Executive Summary
A large US professional association was building a new digital signature SaaS application on AWS when their previous partner walked away mid-engagement. Half the infrastructure was undocumented, the Staging and Production accounts were empty, and the internal team was new to AWS with nobody to lean on. Logicata codified every AWS resource into CloudFormation, consolidated the fragmented stacks, and deployed the platform from Development through to Production in four months, using the same codebase end-to-end.
Customer Overview
Sector: Professional Services / Technology
Location: United States
The customer is one of the largest professional associations in the United States, serving tens of thousands of members with IT support, software products, and digital tools. They were developing a new digital signature application to integrate with an existing suite of member software. It was their first significant AWS deployment, and the stakes were high.
The Challenge
A previous AWS partner had built the initial development environment but departed abruptly, leaving the customer with:
- Undocumented infrastructure. Roughly 50% of resources were Infrastructure as Code; the other half were created manually with no documentation explaining what or why.
- No path to production. The Staging and Production AWS accounts existed in the AWS Organization but were empty. There was no repeatable mechanism for deploying anything to them.
- Fragmented standards. Existing CloudFormation stacks were a mix of YAML and JSON, with ECS clusters split across more stacks than necessary.
- Security gaps. AWS WAF was present but lacking logging and the recommended ACLs.
- Knowledge gap. The internal team was new to AWS with no partner support available, and a launch deadline that didn’t move.
Without a fresh pair of AWS-specialist hands, the platform was not going to ship.
The Solution
Logicata delivered a two-phase engagement.
Phase 1: Discovery
Automated tooling, read-only access inspection, and collaborative workshops documented the entire AWS Organization, including the Shared Networking Account (Transit Gateway, 3-tier VPC, Site-to-Site VPN), the Development Account resources, and the empty Staging and Production accounts. The customer team came out of Discovery with the architectural map they had never had.
Phase 2: Development to Production
Every manually-created resource was codified into standardised AWS CloudFormation YAML templates covering Amazon RDS Aurora, ECS Task Definitions, Amazon ElastiCache, EC2 instances, Amazon CloudFront, Amazon MQ, Amazon ECR, AWS Secrets Manager, and AWS Amplify applications. Fragmented stacks were consolidated into a smaller, cleaner set.
Networking and security work landed alongside: Amazon Route 53 DNS, per-environment Application Load Balancers, AWS Certificate Manager certificates with automated renewal, and AWS WAF with properly-configured ACLs.
With the codebase in place, infrastructure was deployed collaboratively to Staging and then Production using the same templates. No environment drift, no manual ClickOps, no surprise differences between environments.
Results
- 100% Infrastructure as Code across Staging and Production. Zero manual ClickOps in the deployed environments.
- ~50% reduction in CloudFormation stacks through consolidation into standardised templates.
- Security posture hardened. AWS WAF ACLs configured, AWS Certificate Manager set up for automated renewal, environment-scoped security groups.
- Identical promotion across environments. The same codebase deploys Dev, Staging, and Production. What ships to Production is exactly what was tested in Staging.
- Team enablement. Collaborative workshops left the internal team able to operate and extend the platform independently.
- Delivered in four months (September 2024 to January 2025).
AWS Services Used
- AWS CloudFormation
- Amazon ECS
- Amazon RDS (Aurora MySQL)
- Amazon CloudFront
- AWS Transit Gateway
- Amazon Route 53
- AWS Certificate Manager
- AWS WAF
- Amazon ElastiCache (Memcached)
- Amazon MQ (RabbitMQ)
- AWS Amplify
- Amazon ECR
- AWS Secrets Manager
Architecture Overview
The solution uses a multi-account AWS Organization with a Shared Networking Account (Transit Gateway, Ingress/Egress VPCs, Site-to-Site VPN), and separate Development, Staging, and Production accounts. Each account is deployed from identical CloudFormation templates. Centralised networking routes traffic through the Transit Gateway, with environment-specific ALBs, WAF rules, and DNS configuration all managed as code.
About Logicata
Logicata is an AWS Advanced Partner holding the AWS Cloud Operations Management Competency, validated through an independent third-party audit. Logicata helps organisations build and operate secure, well-governed cloud platforms on AWS, enabling customers to reduce operational risk, meet assurance expectations, and scale with confidence.
