects between same-region S3 buckets, cutting transfer time from 8+ hours to 54 minutes using high-concurrency tooling on existing in-region compute. →
Why it was needed

Every account was its own island

Before this work, each tolling project's AWS environment had been built independently — its own network design, its own security posture, its own way of provisioning a new environment. That meant no consistent audit trail across the platform, security tooling rolled out unevenly, and a new environment taking weeks of manual configuration to stand up. For teams operating tolling infrastructure, that inconsistency is itself a risk.

The brief was to design a single governance model that every account — present and future — would inherit automatically, without slowing engineering teams down or requiring them to understand the underlying plumbing. The foundation case study covers how that was built; the integration case studies show what it then made possible.

40+
AWS accounts under one consistent governance and security model
Weeks to hours
Time to provision a fully governed new environment
Zero
Accidental production applies since the pipeline redesign
Platform surface

Every AWS service this platform runs on

The case studies above are the parts written up in detail. This is the whole surface — everything the four-layer landing zone provisions and everything the workloads on top of it depend on.

Platform capabilities organized by architectural layer
Layer Platform responsibility Services and capabilities
01 Governance & identity Account structure, policy guardrails, and workforce federation AWS Organizations · Service Control Policies · IAM · IAM OIDC federation · IAM SAML federation
02 Security & compliance Audit, detection, configuration compliance, secrets, and edge protection CloudTrail · AWS Config · GuardDuty · Security Hub · KMS · AWS WAF · Secrets Manager · Certificate Manager
03 Networking & content delivery Multi-account connectivity, routing, private access, traffic distribution, and delivery Amazon VPC · Transit Gateway · Site-to-Site VPN · VPC interface & gateway endpoints · Route 53 public & private zones · Route 53 Resolver · CloudFront · Application Load Balancer · Network Load Balancer · NAT Gateway · VPC Flow Logs
04 Compute & containers Application runtimes, container orchestration, scaling, and image delivery Amazon EC2 · Amazon EKS on Graviton · Amazon ECS · AWS Lambda · EC2 Auto Scaling · Amazon ECR · EC2 Instance Connect
05 Data & storage Object, file, relational, cache, synchronization, and backup services Amazon S3 · Amazon EFS · Aurora PostgreSQL & MySQL, global · Amazon RDS · ElastiCache for Redis · AWS DataSync · AWS Backup
06 Integration & messaging APIs, private service integration, asynchronous messaging, transfer, and communications API Gateway REST & HTTP APIs · API Gateway VPC Link · Amazon SNS · Amazon SQS · Amazon MQ · AWS Transfer Family (SFTP) · Amazon SES · Amazon Connect
07 Operations & analytics Observability, fleet operations, and platform reporting Amazon CloudWatch · AWS Systems Manager · Amazon QuickSight
Breadth isn't the point on its own. Each of these exists because a layer beneath it needed something specific, and each was provisioned through the same modular Terraform structure rather than added by hand. Endpoint protection and vulnerability scanning were rolled out across the fleet through Systems Manager on that same pattern.

Questions about this work?

Happy to go deeper on any part of this — the networking model, the pipeline design, or the trade-offs behind them.

anupojuprudhvi@gmail.com