![\"Palace](\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/04\/palace-square.webp\")
<\/a><\/figure>\n\n\t\t\n\t\tIt has since expanded to include a distribution and POS presence in multiple regions around the globe, with an eCommerce platform and other web applications running in the cloud.<\/p>\n\n\n\n
The Challenge<\/h2>\n\n\n\n
Palace operates a number of proprietary web services, built to support many Shopify online stores. The same group of services is responsible for managing product portfolios, stock & pricing and order fulfilment. Some workloads also serve static web content. These services all run on Heroku.<\/p>\n\n\n\n
While Platform-as-a-Service (PaaS) vendors like Heroku offer a simple and convenient way to get started in the cloud, they do not typically allow customers control over specifics like networking, security, compute and certain environmental configurations. Consequently, Palace decided to migrate to AWS for greater control, though their lack of familiarity with Infrastructure-as-a-Service (IaaS) presented them with a challenge.<\/p>\n\n\n\n
Palace approached Devoteam to provide migration consultancy as well as hands-on migration and modernisation of some of their incumbent workloads from Heroku to AWS. They also required enhanced security and networking.<\/p>\n\n\n\n
The Solution<\/h2>\n\n\n\n
Devoteam first conducted a series of requirement-gathering workshops, during which 5 distinct architecture patterns were identified: Slack integrations, static web content, dynamic web content, containerised API services, and webhooks.<\/p>\n\n\n\n
A new set of AWS accounts was then created for Palace, providing separate accounts for pre-production and production environments, auditing and networking, and for services shared between accounts.<\/p>\n\n\n\n
AWS security services (Security Hub, AWS Config, CloudTrail, GuardDuty) were deployed and configured across the new accounts, and a hub-and-spoke network was set up to allow authenticated traffic to securely transit between the accounts.<\/p>\n\n\n\n
The 5 architecture patterns identified during requirements-gathering were then developed as modular, multi-environment Terraform projects, allowing each pattern to be re-used for future use cases. Command line tooling and CodePipeline CI\/CD pipelines were added to each pattern.<\/p>\n\n\n\n
AWS services adopted<\/h2>\n\n\n\n
SNS, Lambda, S3, CloudFront, Amazon Certificate Manager (ACM), AWS CloudWatch, ECS Fargate, RDS Aurora, ElastiCache, CodePipeline, CodeDeploy, and others.<\/p>\n\n\n\n
The Benefits<\/h2>\n\n\n\n
Granular control of underlying infrastructure<\/strong><\/p>\n\n\n\n Using the 5 bespoke architecture patterns, identified in collaboration with Devoteam, Palace are now able to confidently deploy IaC infrastructure whilst having full control of the resources deployed. A secondary benefit is that Palace will be able to freely evolve each pattern as they continue to modernise their workloads and cloud infrastructure.<\/p>\n\n\n\n Ease-of-deployment<\/strong><\/p>\n\n\n\n With the development of the 5 Terraform patterns, the multi-environment CI\/CD pipelines in CodePipeline and the ability to run single-command deploys from the command line (such as for DR purposes), deployment of AWS resources is now simpler than previous deployments to Heroku.<\/p>\n\n\n\n Improved scaling and resiliency<\/strong><\/p>\n\n\n\n Auto-scaling multi-AZ ECS services, multi-AZ Aurora clusters and ElastiCache Redis provide elasticity and high availability. Terraform patterns are configurable per pattern and per environment, allowing Palace to easily convert from single-AZ static resources to multi-AZ auto-scaling ones.<\/p>\n\n\n\n Enhanced security and auditing posture<\/strong><\/p>\n\n\n\n A combination of multiple AWS accounts and AWS security services ensure that Palace\u2019s AWS cloud estate is proactively protected and monitored against a backdrop of AWS-manged security threats and security industry best practices.<\/p>\n\n\n\n AWS Security Hub provides a single pane for all security findings across the estate. Findings from other security services, such as CloudTrail, GuardDuty and others are surfaced with automatic severity scores and prioritisation, as well as remediation advice.<\/p>\n\n\n\n Network security has also been improved as a result of this migration project.<\/p>\n\n\n\n Improved cost and usage visibility<\/strong><\/p>\n\n\n\n Consolidated costs for the whole estate can be easily dissected per service, per account or per environment, to name but 3 filters. AWS Budgets and alarms have been configured to ensure Palace are always aware of their spend.<\/p>\n\n\n\n Partner with Devoteam to leverage award-winning tech expertise, agile execution, and a culture of continuous learning.<\/p>\n<\/div>\n\n\n\n<\/div>\n\n\n\n<\/span><\/div>\n\n\nYour Success Starts Here<\/strong><\/h2>\n<\/div>\n\n\n\n
\n\n