Palace Skateboards

The Solution

Ubertas Consulting first conducted a series of requirement-gathering workshops, during which 5 distinct architecture patterns were identified: Slack integrations, static web content, dynamic web content, containerised API services, and webhooks.

A new set of AWS accounts was then created for Palace, providing separate accounts for pre-production and production environments, auditing and networking, and for services shared between accounts.

AWS security services (Security Hub, AWS Config, CloudTrail, GuardDuty) were deployed and configured across the new accounts, and a hub-and-spoke network was set up to allow authenticated traffic to securely transit between the accounts.

The 5 architecture patterns identified during requirements-gathering were then developed as modular, multi-environment Terraform projects, allowing each pattern to be re-used for future use cases. Command line tooling and CodePipeline CI/CD pipelines were added to each pattern.

The Benefits

Granular control of underlying infrastructure

Using the 5 bespoke architecture patterns, identified in collaboration with Ubertas Consulting, Palace are now able to confidently deploy IaC infrastructure whilst having full control of the resources deployed. A secondary benefit is that Palace will be able to freely evolve each pattern as they continue to modernise their workloads and cloud infrastructure.

Ease-of-deployment

With the development of the 5 Terraform patterns, the multi-environment CI/CD pipelines in CodePipeline and the ability to run single-command deploys from the command line (such as for DR purposes), deployment of AWS resources is now simpler than previous deployments to Heroku.

Improved scaling and resiliency

Auto-scaling multi-AZ ECS services, multi-AZ Aurora clusters and ElastiCache Redis provide elasticity and high availability. Terraform patterns are configurable per pattern and per environment, allowing Palace to easily convert from single-AZ static resources to multi-AZ auto-scaling ones.

Enhanced security and auditing posture

A combination of multiple AWS accounts and AWS security services ensure that Palace’s AWS cloud estate is proactively protected and monitored against a backdrop of AWS-manged security threats and security industry best practices.

AWS Security Hub provides a single pane for all security findings across the estate. Findings from other security services, such as CloudTrail, GuardDuty and others are surfaced with automatic severity scores and prioritisation, as well as remediation advice.

Network security has also been improved as a result of this migration project.

Improved cost and usage visibility

Consolidated costs for the whole estate can be easily dissected per service, per account or per environment, to name but 3 filters. AWS Budgets and alarms have been configured to ensure Palace are always aware of their spend.