What was proposed:

The Ferreira Costa was divided in two phases: 

In The first one an assessment was conducted in the specific context of the project, followed by a first implementation.  The second improvements and tuning were developed in the project.

• Map and model the entire technology architecture;

• Propose technical migration scenarios;

• Conduct a capacity planning and infrastructure dimensioning study;

• Optimize systems architectures;

• Performance in your application's response time;

• Increased security through encryption in transit;

• Anti DDoS protection;

• Provide specialized support in cloud computing architecture and technology operation.

Technical enablement

Amazon Cloudfront adoption was developed in order to enhance aspects initially related to performance guaranteeing a more fluid use of Ferreira Costa e-commerce. Even though performance was the initial target, after the adoption of CloudFront reliability and Availability were also positively impacted. Other AWS services were integrated into the solution:

• • SAP Fiori launchpad accelerated by Amazon CloudFront.

  • Acceleration of the SAP OData API calls with AWS Global Accelerator;

  • The Application Load balancer (ALB) acted as reverse proxy to SAP S/4HANA. To improve the security posture, we've installed SAP S/4HANA with embedded Fiori in a private subnet, and setup an SAP Web dispatcher in a public subnet;

  • AWS Certificate Manager were used to manage the wildcard SSL certificate for CloudFront and Application Load balancer;

  • Amazon Route 53 managed the DNS entries required to support the solutions.

• AWS EC2: We are currently running 64 EC2 instances, That are:

  • 15 instances are PROD instances running SAP, 4/15 SAP instances are dedicated to the e-commerce;

  • 12 instances are QAs instances;

  • 17 instances are DEV instances;

  • Another 20 instances are used to several other purposes like VPN, Bastionhost and staging; 

• AWS CloudWatch: CloudWatch service is enabled to provide infrastructure and services monitoring throughout dashboards and also, events alerts;

• AWS GuardDuty: GuardDuty service is also enabled to support monitoring processes;

• AWS Lambda: Lambda are implemented in order to automate creation of snapshots.

AWS Services deployed: 

• Amazon EC2, Amazon S3, Amazon CloudWatch, Amazon GuarDuty, AWS CloudTrail, AWS Lambda, Amazon CloudFront.

Customer issues and concerns that have been overcome:

1. Operational excellence

1.1. Implementation of continuous monitoring with Amazon CloudWatch;

1.2. Integrated connectivity with high available multi zone (Multi-AZ);

2. Security

2.1. Implementation of Amazon GuardDuty for intelligent monitoring of infrastructure perimeter;

2.2. Restriction of external access to the environment, with segregation between private and public subnets for back and front end, respectively;

2.3. Access to the AWS environment for VPN-only administration;

2.4. Encryption of data at rest

2.5. Encryption of data in transit with Amazon Cloudfront.

3. Reliability

3.1. Multiple instance nodes, making it possible to balance reading and writing operations;

3.2. Minimal failover between nodes;

3.3. Using Amazon Data Lifecycle Manager to implement snapshot-level backups.

3.4. Automatic backups of the database layer;

4. Excellence in performance

4.1. Calculation of expected environment demand for rightsizing.

5. Cost optimization

5.1. The monitored environment, with a continuous flow of monitoring for rightsizing.

Third-party solutions applied:

• • Hashicorp Terraform: Infrasctructure as Code;

  • Hashicorp Vault: Secrets and key management service.

Key Results:

• • AWS managed infrastructure service;

  • Professional managed services provided;

  • 99.97% availability of the environment;

  • 29% increase in response time with Amazon Cloudfront;

  • Encryption in transit of sensitive data;

  • Protection against DDoS attacks.

Lessons learned:

• • The implementation of AWS services, allowed us to focus more on the business aspects of the project;

  • Although the planning of projects like this is important, the need for experimentation on the part of the client proved to be fundamental. In this sense, the use of AWS enables a rapid prototyping of architectures;

  • Using the AWS Well-Architected framework as a reference helps us to make clear to the customer the value of a good service partner.

Architecture Diagram: