AWS Production Cloud Architecture – Secure, Highly Available & Scalable Infrastructure
A DevSecOps approach on AWS builds security into every layer of a healthcare application, from the network edge to the database and backups. Layered network controls, encryption with customer-managed keys, continuous compliance checks, automated vulnerability and patch management, and real-time security alerting protect sensitive patient data, while immutable, in-country backups keep the platform recoverable and aligned with data residency requirements.
Benefits
uptime, backed by multi-AZ task placement and ECS automated recovery
faster deployment speed with automated blue/green pipelines
improvement in engineering team efficiency on AWS Fargate
AWS WAF managed rules and rate limits filter attacks before traffic reaches the application
No SSH or RDP ports open; administrators connect only through AWS Systems Manager Session Manager
Every data store encrypted with customer-managed AWS KMS keys and TLS enforced in transit
CIS and AWS Foundational Security Best Practices checks run automatically across the account
GuardDuty and Security Hub findings routed to the security team in real time through EventBridge and SNS
Point-in-time database recovery with an RPO of about 5 minutes and locked, cross-Region backup copies kept in Australia
Overview
Healthcare applications handle some of the most sensitive data there is: patient records, prescriptions, referrals, and clinical documents. They are used by patients, doctors, and administrators, and they connect to external services for electronic prescriptions, national healthcare identifiers, referrals, payments, messaging, and notifications. A single exposed port, unencrypted bucket, leaked credential, or unpatched server can lead to a data breach, regulatory penalties, and loss of patient trust.
A DevSecOps approach treats security as part of the architecture and daily operations rather than a final review step. On AWS, the application runs in private subnets behind AWS WAF and an Application Load Balancer, each tier accepts traffic only from the tier in front of it, and administrators never open SSH or RDP. All data is encrypted with customer-managed keys, secrets are stored centrally, and account-wide services continuously check configuration, scan for vulnerabilities, detect threats, and alert the team automatically. Backups are protected by AWS Backup Vault Lock and copied to a second Australian Region, keeping patient data in-country.
About DevSecOps on AWS
DevSecOps integrates security practices into how infrastructure is designed, deployed, and operated, so security controls are automated, consistent, and continuously verified instead of manually checked. AWS supports this with native services for each stage: AWS WAF, security groups, and VPC endpoints for network protection; AWS KMS, AWS Secrets Manager, and AWS Systems Manager for data and secrets protection; AWS Config, AWS Security Hub, Amazon GuardDuty, and Amazon Inspector for continuous assessment and threat detection; AWS CloudTrail, Amazon CloudWatch, and VPC Flow Logs for audit and visibility; and AWS Backup for protected, policy-driven recovery.
Opportunity: Protecting Sensitive Healthcare Data by Design
Healthcare platforms are often built quickly to meet clinical needs, with security added later. Servers are reachable over SSH from the internet, database credentials sit in configuration files, encryption depends on default settings, and logs are scattered or not kept at all. When an auditor or security reviewer asks who accessed what, or whether every data store is encrypted, the answer requires manual investigation.
Operational risks add to the security risks. Servers fall behind on patches, vulnerabilities go unnoticed until they are exploited, and threats are discovered from user complaints rather than alerts. Backups, if they exist, can be deleted by the same credentials that run the application, and copies may be stored outside the country, which conflicts with health data residency expectations.
Organizations in this position need an architecture where security controls are built in, enforced automatically, and continuously monitored, with recovery that can withstand both infrastructure failure and malicious deletion.
The Solution
Network Design Across Three Availability Zones
The application runs inside an Amazon VPC with public and private subnets in three Availability Zones. Only the Application Load Balancer and NAT gateway sit in public subnets; the application servers and database are in private subnets with no direct internet access.
Protected Entry Point
User traffic arrives over HTTPS through the internet gateway and is inspected by AWS WAF, using AWS managed rule groups and rate-based rules to block common exploits and abusive clients. The Application Load Balancer, with nodes in all three public subnets, enforces TLS 1.2 and TLS 1.3 using an AWS Certificate Manager (ACM) certificate, redirects HTTP to HTTPS, and writes access logs to Amazon S3. The public domain points to the load balancer through a DNS CNAME record.
Least-Privilege Security Groups
Security groups form a strict chain. The load balancer group accepts ports 443 and 80 from the internet, the application group accepts port 443 only from the load balancer group with no SSH (22) or RDP (3389) access, and the database group accepts port 3306 only from the application group. Every tier is reachable only from the tier directly in front of it.
Hardened Application Tier
The application runs on an Amazon EC2 instance (nginx and PHP-FPM) in a private subnet, with Amazon EBS volumes encrypted using AWS KMS. Administrative access is provided only through AWS Systems Manager Session Manager, which requires IAM authentication, needs no open inbound ports, and logs every session.
Encrypted Database
Amazon RDS for MySQL 8.4 is deployed in a DB subnet group spanning all three private subnets, encrypted with AWS KMS, and configured to require TLS for connections. Point-in-time recovery is retained for 35 days.
Controlled Outbound Access
Outbound connections to external services, such as electronic prescription exchange, healthcare identifier services, referral networks, payments, SMS, real-time messaging, and third-party APIs, are restricted to port 443 and leave through a NAT gateway with a fixed Elastic IP address. External providers allow-list that single address, so only the platform can call their APIs.
Secure Document Storage
Patient documents are stored in Amazon S3 with SSE-KMS encryption, versioning, and a bucket policy that rejects any request not made over TLS. The application reaches S3 through an S3 gateway VPC endpoint, so document traffic never crosses the public internet.
Secure Email
Amazon SES sends transactional email with a TLS policy set to Require, so messages are only delivered when the receiving server supports an encrypted connection.
Secrets and Key Management
Database credentials and API keys are stored in AWS Secrets Manager, and configuration values in Systems Manager Parameter Store as SecureString parameters, so no secrets are kept in code or on disk. Six customer-managed AWS KMS keys separate encryption by purpose, giving fine-grained control and an audit trail of every key use.
Identity and Access Controls
IAM users are required to use multi-factor authentication, and IAM Access Analyzer continuously identifies resources shared outside the account and unused or overly broad access, so permissions can be tightened over time.
Continuous Compliance
AWS Config records every resource change and evaluates it with conformance packs. AWS Security Hub runs the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices (FSBP) standards, giving a continuously updated security score and prioritized list of findings.
Threat Detection and Vulnerability Management
Amazon GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS activity to detect threats such as compromised credentials or unusual network traffic. Amazon Inspector continuously scans the EC2 instance for software vulnerabilities, and Systems Manager Patch Manager applies operating system patches on a defined schedule.
Logging and Automated Alerting
AWS CloudTrail records all API activity, VPC Flow Logs capture network traffic, and Amazon CloudWatch collects application and system logs with alarms on key metrics. Amazon EventBridge rules match high-severity security findings and events and send them to an Amazon SNS security-alerts topic, so the team is notified immediately.
Immutable, In-Country Backups
AWS Backup protects the platform with a vault locked using Backup Vault Lock, so recovery points cannot be deleted or altered before their retention ends. Plans cover RDS point-in-time recovery for 35 days, daily EC2 backups kept for 14 days, monthly backups kept for 12 months, and yearly backups kept for 7 years. Monthly and yearly copies are replicated to a KMS-encrypted, Vault Lock-protected vault in the Melbourne Region, so all backup data stays in Australia.
Availability Zone Failure Recovery
If an Availability Zone fails, the EC2 instance is relaunched from its AMI and launch template into one of the other two Availability Zones, and the database is restored with point-in-time recovery into the same DB subnet group. This approach targets a recovery time objective (RTO) of about 1 hour and a recovery point objective (RPO) of about 5 minutes.
Results
Minimal Attack Surface
Only the load balancer is exposed to the internet, protected by AWS WAF. Application and database servers have no public access and no SSH or RDP ports.
Encryption Everywhere
EBS volumes, the database, S3 documents, secrets, and backups are encrypted with customer-managed KMS keys, and TLS is enforced for web traffic, database connections, S3 access, and email.
Audit-Ready Compliance
CIS and FSBP standards, AWS Config conformance packs, and CloudTrail give a continuous, evidence-based view of compliance instead of point-in-time manual reviews.
Faster Detection and Response
GuardDuty, Security Hub, and CloudWatch findings reach the security team within minutes through EventBridge and SNS, so threats are investigated before they escalate.
Reduced Vulnerability Exposure
Continuous Inspector scanning and scheduled Patch Manager updates keep the application server current, closing known vulnerabilities quickly.
Ransomware-Resistant Recovery
Vault Lock prevents backups from being deleted, even by administrators, and cross-Region copies protect against a Regional outage, with point-in-time database recovery down to about 5 minutes.
Data Residency Assured
Production data and every backup copy remain in Australian AWS Regions, supporting health data residency requirements.
AWS Services Used
Core AWS building blocks powering high availability, elastic scaling, security, and automated deployments.
Amazon VPC
Multi-AZ virtual private cloud network segmentation isolating public ingress from private application and database subnets.
AWS WAF
Layer 7 web application firewall blocking SQL injection, common exploits, and automated flood attacks ahead of the load balancer.
Elastic Load Balancing (ALB)
Public-facing Application Load Balancer distributing encrypted HTTPS traffic across healthy private EC2 targets with S3 access logging.
AWS Certificate Manager (ACM)
Centrally manages, provisions, and automatically renews public SSL/TLS certificates for custom production domains.
NAT Gateway + Elastic IP
Highly available managed network gateway enabling private subnet servers to reach external health APIs from a static IP.
Amazon EC2
Reliable cloud compute instances hosting nginx and PHP-FPM workloads secured by customer-managed KMS encryption at rest.
Amazon RDS for MySQL
Fully managed relational database deployed across private DB subnet groups with enforced TLS connections and automated 35-day PITR.
Amazon S3 + Gateway Endpoint
Object storage hosting patient documents with SSE-KMS encryption, versioning, and private VPC gateway endpoint connectivity.
Amazon SES
Secure cloud email service enforcing mandatory TLS encryption for transactional communications and clinical notifications.
AWS KMS
Hardware security module-backed cryptographic service providing purpose-separated customer managed keys (CMKs) across all data stores.
AWS Secrets Manager & Parameter Store
Secure credential store eliminating hardcoded database passwords, third-party API keys, and sensitive application parameters.
AWS Systems Manager
Enables zero-inbound-port remote terminal management through IAM authentication and scheduled operating system security patch cycles.
AWS IAM & Access Analyzer
Least-privilege identity management enforcing multi-factor authentication and continuously analyzing resource policies for public drift.
AWS CloudTrail
Comprehensive audit logging recording every API action, console access, and administrative event across the entire AWS account.
AWS Config
Continuously assesses, audits, and evaluates resource configurations against organizational compliance rules and best practice baselines.
AWS Security Hub
Centralized security posture management checking accounts continuously against CIS AWS Foundations and AWS FSBP benchmarks.
Amazon GuardDuty
Intelligent threat detection using machine learning, anomaly detection, and integrated threat intelligence to protect AWS resources.
Amazon Inspector
Automated vulnerability scanning evaluating EC2 operating systems and application packages for known software CVEs.
Amazon CloudWatch & VPC Flow Logs
Real-time operational telemetry capturing packet flow logs, system metrics, and error rates with automated alarm triggers.
Amazon EventBridge & SNS
Serverless event routing instantly dispatching critical GuardDuty and Security Hub findings to on-call engineering channels.
AWS Backup (Vault Lock)
Centralized, policy-driven backup orchestration with WORM-compliant Backup Vault Lock and automated cross-Region replication.
Send Us a Message
Ready to bring your ideas to life? Tell us about your project and our team will get back to you within one business day.
Denver, CO 80231