Aptible to AWS Migration

Diagram of a migration off a sealed managed platform labelled Aptible into AWS: application containers moving right into three environments — dev, staging and prod — with patient data isolated in its own protected account under a HIPAA shield.

The client runs HIPAA-regulated workloads — Python microservices handling protected health information — on Aptible, a managed platform that carried much of the compliance burden for them. Moving to AWS meant taking that burden back: every control Aptible provided by default had to be rebuilt and evidenced, across three environments, without loosening a single one of them along the way.

Two engineers beside a Terraform module whose connections fan out to three identical environments, with a deployment pipeline running beneath them and an encrypted application container in the foreground.

A HIPAA Platform Rebuilt in Terraform, Then Cut Over

The environments were defined in Terraform before anything moved. A single base module described the whole footprint — ECS Fargate, load balancer, PostgreSQL, queues and topics — so development could be stood up, tuned and validated first, then staging and production deployed from the same definition rather than rebuilt by hand. Their existing CircleCI pipeline was kept and retargeted from the Aptible CLI to ECS, so the team's deployment habits survived the move.

Key Benefits & Outcomes

The results speak for themselves — here's how this engagement delivered measurable improvements across performance, reliability, and operational efficiency.

Cost & Control

Like for like, the same workload runs at roughly 60% less on AWS. A managed platform charges for memory by the gigabyte-hour and adds plan and dedicated-stack fees on top; on ECS Fargate the same containers are billed per vCPU and gigabyte-second, with Savings Plans available on the steady-state portion. The environments are Terraform now, so what runs is what is written down — and the client can stand up a fourth environment for the cost of running it, not a negotiation.

Resilience & Scale

The move opened services a PaaS does not expose. Production gained a cross-region Aurora read replica and cross-region S3 backups, which turns disaster recovery from a support ticket into a tested configuration. Scaling is per-task rather than per-plan, and costs can be attributed per service and per environment through tagging.

Compliance You Own

Leaving a compliance-managed platform means the controls become yours — so they were built explicitly rather than inherited. PHI sits in its own AWS account, traffic is encrypted end to end by an SSL reverse proxy inside each task rather than terminating at the load balancer, and GuardDuty, Inspector, Security Hub and Audit Manager generate the evidence continuously. A future auditor is handed reports the client owns, not a vendor attestation.

An engineer watching a compliance wall: a cost chart stepping downward, rows of green checks and HIPAA report cards, beside three healthy environments mirrored by a second region.

Technology

Compute & Containers

Amazon ECS on FargateApplication Load BalancerDockerNginx

Data

Amazon RDS for PostgreSQLAmazon AuroraAmazon S3

Messaging

Amazon SNSAmazon SQS

Networking & DNS

Amazon VPCAmazon Route 53AWS Certificate Manager

Security & Compliance

AWS Control TowerAmazon GuardDutyAmazon InspectorAWS Security HubAWS Audit ManagerAmazon ECR image scanningProwler

Delivery

TerraformCircleCIPython

How It Was Delivered

Discovery & Account Setup

Inventory the applications and data running in Aptible, and finish the part-built AWS Control Tower implementation before any migration begins.

Infrastructure as Code

Define the base environment — ECS, ALB, RDS, SQS, SNS — as a Terraform module, and stand up development from it.

Application Deployment

Retarget the existing CircleCI pipeline from the Aptible CLI to ECS, add an SSL reverse proxy to each container, then deploy staging and production from the same module, each validated before the next.

Security & Compliance

Prowler scan and remediation, then GuardDuty, Inspector, Security Hub and Audit Manager for automated HIPAA reporting.

Cutover & Handover

Support the PostgreSQL migration, move Route 53 records to the new AWS hosts, then working sessions with recorded video and written runbooks.

The Team

A two-role team over a seven-week engagement.

280 engineering hours across 7 weeks

Senior Cloud ConsultantLanding zone, migration design and security review

Cloud EngineerTerraform, pipeline retargeting and environment delivery

What This Project Means For Us

Leaving a compliance-managed platform is the moment the compliance work becomes yours. This engagement is what we bring to that trade: the controls written down as Terraform, the evidence automated before anyone asks for it, the customer's own pipeline still doing the deploying — and roughly 60% off the monthly bill for the same workload. Five phases, three environments, and a cutover that came last rather than first.

Technical Highlights

Full application and data inventory taken in Aptible before any migration

AWS Control Tower implementation assessed and finalised

Base environment defined as a reusable Terraform module

Python microservices on ECS Fargate behind an Application Load Balancer

End-to-end encryption via an SSL reverse proxy inside each container

PHI isolated in a dedicated AWS account across dev, staging and production

CircleCI retargeted from the Aptible CLI to ECS deployments

PostgreSQL migration with cross-region Aurora replica and S3 backups

Automated HIPAA reporting with Audit Manager, ECR scanning and Prowler

Route 53 cutover, then knowledge transfer with recorded sessions and written runbooks

Roughly 60% lower monthly run-rate than the managed platform, like for like

One partner across a portfolio of media projects

We've brought Cloud Ripples into a wide range of engagements across our media and entertainment work, and they adapt quickly to each one. Whether it's a greenfield product build or a DevOps engagement on an existing platform, they come in with the right people, ask the right questions early, and deliver without needing to be managed closely.

Sreejith ParthaCEO

A trusted engineering partner for over 15 years

Cloud Ripples has been part of Gooru's engineering team for more than fifteen years, building and maintaining our applications and managing the cloud infrastructure they run on. They've scaled with us through every stage of our platform's growth, and their reliability, ownership, and deep understanding of our systems have made them a genuine extension of our team rather than a vendor.

SriniCo-founder & CPO

Cloud Ripples developed and now maintains our ERP application across web and mobile

From consultation to delivery, they were professional and insightful. They understood our needs and exceeded expectations. They also handled infrastructure design, hosting, and 24/7 server monitoring, ensuring smooth operation and peace of mind.

VaibhavDirector Operations

Cloud Ripples Support Has Been Essential to Our Success

A reliable and responsive partner, Cloud Ripples handled our diverse tech needs and the complex DEI Toolkit customization with skill and positivity. Their support means a lot to us.

Kris KewitschExecutive Director

A free consultation — with an engineer, not a salesperson

Tell us what you are trying to build, fix or migrate. We will look at your architecture, your costs and your risks, and come back with a recommendation in writing — whether or not it turns into an engagement.

Someone who has read up on your stack before the call

A working session on your actual problem — not a product pitch

An honest view of what you need, and what you do not

A written proposal with fixed scope and cost

The same engineers delivering it, and supporting it afterwards

contact@cloudripples.io

+91 8939464343

No. 403-404, Third Floor, NSIC Software Technology Park
Ekkatuthangal, Chennai - 600032, INDIA

View On Map

Schedule a free consultation