Nodei | AWS Cost Analysis and Optimization Agent

Case Studies

CUSTOMER CASE STUDY

Nodei

AWS Cost Analysis and Optimization Agent

Customer Nodei
AWS Account ID 328879700399
ACE Opportunity IDs O21927237 (AI Assessment) · O24437729 (POC Funding)
Industry Cloud-native technology / SaaS (confirm)
Solution Area Agentic AI, AWS Cost Analysis and Optimization, FinOps Enablement
Delivery Partner Atomic Computing (AWS Advanced Tier Services Partner)

Customer Background

Nodei operates production workloads on AWS and needed better visibility into cloud spend along with practical, trustworthy guidance on how to reduce it. As usage grew across accounts, its finance, engineering, and cloud operations teams were spending time manually gathering cost data from the console, Cost Explorer, optimization tools, and documentation before they could answer routine questions or act on savings opportunities. The goal was to design and validate an agentic AI solution that lets teams ask cost and optimization questions in plain language, grounded in live AWS data, without granting the agent the ability to change infrastructure.

1. Executive Summary

Atomic Computing designed and built a proof-of-concept AWS Cost Analysis and Optimization Agent for Nodei. The solution is a multi-agent, conversational assistant for FinOps, cloud operations, and engineering teams. It combines Amazon Bedrock foundation model inference with an agent orchestration layer, live AWS cost and optimization data, AWS documentation retrieval, session memory, and secure cross-account access. The agent uses a Claude Haiku-class model on Amazon Bedrock for routing, summarization, and explanation, with LangGraph for controlled multi-agent orchestration, MCP servers for standardized access to AWS billing and documentation tools, and FastAPI for a streaming chat interface. Financial calculations are performed deterministically in code, and the model is used to explain results rather than to invent or compute them. The engagement was delivered across four practice areas: agentic AI design, security and interoperability, responsible AI, and managed compute. The result was a working, read-only, least-privilege agent that improved cost visibility and self-service optimization guidance for Nodei while keeping human review in place for any operational or financial decision.
The solution addresses three primary customer needs:

Customer Need Solution Capability
Understand AWS spend quickly Conversational cost analysis for month-to-date spend, previous-month totals, service-level breakdowns, and cost trends
Identify savings opportunities Optimization recommendations for EC2, RDS, Lambda, ECS, EBS, Reserved Instances, and Savings Plans
Improve AWS decision-making Live AWS documentation lookup and explanation through a documentation specialist agent

2. Customer Challenges

The assessment identified a set of cost, operational, and security challenges that the agent needed to address:

Challenge Impact
Cloud spend visibility is fragmented Finance and engineering teams spend time manually gathering cost data across consoles and dashboards
Optimization recommendations are hard to interpret Teams may miss savings from rightsizing, RI/SP coverage, idle resources, or storage optimization
Documentation lookup slows decisions Users need fast, contextual explanations of AWS services and pricing concepts
Multi-account environments add complexity Central teams need secure access to member and customer accounts
Repeated queries create latency and tool overhead Users expect fast, interactive, chat-style responses
Long conversations need continuity The assistant must remember context across turns without exposing unnecessary history
Cost and billing data is sensitive Access must be authenticated, least-privilege, and auditable

3. Solution Overview

Atomic Computing implemented a controlled, multi-agent architecture rather than a single monolithic assistant. A supervisor agent classifies each user message and routes it to a specialist agent, and cost and documentation tasks follow a two-phase pattern that separates deterministic data retrieval from model narration. The solution included:

  • A supervisor agent for intent classification and routing.
  • A cost analysis (manager) agent for month-to-date, previous-month, and service-level spend.
  • A remediation agent for service-scoped optimization recommendations.
  • A documentation agent for grounded AWS service and pricing explanations.
  • A direct chat agent for greetings, capability questions, and simple follow-ups.
  • Amazon Bedrock (Claude Haiku-class) for inference, accessed through langchain-aws.
  • LangGraph for explicit, state-based orchestration and typed shared state.
  • MCP servers (billing/cost management and AWS documentation) launched on demand through uvx.
  • FastAPI with Server-Sent Events for streaming responses, and SQLite with WAL mode for session persistence.
  • Cookie-based authentication with PBKDF2-SHA256 password hashing and session ownership.
  • STS AssumeRole with optional ExternalId for secure cross-account analysis.

4. Agent Architecture and Routing

The supervisor routes each request to the agent best suited to the task. This limits unnecessary tool exposure and lets each specialist have its own tools, prompt, and token budget.

Route Agent Use Case
manager Cost Analysis Agent Spend summaries, MTD costs, forecasts, service-level cost breakdowns
remediation Optimization Agent Rightsizing, idle resources, RI/SP coverage, savings recommendations
docs Documentation Agent AWS service explanations, pricing concepts, service comparisons
direct General Chat Agent Greetings, capability questions, simple follow-ups

Two-phase retrieval and narration

For cost analysis and documentation, the implementation fetches data first and narrates second. The cost fetcher retrieves previous-month, month-to-date, and same-period-last-month figures in parallel using asyncio.gather, month-over-month deltas are calculated in Python, and the result is reduced to a compact JSON summary before a single Bedrock narration call. Financial calculations are therefore deterministic and auditable, and the model explains the result rather than computing it. The documentation agent works the same way: it retrieves targeted AWS documentation, then passes it to the model without tools bound to produce a grounded answer.

5. Cost Analysis and Optimization Capabilities

The cost analysis agent answers questions about recent and comparative AWS spend using Cost Explorer data through the billing MCP server. The remediation agent uses service-scoped tool routing so it can answer both broad questions, such as how to reduce the overall bill, and targeted questions, such as showing RDS rightsizing opportunities.

Requested Scope Tools Used
EC2 Cost Optimization Hub, Compute Optimizer EC2 recommendations, RI performance, Savings Plans performance
RDS Cost Optimization Hub and Compute Optimizer RDS recommendations
Lambda Lambda optimization and Compute Optimizer recommendations
ECS ECS service recommendations
EBS EBS volume recommendations
Full account All available optimization tools

6. Responsible AI and Safety Controls

Because the agent interacts with sensitive cost data and can influence operational decisions, responsible AI practices were applied across the full lifecycle: discovery, design, implementation, validation, monitoring, and iterative improvement. The design prioritizes accuracy, safety, transparency, privacy, and continuous improvement.

Implemented controls

Control Responsible AI Benefit
Two-phase cost analysis and Python arithmetic Prevents hallucinated financial values and improves numerical reliability
Grounded documentation retrieval Reduces unsupported documentation answers
Read-only AWS access, no autonomous remediation Preserves human approval and prevents destructive automation
Supervisor routing and service-scoped tools Limits scope per task and reduces unnecessary data exposure
Advisory response language Recommendations are framed as analysis to review, not approved changes
Sliding context window and summarization Reduces long-context exposure and token cost
Tool response guards and token budgets Reduce malformed context and uncontrolled generation

Human oversight

The agent is designed to provide analysis and recommendations, not autonomous infrastructure changes. Optimization recommendations, rightsizing suggestions, and RI or Savings Plans guidance are advisory, and a human is expected to validate workload impact, cost commitment, and owner approval before acting. Escalation to a human reviewer is recommended whenever a recommendation could affect production, involves financial commitment, conflicts with console data, or reports missing data.

7. Security, Cross-Account Access, and Interoperability

Security was implemented at two levels. Application-level authorization ensures only authenticated users can access the agent and their own sessions, using cookie-based authentication with PBKDF2-SHA256 password hashing, HMAC-signed HTTP-only cookies, and session ownership. AWS-level authorization uses read-only IAM permissions for cost, optimization, and recommendation data, so the agent can inspect billing and optimization data but cannot modify infrastructure.

Cross-account access

For multi-account environments, the application assumes a read-only role in the target account using AWS STS, configured through AWS_ROLE_ARN, an optional AWS_PROFILE, and an optional AWS_EXTERNAL_ID. Temporary role-based credentials are preferred over long-lived static keys, and ExternalId reduces confused-deputy risk when a central or consulting account analyzes a member account.

Interoperability

The application exposes standard, reusable interfaces so it can integrate with web UIs, internal portals, and future channels. These include a JSON REST API, Server-Sent Events for token-by-token streaming, MCP for standardized tool invocation, and LangGraph for controlled routing between agents. Endpoints cover streaming and non-streaming chat, session creation and listing, message history retrieval, session deletion, login, and health checks.

8. Compute and Deployment Architecture

The recommended production deployment uses Amazon ECS on AWS Fargate as the primary compute service for the containerized FastAPI and LangGraph application. Fargate suits the workload because it is containerized, long-running, API-driven, and needs stable HTTP and SSE streaming, and it supports the subprocess-based MCP servers launched inside the container. Fargate also removes EC2 host management, supports task IAM roles and private networking, and scales task count based on demand.

Workload Component Recommended Compute Service
Primary web and agent runtime Amazon ECS on AWS Fargate
Optional specialized agent runtime Amazon Bedrock AgentCore Runtime
Event-driven background jobs AWS Lambda (cost summaries, session cleanup, notifications)
Large Kubernetes environments Amazon EKS with Fargate or managed node groups


The supporting stack includes Amazon ECR for the container image, an Application Load Balancer with AWS Certificate Manager for HTTPS, AWS Secrets Manager or SSM Parameter Store for secrets, and Amazon CloudWatch for logs and metrics. ECS tasks run in private subnets across at least two Availability Zones with the ALB as the only public entry point, a least-privilege task role for Bedrock, STS, logging, and approved cost APIs, and VPC endpoints to reduce public internet exposure.

9. Business Outcomes

The proof of concept delivered the following outcomes for Nodei:

  • A working conversational agent for AWS cost analysis and optimization across FinOps, cloud operations, and engineering teams.
  • Faster, self-service answers to cost questions without manual navigation of multiple AWS consoles and dashboards.
  • Grounded, auditable cost figures, with financial calculations performed deterministically in code.
  • Service-scoped optimization guidance for EC2, RDS, Lambda, ECS, EBS, Reserved Instances, and Savings Plans.
  • Secure, least-privilege, read-only AWS access with cross-account role assumption and no ability to modify infrastructure.
  • A responsible AI framework with human-in-the-loop review, monitoring signals, and an iterative improvement process.
  • A clear path to production on Amazon ECS Fargate, with enterprise hardening options for SSO, RBAC, secrets management, and observability.

10. Conclusion

Atomic Computing helped Nodei move from fragmented cost visibility to a controlled, conversational way of understanding and reducing AWS spend. The proof of concept combines Amazon Bedrock-hosted Claude models for inference, LangGraph for controlled multi-agent orchestration, MCP servers for live AWS data and documentation access, and FastAPI for a streaming interface, all designed around least-privilege access, deterministic financial calculations, and human review of operational decisions. The engagement demonstrates a disciplined consulting approach across agentic AI, security and interoperability, responsible AI, and managed compute. Nodei can get fast, grounded cost and optimization insights today, while the architecture leaves a clear path toward enterprise-grade identity, authorization, monitoring, and governance as adoption grows.

AWS Security Foundation for Houdiny AI Platform

Case Studies
Customer: Houdiny AI
ACE Opp ID: 024688744022
Industry: SaaS / AI-Powered Lead Outreach Assistant Platform
Solution Area: Secure AWS Setup, SOC Monitoring, Vulnerability Assessment, and Penetration Testing

Customer Background

Houdiny AI is an AI-powered lead outreach assistant platform that helps enterprises automate and optimize sales engagement. As the platform scaled, Houdiny AI required a secure, production-ready AWS environment that could protect customer data, support compliance readiness, and provide continuous security visibility.

Houdiny AI partnered with Atomic Computing to implement a secure AWS foundation supported by monitoring, vulnerability management, penetration testing, and automated remediation.

1. Executive Summary

Atomic Computing designed and implemented a secure AWS environment for Houdiny AI, focused on secure setup, continuous SOC monitoring, timed vulnerability assessments, and scheduled penetration testing.

The solution used AWS-native security services including IAM, AWS Identity Center, AWS CloudTrail, Amazon GuardDuty, AWS Security Hub, AWS Config, Amazon CloudWatch, AWS KMS, Amazon Macie, AWS WAF, Lambda, EventBridge, and Terraform-managed remediation runbooks.

The engagement enabled Houdiny AI to improve cloud security visibility, reduce misconfiguration risk, validate security controls, and maintain stronger audit readiness for ISO 27001 and SOC 2-aligned practices.

2. Customer Challenges

Houdiny AI needed to address the following security and operational challenges:

  • Secure setup of AWS accounts, workloads, identity, networking, and encryption
  • Limited centralized visibility into AWS security events and configuration changes
  • Need for continuous SOC monitoring and alert triage
  • Lack of scheduled vulnerability assessments across cloud and application assets
  • Need for authorized penetration testing to validate exploitable risks
  • Manual remediation and tracking of non-compliant resources
  • Audit readiness requirements for ISO 27001 and SOC 2-aligned controls

3. Solution Overview

Atomic Computing implemented a security-focused AWS operating model covering secure architecture, monitoring, recurring assessments, and remediation.

The solution included:

  • Secure AWS account and workload configuration
  • IAM and AWS Identity Center for least-privilege access
  • Multi-factor authentication for privileged users
  • Secure VPC and security group configuration
  • Encryption using AWS KMS
  • Centralized logging with AWS CloudTrail and CloudWatch
  • Threat detection with GuardDuty
  • Security posture management with Security Hub and AWS Config
  • Sensitive data discovery with Amazon Macie
  • Web application protection using AWS WAF
  • SOC monitoring and incident escalation procedures
  • Timed vulnerability assessments
  • Scheduled penetration testing
  • Automated remediation using Lambda, EventBridge, and Terraform

4. SOC Monitoring and Security Operations

Atomic Computing implemented SOC monitoring to provide Houdiny AI with continuous visibility into security risks and suspicious activity.

The SOC process included:

  • Monitoring GuardDuty, Security Hub, CloudTrail, CloudWatch, AWS Config, and WAF findings
  • Reviewing suspicious logins, unusual API calls, exposed services, and configuration drift
  • Triage and prioritization of high-severity alerts
  • Escalation of confirmed incidents to technical owners
  • Remediation tracking and closure reporting
  • Periodic security posture reporting

Key metrics tracked included:

Metric Purpose
Mean Time to Detection Measures how quickly threats or violations are detected
Mean Time to Identification Measures how quickly root cause is identified
Mean Time to Remediation Measures how quickly issues are resolved
Non-Compliance Count Tracks resources outside approved configuration
Vulnerability Closure Rate Tracks remediation progress for VA findings
Penetration Test Remediation Status Tracks closure of validated exploitable findings
Incident SLA Compliance Tracks incident response performance

5. Timed Vulnerability Assessments

Atomic Computing established timed vulnerability assessments to identify risks across Houdiny AI’s AWS environment and application-facing assets.

Assessment activities included:

  • Reviewing AWS configuration risks
  • Checking IAM permissions and privilege exposure
  • Identifying open ports and public-facing services
  • Reviewing security group rules
  • Checking encryption and data protection controls
  • Identifying cloud misconfigurations
  • Reviewing application-facing vulnerabilities
  • Assigning severity ratings
  • Providing remediation recommendations
  • Revalidating resolved findings where required

This helped Houdiny AI identify and reduce security weaknesses on a recurring basis.

6. Scheduled Penetration Testing

Atomic Computing implemented an authorized penetration testing process to validate Houdiny AI’s real-world security posture.

The penetration testing process included:

  • Defining scope, targets, and testing windows
  • Conducting reconnaissance on approved assets
  • Testing authentication and authorization controls
  • Validating common web application risks, including OWASP-aligned issues
  • Confirming exploitability of identified vulnerabilities
  • Documenting evidence and business impact
  • Providing prioritized remediation guidance
  • Supporting retesting after fixes

This enabled Houdiny AI to move beyond vulnerability identification and understand which risks were practically exploitable.

7. Automated Remediation and Risk Tracking

Atomic Computing implemented automated remediation and structured risk tracking to reduce manual effort and improve response times.

Risk Area Detection Method Remediation Approach
Over-permissive IAM AWS Config, Security Hub Apply least-privilege updates
Public S3 access AWS Config, Security Hub Remove public access and notify owners
Open security groups AWS Config, CloudWatch Restrict ingress rules
Unencrypted resources AWS Config, KMS checks Enforce or plan encryption remediation
Suspicious activity GuardDuty, CloudTrail Investigate, contain, and escalate
Web application risks VA/PT findings Remediate and retest


All findings were assigned severity, ownership, remediation timelines, and closure status.

8. Incident Response SOP

Atomic Computing helped Houdiny AI define a security incident response SOP covering:

  1. Detection through GuardDuty, Security Hub, CloudWatch, AWS Config, and WAF logs
  2. Severity classification as Critical, High, Medium, or Low
  3. Notification to SOC, technical owners, and stakeholders
  4. Containment of affected resources or access paths
  5. Remediation through configuration changes, patching, access removal, or key rotation
  6. Root cause analysis using CloudTrail, Config, and workload logs
  7. Documentation for operational and audit evidence
  8. Post-incident review and continuous improvement

9. Business Outcomes

The engagement delivered the following outcomes for Houdiny AI:

  • Secure and production-ready AWS setup
  • Improved visibility into cloud security events
  • Continuous SOC monitoring and alert triage
  • Reduced risk from misconfigurations and exposed services
  • Scheduled vulnerability assessments
  • Authorized penetration testing and retesting
  • Faster remediation using automation and runbooks
  • Stronger incident response readiness
  • Better audit readiness for ISO 27001 and SOC 2-aligned practices
  • Improved protection of sensitive customer and business data

10. Conclusion

Atomic Computing helped Houdiny AI establish a secure AWS operating model built around secure setup, SOC monitoring, timed vulnerability assessments, and scheduled penetration testing.

By combining AWS-native security services, automated remediation, structured incident response, and recurring security validation, Atomic Computing enabled Houdiny AI to reduce risk, improve visibility, and operate its SaaS platform securely on AWS.

SihaTech: GDPR-Compliant AWS Infrastructure for Digital Health at Scale

Case Studies

Customer: SihaTech
 ACE Opp ID: 551452214208
 Industry: Digital Health / Patient Data Management
 Solution Area: Secure, Compliant, and Scalable Cloud Infrastructure on AWS

1. Executive Summary

SihaTech is a digital health platform that manages sensitive medical records, patient data, and healthcare workflows. With growing adoption and increasing regulatory requirements (GDPR, CNDP), SihaTech needed a secure, compliant, and scalable cloud infrastructure capable of protecting sensitive medical data while maintaining high availability and operational efficiency.

To meet these requirements, SihaTech partnered with Atomic Computing, leveraging AWS best practices for governance, security, and automation. The solution utilizes services including AWS Amplify, Amazon EKS, ALB, RDS (PostgreSQL Multi-AZ), S3 with KMS encryption, and ECR, providing a secure, compliant, and cost-efficient environment for development and production workloads.

As a result, SihaTech now operates on a secure, highly available, and governed AWS infrastructure that supports sensitive healthcare operations while ensuring compliance with international privacy standards.

2. Customer Background

SihaTech provides a platform for healthcare professionals to manage patient information, medical records, and workflows securely. The platform stores structured data such as:

  • User profiles
  • Patient metadata
  • Document references
  • Access permissions
  • Audit logs 

As the platform scaled, the organization required a cloud architecture that could:

  • Securely manage sensitive medical data
  • Comply with GDPR/CNDP regulations
  • Support scalable workloads in development and production
  • Provide centralized operational visibility
  • Reduce operational overhead through automation

Atomic Computing was engaged to build a secure, multi-account AWS environment aligned with governance and compliance standards.

3. Customer Challenges

Before the engagement, SihaTech faced multiple infrastructure and governance challenges:

3.1 Security and Compliance
Handling sensitive medical data required robust security and encryption practices. The platform needed full compliance with GDPR and CNDP, including data residency and encryption standards.

3.2 Lack of Centralized Governance
There was a need for a structured multi-account environment to separate development, production, and management workloads while enforcing policies consistently.

3.3 Limited Operational Visibility
Monitoring of infrastructure activity, configuration changes, and potential security threats was insufficient, increasing compliance risk.

3.4 Scalable and Resilient Infrastructure
The platform required high availability, disaster recovery readiness, and support for auto-scaling workloads.

3.5 Operational Efficiency
Manual deployment and management processes increased operational overhead and the risk of misconfiguration. Automation and Infrastructure-as-Code practices were required.

4. Solution Overview

Atomic Computing designed a secure AWS cloud environment for SihaTech focused on governance, compliance, and automation, while ensuring cost efficiency in development environments.

Key components include:

  • Multi-account architecture using AWS Control Tower (Management, Audit, Log Archive, Development, Production)
  • Secure backend infrastructure: ALB, EKS microservices, RDS PostgreSQL Multi-AZ, S3 KMS-encrypted medical files
  • Continuous monitoring and observability using CloudWatch and CloudTrail
  • Centralized access management with least-privilege IAM roles and IAM Identity Center. 

This solution provides a secure, resilient, and scalable environment capable of supporting sensitive healthcare workloads.

5. Solution Architecture

Multi-Account AWS Environment

  • AWS Control Tower deployed for account governance
  • Accounts for Management, Audit/Log Archive, Development, and Production
  • Organizational Units enforce the separation of duties and centralized policies (Security and Sandbox for application).
  • Control Tower guardrails ensure consistent security compliance

Identity and Access Management

  • Centralized IAM roles and policies with least-privilege principles
  • MFA for privileged access
  • Secure role-based access to EKS, RDS, and S3 resources

Application Architecture

  • Frontend: Hosted via AWS Amplify (web app)
  • Backend: Microservices running on Amazon EKS
  • ALB: Public-facing load balancer with path-based routing

Data Storage:

  • Amazon S3 for medical files (KMS-encrypted, versioned, public access blocked)
  • Amazon RDS PostgreSQL Multi-AZ cluster for structured data (user profiles, metadata, audit logs)

Operational Monitoring & Compliance

  • CloudWatch dashboards for EKS and RDS metrics
  • CloudTrail logging for auditability
  • Alerts and notifications configured via SNS
  • Automated backups and performance insights enabled
 

Infrastructure Automation

  • Terraform/IaC templates for repeatable deployments
  • Enables quick redeployment and disaster recovery
  • Consistent configuration across environments

6. Security & Compliance Controls

Preventive Controls

  • KMS encryption for all storage
  • Block public access policies for S3
  • IAM least-privilege policies
 

Detective Controls

  • CloudWatch monitoring and alarms
  • CloudTrail for all API activity
  • Centralized audit logs

Corrective Controls

  • Automatic remediation for misconfigurations
  • Enforcement of encryption for storage

7. Operational Governance

Key metrics tracked include:

MetricDescription
Mean Time to Detection (MTTD)Time to detect potential compliance/security issues
Mean Time to Remediation (MTTR)Time to remediate findings
Compliance DriftDeviations from baseline infrastructure configuration
Security FindingsNumber of open alerts or misconfigurations

These metrics ensure continuous visibility into security posture and operational governance.

8. Business Outcomes

Improved Security Posture

  • Layered security controls and centralized monitoring protect sensitive medical data

Compliance Assurance

  • Alignment with GDPR, CNDP, ISO security best practices, and HIPAA requirements for handling sensitive healthcare and patient data

Operational Efficiency

  • Automation reduces manual effort and configuration drift

Scalable Cloud Platform

  • Supports development and production workloads with controlled costs
  • Frontend deployment via Amplify enables faster feature releases

Improving AWS Security Governance for EHS Tools

Case Studies
ACE ID: 617734733590
Industry: Oil & Gas Industry
Country: Malaysia

Executive Summary

EHS Tools is a Malaysia-based technology provider serving customers in the oil and gas and energy sector through business-critical applications hosted on AWS. As part of its growth strategy and commitment to ISO 27001-aligned security practices, EHS Tools engaged Atomic Computing to assess and strengthen the security posture of its AWS environment.

The engagement began with a comprehensive AWS Well-Architected Framework Review (WAFR), which identified several security, governance, and operational risks, including excessive administrative access, long-lived credentials, public infrastructure exposure, limited environment isolation, and inconsistent access management practices.

Atomic Computing designed and implemented a security-focused modernization program that improved identity governance, reduced attack surface, strengthened infrastructure security, enhanced developer access controls, and established long-term governance standards. The engagement also delivered significant operational and financial benefits, including an estimated 35–45% reduction in monthly AWS costs while improving overall security posture and audit readiness.

Customer Overview

EHS Tools provides digital solutions and operational tooling for organizations in the oil and gas and energy industry. The company’s platform supports business-critical workloads and serves enterprise customers primarily within Malaysia.

The AWS environment consisted of multiple AWS accounts supporting development and production workloads, Amazon ECS clusters, Amazon EC2 instances, Amazon RDS databases, Amazon S3 storage, and supporting cloud-native services. As the platform expanded, EHS Tools required a more structured approach to security, governance, and operational management.

Business Challenge

Atomic Computing’s engagement began with an AWS Well-Architected Framework Review (WAFR) focused on security, operational excellence, and governance.

The review identified approximately 33 high-risk issues across the environment, including:

  • Excessive administrative privileges across engineering teams
  • Long-lived IAM access keys and credential sprawl
  • Human access managed through both IAM users and IAM Identity Center
  • Shared SSH keys and direct server access
  • Publicly accessible infrastructure components
  • Developers with broad access to production resources
  • Limited separation between development and production environments
  • Inconsistent identity and access management practices
  • Lack of standardized governance controls and onboarding processes
  • Opportunities to improve encryption, monitoring, and audit readiness

The customer required a solution that would improve security while maintaining developer productivity and supporting future growth.

Solution Architecture

Identity and Access Governance

Atomic Computing redesigned the customer’s identity and access model to align with AWS security best practices and least-privilege principles.

AWS IAM Identity Center was standardized as the primary method for workforce access, replacing reliance on direct IAM user access. Permission sets were redesigned and aligned with job responsibilities, administrative access was reduced, and MFA enforcement was standardized across the organization.

Custom Service Control Policies (SCPs) were implemented through AWS Organizations to reduce administrative blast radius and restrict access to approved AWS services. Prefix-based and tag-based governance models were also introduced to improve consistency and scalability across environments.

As a result, administrative access was reduced from six users to two, approximately six active access keys were removed, and human access was centralized through Identity Center.

Secure Developer Access

A major objective of the engagement was to modernize developer access while reducing exposure to common attack vectors.

Atomic Computing replaced traditional VPN and SSH-based access methods with AWS Systems Manager Session Manager. Shared SSH keys were eliminated, inbound port 22 access was closed, and secure Session Manager-based access workflows were implemented for developers.

Database access was further secured using Session Manager port forwarding, allowing engineers to connect to private RDS instances without exposing database endpoints publicly.

This approach reduced attack surface, simplified access management, and eliminated the operational burden associated with managing VPN infrastructure and SSH credentials.

Multi-Account Security Architecture

To improve isolation and governance, Atomic Computing helped restructure the AWS environment using a multi-account strategy.

Development and production workloads were separated into dedicated AWS accounts, reducing risk associated with shared environments and aligning the architecture more closely with AWS Security Reference Architecture recommendations.

Cross-account IAM role architecture was implemented to support secure workload communication and administrative operations while maintaining clear security boundaries. Human access was centralized through IAM Identity Center, reducing reliance on local account identities and simplifying governance.

Infrastructure Governance and Automation

Atomic Computing established a governance framework designed to improve consistency, reduce configuration drift, and support future scalability.

The framework included:

  • Standardized naming conventions
  • Mandatory environment tagging
  • Prefix-based governance controls
  • Terraform deployment standards
  • Environment-specific access controls
  • Standardized onboarding procedures for users and workloads

These controls provided a repeatable model for securely deploying and managing infrastructure across multiple AWS accounts.

Secure CI/CD and Container Security

As part of the ongoing engagement, Atomic Computing also worked with EHS Tools to strengthen software delivery security.

Security controls were introduced into CI/CD workflows, including container image scanning, code quality validation through linting, and vulnerability assessment capabilities within Amazon ECR.

These enhancements introduced shift-left security practices into the software delivery lifecycle and improved visibility into application security risks before deployment to production environments.

AWS Services Used

The engagement leveraged several AWS-native security and governance services, including:

  • AWS Organizations
  • AWS IAM Identity Center
  • AWS Identity and Access Management (IAM)
  • AWS Systems Manager Session Manager
  • AWS CloudTrail
  • AWS Access Analyzer
  • AWS Key Management Service (KMS)
  • AWS Secrets Manager
  • AWS Security Hub
  • AWS Config
  • Amazon EC2
  • Amazon ECS
  • Amazon RDS
  • Amazon S3
  • Amazon ECR
  • Amazon CloudWatch
  • AWS Well-Architected Tool

People and Process Transformation

In addition to technical implementation, Atomic Computing worked closely with the EHS Tools engineering team to improve security processes and operational practices.

Multiple security review workshops were conducted to review findings, prioritize remediation activities, and align stakeholders on implementation priorities.

New onboarding standards were introduced for both workforce identities and machine identities. Human access is now provisioned through IAM Identity Center using standardized permission sets, while workloads are encouraged to use IAM roles instead of long-lived credentials.

The engagement also introduced governance standards covering infrastructure deployment, tagging, access management, and environment separation, helping establish a more sustainable operating model.

Results and Business Outcomes

The engagement delivered measurable improvements across security, governance, operational efficiency, and cost optimization.

Security Improvements

  • Administrative users reduced from six to two
  • Approximately six long-lived access keys removed
  • Shared SSH key usage eliminated
  • Direct SSH access removed from workloads
  • Human access centralized through IAM Identity Center
  • Improved production and development environment isolation
  • Reduced attack surface through Session Manager adoption
  • Improved audit readiness supporting ISO 27001 objectives

Well-Architected Outcomes

  • Approximately 33 high-risk issues identified during the WAFR
  • More than 65% of identified findings remediated during the engagement
  • Ongoing remediation tracking process established

Governance Improvements

  • Standardized IAM governance model implemented
  • SCP-based guardrails introduced
  • Multi-account security architecture strengthened
  • Terraform governance standards established
  • Standardized onboarding processes introduced

Operational Benefits

  • VPN infrastructure eliminated
  • Simplified developer access workflows
  • Reduced operational overhead associated with access management
  • Improved consistency across AWS environments

TCO Analysis

As part of the engagement, Atomic Computing conducted a Total Cost of Ownership (TCO) assessment alongside the Well-Architected review.

The assessment identified opportunities to improve infrastructure efficiency while strengthening security controls. Recommendations included infrastructure optimization, storage governance improvements, elimination of VPN-related costs, and improved operational practices.

Prior to the engagement, AWS spend averaged approximately $1,100 USD per month. Following implementation of the recommended security, governance, and optimization initiatives, projected monthly AWS spend was reduced to approximately $700 USD per month.

This represented an estimated cost reduction of approximately 35–45% while simultaneously improving the security posture and operational maturity of the environment.

Lessons Learned

The engagement reinforced several important lessons regarding cloud security and governance.

Early implementation of centralized identity governance significantly reduces long-term security and operational risk. Eliminating long-lived credentials and shared SSH access can dramatically reduce attack surface while improving auditability. Secure access solutions such as Session Manager can improve both security and operational efficiency. Finally, multi-account governance, standardized infrastructure controls, and structured Well-Architected reviews provide a strong foundation for long-term security success.

Conclusion

Through a security-first modernization initiative, Atomic Computing helped EHS Tools transform its AWS security posture, improve governance, modernize developer access, strengthen environment isolation, and establish a scalable operating model aligned with AWS best practices.

The engagement demonstrates how a structured approach combining technical remediation, governance transformation, and process improvement can significantly reduce risk while improving operational efficiency, developer productivity, and overall business outcomes.

Securing the Gateway to Dubai: A Production-Ready AWS Security Foundation

Case Studies

Customer: Time To Say Dubai 

ACE ID: 273354652519

Industry: Consulting / Relocation & Business Setup Services 

Solution Area: Secure AWS Setup, SOC Monitoring, Vulnerability Assessment, and Penetration Testing 

1. Executive Summary

Time To Say Dubai is a consultation platform that supports individuals and businesses with relocation, employment opportunities, visa processes, and company formation services in Dubai. As the organization expanded its digital services, it required a secure, scalable, and production-ready AWS environment capable of protecting customer data, reducing security risk, and supporting continuous monitoring.

Time To Say Dubai partnered with Atomic Computing, an AWS consulting partner specializing in secure cloud architecture, security operations, vulnerability management, and compliance-aligned AWS implementations. Atomic Computing designed and implemented a secure AWS environment supported by preventive, detective, and corrective security controls.

The engagement focused on four major security outcomes: secure AWS setup, continuous SOC monitoring, scheduled penetration testing, and timed vulnerability assessments. Atomic Computing implemented AWS-native security services including AWS Identity and Access Management, AWS Identity Center, AWS CloudTrail, Amazon GuardDuty, AWS Security Hub, AWS Config, Amazon Macie, AWS WAF, AWS KMS, and centralized logging to establish a strong cloud security foundation.

As a result, Time To Say Dubai now operates on a secure and monitored AWS platform with improved visibility, reduced exposure to misconfiguration risks, defined vulnerability assessment cycles, and a structured penetration testing program to validate real-world security posture.

2. Customer Background

Time To Say Dubai provides digital consultation services for individuals and businesses relocating to Dubai or establishing business operations in the UAE. The platform handles customer inquiries, service requests, business setup information, and other sensitive customer-related data.

With increasing digital adoption and growing customer activity, the organization needed an AWS environment that could:

  • Securely support production workloads
  • Protect sensitive customer and business data
  • Enable continuous monitoring of security events
  • Detect and respond to threats quickly
  • Support scheduled vulnerability assessments
  • Validate security controls through periodic penetration testing
  • Reduce operational risk through secure configuration and automation

The customer recognized that a secure cloud foundation was necessary to support growth, maintain customer trust, and reduce exposure to cyber threats.

3. Customer Challenges

Before engaging Atomic Computing, Time To Say Dubai faced several security and operational challenges.


3.1 Need for Secure AWS Setup

The customer required a properly configured AWS environment with secure identity management, network segmentation, encryption, monitoring, and workload protection from the beginning.


3.2 Limited Security Visibility

The organization lacked centralized visibility into AWS account activity, configuration changes, suspicious behavior, and workload-level security events.


3.3 Manual Vulnerability Management

Vulnerability checks were not performed on a defined schedule, increasing the risk that misconfigurations, outdated packages, exposed services, or application weaknesses could remain undetected.


3.4 Lack of Penetration Testing Program

The customer needed a structured and authorized penetration testing process to validate whether vulnerabilities could be exploited and to understand real business impact.


3.5 Need for Continuous SOC Monitoring

The platform required ongoing security monitoring to identify threats, investigate alerts, and support timely incident response.


3.6 Production Readiness and Risk Reduction

The organization needed a secure, scalable, and reliable cloud environment capable of supporting production workloads while minimizing security and operational risk.

4. Solution Overview

Atomic Computing designed and implemented a security-focused AWS environment for Time To Say Dubai. The solution combined secure cloud architecture, continuous monitoring, vulnerability management, and scheduled penetration testing.

The solution included:

  • Secure AWS account and workload setup
  • Identity and access governance using IAM and AWS Identity Center
  • Network security controls using VPC design, security groups, and controlled access paths
  • Data protection using encryption with AWS KMS
  • Centralized logging using AWS CloudTrail and Amazon CloudWatch
  • Threat detection using Amazon GuardDuty
  • Security posture management using AWS Security Hub and AWS Config
  • Sensitive data discovery using Amazon Macie
  • Web application protection using AWS WAF
  • Scheduled vulnerability assessments
  • Authorized penetration testing cycles
  • SOC monitoring and alert triage procedures
  • Remediation guidance and security reporting

This approach helped Time To Say Dubai move from a basic cloud deployment model to a security-led operating model with continuous visibility and recurring validation.

5. Solution Architecture

The AWS environment was designed using security best practices and operational monitoring principles.


5.1 Secure AWS Account Setup

Atomic Computing implemented a secure AWS foundation that included:

  • Separation of production and non-production environments
  • Centralized logging and monitoring configuration
  • Secure IAM role design
  • Multi-factor authentication for privileged access
  • Least-privilege permission policies
  • Encryption for sensitive storage and workloads
  • Controlled administrative access
  • Baseline security guardrails

This ensured that the AWS environment was production-ready and aligned with secure cloud operating practices.


5.2 Identity and Access Management

Access to AWS resources was secured using:

  • AWS IAM roles mapped to job responsibilities
  • AWS Identity Center for centralized access management
  • Permission sets based on least privilege
  • Multi-factor authentication for privileged users
  • Periodic access review procedures
  • Removal of unnecessary permissions and inactive access

These controls reduced the risk of unauthorized access and privilege misuse.

5.3 Network and Workload Security

Atomic Computing implemented network-level security controls to reduce exposure and protect workloads. These included:

  • Secure VPC design
  • Restricted inbound and outbound access
  • Security group hardening
  • Controlled administrative access
  • Segmentation between public and private resources
  • Review of exposed ports and services
  • Secure configuration of production workloads

Where applicable, AWS WAF was used to provide additional protection for web-facing applications against common web attacks.

5.4 Centralized Logging and Monitoring

Security logging was implemented across the AWS environment using:

  • AWS CloudTrail for account and API activity
  • Amazon CloudWatch for operational and security logs
  • AWS Config for configuration tracking
  • Security Hub for centralized security findings
  • GuardDuty for threat detection

This provided centralized visibility into security events, infrastructure changes, and suspicious activity.

5.5 SOC Monitoring

Atomic Computing implemented SOC monitoring procedures to support ongoing security operations. The SOC monitoring process included:

  • Monitoring GuardDuty, Security Hub, CloudTrail, CloudWatch, and AWS Config findings
  • Reviewing suspicious login activity and unusual API behavior
  • Identifying exposed services and misconfigurations
  • Tracking high-severity alerts
  • Escalating incidents based on severity
  • Maintaining investigation and remediation records
  • Producing periodic security posture reports

SOC monitoring helped the customer detect threats faster and maintain operational awareness across the AWS environment.

6. Vulnerability Assessment and Penetration Testing

Atomic Computing established a structured vulnerability management and penetration testing approach for Time To Say Dubai.


6.1 Timed Vulnerability Assessments

Timed vulnerability assessments were scheduled to identify weaknesses across infrastructure, cloud configuration, and application-facing components.

The assessment process included:

  • Reviewing AWS configuration risks
  • Identifying publicly exposed resources
  • Checking for open ports and insecure network access
  • Reviewing IAM permissions and privilege risks
  • Identifying unencrypted storage or misconfigured data services
  • Reviewing web application exposure
  • Producing vulnerability findings with severity ratings
  • Providing remediation recommendations
  • Re-testing remediated findings where required

Assessments were performed on a defined schedule to ensure that security risks were identified regularly rather than only during major changes or incidents.

6.2 Scheduled Penetration Testing

Atomic Computing implemented an authorized penetration testing program to validate the real-world security posture of Time To Say Dubai’s web-facing environment.

The penetration testing process included:

  • Defining scope and authorization boundaries
  • Identifying approved targets and testing windows
  • Conducting reconnaissance of in-scope assets
  • Testing web application vulnerabilities
  • Validating exploitable misconfigurations
  • Assessing authentication and access control weaknesses
  • Testing for common OWASP risks
  • Evaluating business impact of validated findings
  • Documenting evidence and proof of exploitability
  • Delivering a final penetration testing report
  • Supporting remediation and revalidation

This allowed the customer to move beyond basic vulnerability identification and understand which risks could be exploited in practice.

6.3 Vulnerability and PT Reporting

Atomic Computing provided structured reporting that included:

  • Executive summary
  • Technical findings
  • Risk ratings
  • Evidence and screenshots where applicable
  • Affected assets
  • Business impact
  • Remediation steps
  • Retest status
  • Prioritized action plan

Reports were designed to support both technical remediation and management-level risk visibility.

7. Security and Compliance Controls

The solution incorporated preventive, detective, and corrective security controls.


7.1 Framework Alignment

The environment and security processes were aligned with industry-recognized standards and best practices, including:

  • AWS Well-Architected Security Pillar
  • CIS AWS Foundations Benchmark
  • ISO 27001 security control principles
  • SOC 2 security and availability principles
  • OWASP web application security practices

7.2 Preventive Controls

Preventive controls were implemented to reduce the likelihood of security incidents.

Examples include:

  • Least-privilege IAM access
  • Multi-factor authentication for privileged accounts
  • S3 Block Public Access
  • Encryption using AWS KMS
  • Restricted security group rules
  • AWS WAF protections for web-facing applications
  • Secure network segmentation
  • Controlled administrative access

7.3 Detective Controls

Detective controls were implemented to identify threats, misconfigurations, and suspicious activity.

Examples include:

  • GuardDuty threat detection
  • Security Hub findings aggregation
  • AWS Config compliance checks
  • CloudTrail activity monitoring
  • CloudWatch log monitoring
  • Macie sensitive data discovery
  • SOC alert review and escalation

7.4 Corrective Controls

Corrective controls were implemented to support timely remediation.

Examples include:

  • Removing public access from exposed storage
  • Restricting overly permissive security groups
  • Enforcing encryption on storage resources
  • Disabling unnecessary access keys
  • Updating vulnerable packages and services
  • Remediating application vulnerabilities discovered during testing
  • Revalidating fixes after remediation

8. Operational Security Governance

Atomic Computing implemented an operational security governance model to maintain the customer’s security posture over time.

The governance model included:

  • Scheduled vulnerability assessments
  • Scheduled penetration testing
  • Continuous SOC monitoring
  • Security alert triage
  • Incident escalation procedures
  • Remediation tracking
  • Periodic access reviews
  • Security posture reporting
  • Cloud configuration reviews
  • Continuous improvement recommendations

    Key operational metrics included:

Metric Description
Mean Time to Detection Time taken to detect a security issue or suspicious event
Mean Time to Triage Time taken to review and classify an alert
Mean Time to Remediation Time taken to resolve confirmed security findings
Vulnerability Closure Rate Percentage of vulnerabilities remediated within the agreed timeline
Critical Finding Count Number of critical findings identified during assessments
Recurring Finding Rate Number of repeated issues found across assessments
Penetration Test Remediation Status Status of fixes for validated exploitable findings
Compliance Drift Resources that deviate from approved security configuration


This governance model helped ensure that security remained an ongoing operational discipline rather than a one-time implementation activity.

9. Business Outcomes

The solution delivered measurable security and operational benefits for Time To Say Dubai.

9.1 Secure Production Environment

The customer now operates on a secure AWS environment with hardened identity, network, logging, monitoring, and encryption controls.

9.2 Improved Threat Visibility

SOC monitoring provides continuous visibility into suspicious activity, misconfigurations, and high-risk security events.

9.3 Reduced Vulnerability Exposure

Timed vulnerability assessments help identify and remediate risks on a regular schedule.

9.4 Validated Security Posture

Scheduled penetration testing validates whether vulnerabilities are exploitable and helps the customer understand real-world business impact.

9.5 Faster Response and Remediation

Centralized findings, SOC workflows, and remediation tracking improve response times and reduce manual effort.

9.6 Increased Customer Trust

Stronger security controls and recurring validation improve confidence in the platform’s ability to protect customer data.

10. Results and Impact

Through the engagement with Atomic Computing, Time To Say Dubai achieved:

  • A secure and production-ready AWS setup
  • Centralized cloud security monitoring
  • Defined SOC monitoring and alert triage processes
  • Scheduled vulnerability assessment cycles
  • Authorized penetration testing procedures
  • Improved visibility into cloud risks and threats
  • Reduced risk from misconfiguration and exposed services
  • Stronger protection of customer data
  • Better alignment with AWS security best practices and industry frameworks
  • A scalable security operating model for future growth

The customer is now better positioned to expand its digital services while maintaining a strong security posture.

11. Conclusion

The collaboration between Time To Say Dubai and Atomic Computing demonstrates how an AWS security consulting engagement can help a growing digital business establish secure cloud operations.

Atomic Computing delivered a secure AWS setup supported by centralized monitoring, vulnerability management, scheduled penetration testing, and SOC-driven operational oversight. The solution helped Time To Say Dubai reduce cloud security risk, improve visibility, validate security controls, and protect customer data.

By combining AWS-native security services with structured security operations and recurring assessments, Atomic Computing enabled Time To Say Dubai to operate with greater confidence, resilience, and readiness for future growth.

Houdiny AI Strengthens Digital Sovereignty and Secure Cloud Operations on AWS

Case Studies

Client: Houdiny AI

Domain: Digital Sovereignty

Pattern: Secure Cloud Governance, Compliance, and Automated Remediation on AWS

1. Customer Background

Houdiny AI is an AI-powered lead outreach assistant platform that enables enterprises to automate and optimize sales engagement processes.

With rapid growth and increasing demand for secure, compliant cloud services, Houdiny AI required a digitally sovereign, production-ready AWS environment capable of scaling, maintaining operational resilience, and ensuring compliance with strict regulatory and organizational directives.

The organization needed a cloud foundation that could:

  • Enforce data residency and sovereignty across all accounts

  • Protect sensitive data including PII, PHI, and confidential datasets

  • Monitor and remediate compliance violations automatically

  • Provide audit-ready evidence aligned with ISO 27001 and SOC 2

  • Enable structured risk management for operational deviations

2. Customer Challenges

Before partnering with Atomic Computing, Houdiny AI faced several key challenges:

  • Limited Digital Sovereignty Controls: No mechanisms to enforce region-bound data residency or prevent cross-jurisdiction data transfer.

  • Operational and Compliance Visibility Gaps: Difficulty tracking MTTD, MTTI, MTTR, and non-compliant resources.

  • Manual Remediation Processes: Non-compliant resources required manual intervention, increasing risk and operational overhead.

  • Audit Readiness Complexity: Collecting and validating evidence for ISO 27001 and SOC 2 audits was time-consuming.

  • Incident Response Delays: Security incidents lacked standardized detection, classification, and remediation workflows.

3. Solution Overview

Atomic Computing designed and deployed a digitally sovereign AWS environment, integrating governance, compliance, and automated remediation.

Key solution highlights include:

  1. Multi-Account AWS Environment: Implemented AWS Control Tower to organize accounts into production, non-production, and security/logging units, providing centralized governance.

  2. Continuous Compliance Monitoring: Leveraged AWS Config, Security Hub, GuardDuty, and CloudWatch to track compliance, detect anomalies, and report operational metrics (MTTD, MTTI, MTTR).

  3. Automated Remediation: Used Terraform-managed runbooks and Lambda scripts to resolve non-compliant resources, including IAM policies, S3 buckets, RDS encryption, and security group misconfigurations.

  4. Structured Risk Management: Centralized tracking and reporting of non-compliant resources, operational deviations, security misconfigurations, and data residency breaches, with auditable evidence stored in versioned S3 buckets.

  5. Audit Automation: Automated evidence collection for resource configuration, API activity, compliance aggregation, and reporting using AWS Config, CloudTrail and Security Hub..

  6. Incident Response SOPs: Defined processes for detection, classification, notification, containment, remediation, root cause analysis, and post-incident review.

4. Solution Architecture

The architecture is built on a governance-first, digitally sovereign approach.

  • Identity and Access Management: Least-privilege IAM roles, multi-factor authentication, and centralized AWS Identity Center permissions.

  • Network and Data Protections: Data residency enforced via AWS Config and Service Control Policies (SCPs), sensitive data encrypted at-rest, in-transit, and during compute (using Nitro Enclaves).

  • Compliance Monitoring and Remediation: Continuous monitoring of compliance status, with automated remediation for misconfigurations, non-compliant policies, and unencrypted resources.

  • Audit Readiness: Centralized logging via CloudTrail and Security Hub, with automated aggregation, reporting, and evidence retention.

  • Operational Runbooks: Terraform and Lambda-based automation ensures rapid, reliable remediation while reducing manual error.

5. Compliance Metrics Tracked

Metric Definition AWS Service / Tool Frequency
Mean Time to Detection (MTTD) Time to detect compliance violations Config, Security Hub, CloudWatch, GuardDuty Continuous, real-time
Mean Time to Identification (MTTI) Time to identify root cause Security Hub correlation, CloudTrail Real-time & post-event
Mean Time to Remediation (MTTR) Time from detection to remediation Config Rules + Lambda runbooks, EventBridge Automated/manual per resource
Non-Compliance Count Number of resources out-of-compliance Config, Security Hub Continuous dashboard
Audit Readiness Score % evidence automatically collected & validated Audit Manager, Config, CloudTrail Continuous, quarterly summary
Incident Response SLA Compliance % security incidents resolved within SLA CloudWatch, Security Hub, Trello dashboards & tickets Monthly reporting

Outcome: Provides continuous visibility into compliance posture, operational risks, and audit readiness aligned with ISO 27001 and SOC 2.

6. Operational Outcomes

Houdiny AI achieved measurable improvements:

  • Continuous Compliance: Automated detection and remediation of non-compliant resources across all accounts.

  • Operational Transparency: MTTD, MTTI, MTTR, and non-compliance metrics tracked and reported.

  • Risk Mitigation: Structured risk management of security misconfigurations, compliance violations, operational deviations, and data residency breaches.

  • Audit Readiness: Automated evidence collection and reporting enables defensible, ISO 27001 and SOC 2-aligned audits.

  • Incident Response: SOP ensures rapid containment, remediation, and reporting of security events.

7. AWS Services Used

  • Governance & Identity: AWS Control Tower, IAM, AWS Identity Center

  • Security & Compliance: AWS Config, Security Hub, GuardDuty, Amazon Macie, AWS KMS, Nitro Enclaves, Service Control Policies (SCPs)

  • Automation & Remediation: Terraform, Lambda, EventBridge

  • Monitoring & Logging: CloudTrail, CloudWatch, Security Hub dashboards

8. Conclusion

The collaboration between Houdiny AI and Atomic Computing demonstrates how digital sovereignty and automated operational governance can be achieved on AWS.

Through a combination of continuous compliance monitoring, automated remediation, structured risk management, and incident response SOPs, Atomic Computing delivered a secure, scalable, and audit-ready cloud environment.

Houdiny AI can now confidently scale its AI-powered platform while maintaining operational sovereignty, data protection, and compliance with international security standards.

Time-To-Say Dubai Achieves Sovereign-Ready Architecture on AWS: Data Residency, Egress Control, and Continuous Compliance

Case Studies

Domain: AWS Digital Sovereignty
Pattern: Data Residency, Egress Control, Data Protection, and Continuous Compliance across Multi-Account AWS Environment

1. Customer Background

Time To Say Dubai is a digital consultation platform helping individuals and businesses relocate to Dubai, providing employment guidance, visa assistance, and company formation support.

With rapid adoption of digital services and a growing user base, the organization required a cloud environment that could:

  • Enforce strict data residency and access controls
  • Protect sensitive customer data
  • Ensure continuous compliance with international and regional regulatory frameworks
  • Provide centralized visibility into infrastructure security
  • Scale securely to support production workloads while reducing operational overhead

2. Challenges

Prior to partnering with Atomic Computing, Time To Say Dubai faced several challenges:

  • Lack of Data Residency Controls: There were no mechanisms to ensure workloads and data remained within approved regions.
  • Limited Egress and Network Visibility: Outbound traffic was unmanaged, increasing risk of unauthorized data transfer.
  • Data Protection and Privacy Risks: Sensitive customer information required stronger encryption, access control, and monitoring.
  • Manual Compliance Tracking: No automated monitoring for configuration drift, misconfigurations, or audit readiness.
  • Audit and Regulatory Readiness: Processes were largely reactive, making alignment with frameworks like ISO 27001, SOC 2, CIS Benchmarks, and GDPR challenging.

3. Solution – Aligned Against Digital Sovereignty Competency Pillars

1. Secure Multi-Account AWS Environment

  • Deployed AWS Control Tower to create staging, production, and security/logging accounts under centralized governance.
  • Applied preventative guardrails for region restrictions, mandatory encryption, and least-privilege IAM access.

2. Data Residency and Privacy Controls

  • Enforced strict controls to ensure data remains in approved jurisdictions.
  • Applied defense-in-depth strategy for sensitive data: encryption at-rest, in-transit, and during compute (using AWS Nitro Enclaves).
  • Field-level protection and access control for PII, PHI, and confidential datasets using Amazon Macie, AWS KMS, and IAM.

3. Network Egress and Secure Connectivity

  • Centralized outbound traffic through inspection VPCs using AWS Network Firewall and Route 53 Resolver DNS Firewall.
  • Applied allowlists for approved domains/IPs and blocked unauthorized traffic.
  • AWS PrivateLink used for private connectivity to services, minimizing public internet exposure.

4. Continuous Compliance Monitoring

  • AWS Config rules monitor resources against frameworks including ISO 27001, SOC 2, CIS Benchmarks, GDPR, and NIST 800-53.
  • AWS Security Hub aggregates findings from GuardDuty, Inspector, and Config, triggering automated remediation where needed.
  • Compliance dashboards track drift, violations, and access misconfigurations.

5. Identity and Access Governance

  • Least-privilege access enforced with role-based policies and AWS Identity Center SSO.
  • Multi-factor authentication and privileged access separation implemented.
  • Continuous detection and remediation of access misconfigurations using IAM Access Center and Config.

6. Audit and Operational Readiness

  • Audit-ready architecture with documented control mappings, scope definitions, and risk registers.
  • Continuous monitoring ensures readiness for internal and external audits aligned with regulatory and sovereignty requirements.

4. Quantitative Business Impact

Metric Before Implementation After Implementation
Data Residency Enforcement Manual, policy-only Enforced through AWS controls across regions
Outbound Traffic Control Unmonitored Centralized inspection and allowlist model
Security Findings Response Manual Automated detection and remediation
Compliance Visibility Limited Continuous monitoring across all accounts
Access Governance Ad-hoc Least-privilege, multi-factor, continuously monitored

5. Outcomes

  • Sovereign Cloud Environment: Full control over data location, egress, and access.
  • Improved Security Posture: Layered preventive, detective, and corrective controls protect sensitive data.
  • Continuous Compliance: Alignment with ISO 27001, SOC 2, CIS Benchmarks, GDPR, and NIST 800-53.
  • Operational Efficiency: Automation reduces manual remediation effort.
  • Scalable Infrastructure: AWS environment supports growth while maintaining governance.
  • Audit Readiness: Centralized logging, control mapping, and compliance dashboards ensure regulatory and audit readiness.

6. AWS Services Used

  • Governance & Identity: AWS Control Tower, AWS Organizations, AWS Identity Center (SSO), IAM
  • Security & Compliance: AWS Config, Security Hub, AWS Identity Center, GuardDuty, Amazon Macie, AWS Network Firewall, AWS KMS
  • Automation & Monitoring: CloudTrail, CloudWatch, Infrastructure-as-Code (Terraform/CloudFormation)

7. Conclusion

The collaboration between Time To Say Dubai and Atomic Computing demonstrates how a governance-first, digital sovereignty-focused cloud architecture can strengthen security, compliance, and operational efficiency.

Through the implementation of strong data residency controls, network egress management, automated monitoring, and layered data protection, Atomic Computing delivered a secure, scalable, and sovereign-ready AWS environment.

Time To Say Dubai can now confidently scale digital services while maintaining operational governance, regulatory alignment, and customer trust.

Secure, Compliant Healthcare on AWS: A Governance-First Transformation for SihaTech

Case Studies

Customer: SihaTech
Partner: Atomic Computing

Industry: Digital Health / Patient Data Management
Solution Area: Secure, Compliant, and Scalable Cloud Infrastructure on AWS

1. Executive Summary

SihaTech is a digital health platform that manages sensitive medical records, patient data, and healthcare workflows. With growing adoption and increasing regulatory requirements (GDPR, CNDP), SihaTech needed a secure, compliant, and scalable cloud infrastructure capable of protecting sensitive medical data while maintaining high availability and operational efficiency.

To meet these requirements, SihaTech partnered with Atomic Computing, leveraging AWS best practices for governance, security, and automation. The solution utilizes services including AWS Amplify, Amazon EKS, ALB, RDS (PostgreSQL Multi-AZ), S3 with KMS encryption, and ECR, providing a secure, compliant, and cost-efficient environment for development and production workloads.

As a result, SihaTech now operates on a secure, highly available, and governed AWS infrastructure that supports sensitive healthcare operations while ensuring compliance with international privacy standards.

2. Customer Background

SihaTech provides a platform for healthcare professionals to manage patient information, medical records, and workflows securely. The platform stores structured data such as:

  • User profiles
  • Patient metadata
  • Document references
  • Access permissions
  • Audit logs

As the platform scaled, the organization required a cloud architecture that could:

  • Securely manage sensitive medical data
  • Comply with GDPR and CNDP regulations
  • Support scalable workloads in development and production
  • Provide centralized operational visibility
  • Reduce operational overhead through automation

Atomic Computing was engaged to build a secure, multi-account AWS environment aligned with governance and compliance standards.

3. Customer Challenges

Before the engagement, SihaTech faced multiple infrastructure and governance challenges:

3.1 Security and Compliance
 Handling sensitive medical data required robust security and encryption practices. The platform needed full compliance with GDPR and CNDP, including data residency and encryption standards.

3.2 Lack of Centralized Governance
 There was a need for a structured multi-account environment to separate development, production, and management workloads while enforcing policies consistently.

3.3 Limited Operational Visibility
Monitoring of infrastructure activity, configuration changes, and potential security threats was insufficient, increasing compliance risk.

3.4 Scalable and Resilient Infrastructure
 The platform required high availability, disaster recovery readiness, and support for auto-scaling workloads.

3.5 Operational Efficiency
 Manual deployment and management processes increased operational overhead and the risk of misconfiguration. Automation and Infrastructure-as-Code practices were required.

4. Solution Overview

Atomic Computing designed a secure AWS cloud environment for SihaTech focused on governance, compliance, and automation, while ensuring cost efficiency in development environments.

Key components include:

  • Multi-account architecture using AWS Control Tower (Management, Audit, Log Archive, Development, Production)
  • Secure backend infrastructure: ALB, EKS microservices, RDS PostgreSQL Multi-AZ, S3 KMS-encrypted medical files
  • Continuous compliance and monitoring using CloudWatch and CloudTrail
  • Infrastructure-as-Code for repeatable, consistent deployments
  • Centralized access management with least-privilege IAM roles

This solution provides a secure, resilient, and scalable environment capable of supporting sensitive healthcare workloads.

5. Solution Architecture

Multi-Account AWS Environment

  • AWS Control Tower deployed for account governance
  • Accounts for Management, Audit/Log Archive, Development, and Production
  • Organizational Units enforce separation of duties and centralized policies
  • Control Tower guardrails ensure consistent security compliance

Identity and Access Management

  • Centralized IAM roles and policies with least-privilege principles
  • MFA for privileged access
  • Secure role-based access to EKS, RDS, and S3 resources

Application Architecture

  • Frontend: Hosted via AWS Amplify (web app)
  • Backend: Microservices running on Amazon EKS
  • ALB: Public-facing load balancer with path-based routing
  • Data Storage:
    • Amazon S3 for medical files (KMS-encrypted, versioned, public access blocked)
    • Amazon RDS PostgreSQL Multi-AZ cluster for structured data (user profiles, metadata, audit logs)

Operational Monitoring & Compliance

  • CloudWatch dashboards for EKS and RDS metrics
  • CloudTrail logging for auditability
  • Alerts and notifications configured via SNS
  • Automated backups and performance insights enabled

Infrastructure Automation

  • Terraform/IaC templates for repeatable deployments
  • Enables quick redeployment and disaster recovery
  • Consistent configuration across environments

6. Security & Compliance Controls

Preventive Controls

  • KMS encryption for all storage
  • Block public access policies for S3
  • IAM least-privilege policies

Detective Controls

  • CloudWatch monitoring and alarms
  • CloudTrail for all API activity
  • Centralized audit logs

Corrective Controls

  • Automatic remediation for misconfigurations
  • Enforcement of encryption for storage
  • Alerts on unauthorized access attempts

7. Operational Governance

Key metrics tracked include:

Metric Description
Mean Time to Detection (MTTD) Time to detect potential compliance/security issues
Mean Time to Remediation (MTTR) Time to remediate findings
Compliance Drift Deviations from baseline infrastructure configuration
Security Findings Number of open alerts or misconfigurations

These metrics ensure continuous visibility into security posture and operational governance.

8. Business Outcomes

Improved Security Posture

  • Layered security controls and centralized monitoring protect sensitive medical data

Compliance Assurance

  • GDPR and CNDP alignment achieved
  • RDS Multi-AZ ensures high availability and fault tolerance

Operational Efficiency

  • Automation reduces manual effort and configuration drift

Scalable Cloud Platform

  • Supports development, testing, and production workloads with controlled costs
  • Frontend deployment via Amplify enables faster feature releases

9. Conclusion

The collaboration between SihaTech and Atomic Computing demonstrates how a governance-first, secure AWS architecture can enable sensitive healthcare platforms to operate safely, efficiently, and compliantly.

By implementing multi-account governance, centralized monitoring, IaC-based deployment, and layered security controls, Atomic Computing delivered a secure, scalable, and compliant AWS environment that supports SihaTech’s mission of managing patient data and healthcare workflows while maintaining regulatory compliance.

Governance-First AWS Transformation: Strengthening Security and Scalability for JobsForNationals

Case Studies

Customer: JobsForNationals
Partner: Atomic Computing

Industry: Digital Employment Platform / Government Workforce Enablement
Solution Area: Secure Cloud Governance & Digital Sovereignty on AWS

1. Executive Summary

JobsForNationals is a digital employment platform designed to connect national job seekers with employment opportunities across multiple sectors. As the platform scaled to support increasing user demand, it required a secure, compliant, and highly governed cloud environment capable of protecting sensitive user data while maintaining operational resilience.

To address these requirements, JobsForNationals partnered with Atomic Computing, an AWS consulting partner specializing in secure and compliant cloud infrastructure. Atomic Computing designed and implemented a governance-first cloud architecture aligned with digital sovereignty principles, ensuring strict control over data, infrastructure operations, and compliance monitoring.

The solution leverages AWS services including AWS Control Tower, AWS Config, AWS Security Hub, AWS CloudTrail, and automated Infrastructure-as-Code deployments using Terraform.

As a result, JobsForNationals now operates on a secure, scalable, and continuously governed AWS environment capable of supporting production workloads while maintaining compliance with international security standards and digital sovereignty requirements.


2. Customer Background

JobsForNationals is a workforce enablement platform designed to help national citizens find employment opportunities across various industries. The platform provides services such as job listings, application management, and employer engagement through digital channels.

With the rapid growth of the platform and increasing reliance on cloud infrastructure, the organization required a modern cloud architecture capable of supporting secure operations while maintaining strong governance over sensitive employment data.

The organization required a cloud environment that could:

  • Support scalable production workloads
  • Protect sensitive citizen and employment data
  • Maintain compliance with security and governance standards
  • Provide centralized operational visibility
  • Automate infrastructure deployment and recovery

To meet these requirements, JobsForNationals partnered with Atomic Computing to build a secure cloud foundation based on governance and automation.


3. Customer Challenges

Prior to the engagement with Atomic Computing, the organization faced several infrastructure and governance challenges.

3.1 Lack of Structured Cloud Governance

The organization required a centralized governance framework capable of enforcing security policies and operational controls across multiple cloud accounts.

3.2 Security and Compliance Requirements

Because the platform handles sensitive employment and personal data, the infrastructure needed to align with internationally recognized security frameworks such as:

  • ISO 27001
  • CIS AWS Foundations Benchmark
  • NIST security controls


3.3 Limited Infrastructure Visibility

The organization required improved monitoring and visibility into infrastructure activity, configuration changes, and potential security threats.


3.4 Need for Scalable Production Infrastructure

The platform required a resilient cloud architecture capable of supporting production workloads while ensuring high availability and disaster recovery readiness.


3.5 Operational Efficiency

Manual infrastructure configuration and monitoring processes increased operational overhead and created risks related to configuration drift.

The organization required automation and Infrastructure-as-Code practices to improve operational efficiency.


4. Solution Overview

Atomic Computing designed and implemented a secure AWS cloud foundation for JobsForNationals focused on governance, automation, and continuous compliance.

The solution incorporates preventive, detective, and corrective security controls while ensuring infrastructure consistency through Infrastructure-as-Code.

Key components of the solution include:

  • Multi-account AWS environment using Control Tower
  • Centralized identity and access governance
  • Continuous configuration monitoring
  • Centralized logging and audit visibility
  • Automated remediation of non-compliant resources
  • Infrastructure deployment and disaster recovery using Terraform

This architecture provides a secure and scalable environment capable of supporting production workloads while maintaining governance and operational control.


5. Solution Architecture

The JobsForNationals environment was built using a multi-account architecture aligned with AWS governance best practices.


Multi-Account AWS Environment

Atomic Computing deployed a multi-account architecture using AWS Control Tower.

The environment includes dedicated accounts for:

  • Management account
  • Security and logging account
  • Staging environment
  • Production environment

Accounts are organized into Organizational Units to ensure separation of duties and centralized governance.

Control Tower guardrails enforce security controls across all accounts.


Identity and Access Management

Access to AWS resources is managed using a centralized identity management framework.

Key components include:

  • Least privilege IAM policies
  • Role-based access controls
  • Multi-factor authentication for privileged users
  • Centralized identity management using AWS IAM Identity Center

This approach ensures secure and auditable access to cloud resources.


Continuous Compliance Monitoring

Continuous compliance monitoring is implemented using AWS Config.

AWS Config tracks resource configurations and evaluates them against predefined compliance rules.

Security findings are aggregated using AWS Security Hub, providing a centralized view of infrastructure security posture.


Centralized Logging and Audit

All AWS API activity is captured using AWS CloudTrail.

CloudTrail provides:

  • complete audit trail of API activity
  • traceability of configuration changes
  • evidence collection for compliance and audit activities

Logs are stored securely and retained for audit and governance purposes.


Infrastructure Automation

Infrastructure provisioning and disaster recovery processes are implemented using Terraform-based Infrastructure-as-Code.

This enables:

  • repeatable infrastructure deployments
  • consistent configuration across environments
  • automated disaster recovery procedures

Infrastructure components such as networking, compute resources, and security configurations can be redeployed rapidly if required.


6. Security and Compliance Controls

The JobsForNationals environment incorporates multiple security controls aligned with industry frameworks.


Compliance Framework Alignment

The architecture aligns with several widely adopted security frameworks:

  • ISO 27001
  • CIS AWS Foundations Benchmark
  • NIST security controls

These frameworks guided the implementation of governance policies, monitoring mechanisms, and operational controls.


Preventive Controls

Preventive controls are implemented to prevent security misconfigurations before they occur.

Examples include:

  • Service Control Policies restricting resource deployment to approved regions
  • Mandatory encryption policies for storage resources
  • IAM policies enforcing least privilege access
  • Block public access policies for S3 storage


Detective Controls

Detective controls continuously monitor the environment for potential security issues.

Examples include:

  • AWS Config rules monitoring configuration compliance
  • Security Hub aggregating security findings
  • Continuous infrastructure monitoring


Corrective Controls

Corrective controls enable automated remediation of security issues.

Examples include:

  • removal of public access from storage resources
  • remediation of overly permissive security groups
  • re-enabling disabled logging services
  • enforcing encryption for storage resources


7. Operational Governance

Atomic Computing implemented an operational governance framework to maintain continuous compliance.

Key compliance metrics tracked include:

Metric Description
Mean Time to Detection (MTTD) Average time to detect compliance violations
Mean Time to Identification (MTTI) Time required to identify root cause of issues
Mean Time to Remediation (MTTR) Time taken to fully remediate security findings
Compliance Drift Resources deviating from baseline configuration
Security Findings Number of open security findings

These metricure.


8. Business Outcomes

The implemented solution delivers help the organization maintain continuous visibility into its security posted significant improvements for JobsForNationals.

Improved Security Posture

The environment now includes layered security controls, centralized monitoring, and automated remediation workflows.


Continuous Compliance

The organization can maintain alignment with international security frameworks and governance requirements.


Operational Efficiency

Infrastructure automation reduced manual operational effort and minimized configuration drift.


Scalable Cloud Platform

The architecture supports growth while maintaining governance and security controls.


Improved Data Protection

Strong security controls protect sensitive citizen and employment data processed by the platform.


9. Results and Impact

By implementing a secure and governed AWS environment, JobsForNationals achieved:

  • A production-ready AWS platform aligned with governance best practices
  • Continuous monitoring and compliance enforcement
  • Reduced operational overhead through automation
  • Improved visibility into infrastructure security
  • A scalable infrastructure capable of supporting platform growth


10. Conclusion

The collaboration between JobsForNationals and Atomic Computing demonstrates how a governance-first cloud architecture can strengthen security, compliance, and operational resilience.

By implementing automated governance controls, continuous monitoring, and Infrastructure-as-Code practices, Atomic Computing delivered a secure and scalable AWS environment that supports JobsForNationals’ mission of enabling employment opportunities through digital platforms.

The platform now operates on a resilient cloud foundation capable of supporting future growth while maintaining strong governance, compliance, and digital sovereignty principles.

In2 Scales Securely with AWS Cloud Operations: Governance, Observability, Compliance, and Financial Optimization

Case Studies

AWS Cloud Operations Competency 
Client: In2
Domain: AWS Cloud Operations
Pattern: Governance, Compliance, Observability, and Operations with AWS CloudOps across Multi-Account Setup

1. Executive Summary

In2, a rapidly growing consultancy and solutions provider, required a secure, governed, and production-ready AWS environment to host its digital workloads. Their previous infrastructure lacked governance, automation, and observability, leading to operational inefficiencies and compliance risks.

With the expertise of Atomic Computing, In2 adopted a multi-account AWS Control Tower landing zone, implemented infrastructure automation via Terraform, enhanced monitoring with CloudWatch, and deployed robust compliance guardrails with AWS Config and CloudTrail.

This modernization enabled In2 to achieve scalable operations, proactive monitoring, and continuous compliance, while aligning with AWS Cloud Operations Competency pillars.

2. Challenges

Before migration, In2 faced several hurdles:

  • Limited Governance: No structured multi-account framework or automated controls.
  • Manual Deployments: Infrastructure changes were time-consuming and prone to human error.
  • Weak Observability: Minimal logging and monitoring across workloads.
  • Compliance Gaps: Lack of audit-ready records for configuration and activity tracking.
  • Operational Inefficiency: No automation for patching or operational tasks.

3. Solution – Aligned against CloudOps Competency Pillars

1. Cloud Governance Controls

  • Deployed AWS Control Tower Landing Zone with dedicated Management, Staging, and Production accounts.
  • Enabled Control Tower Managed Guardrails for baseline security and governance:
    • Detective Guardrails: Detect public S3 buckets, unrestricted SSH/RDP access, root user activity.
    • Preventive Guardrails: Prevent deletion of centralized CloudTrail logs, enforce MFA for root accounts, enforce encryption at rest for RDS.
  • Governance extended with custom Service Control Policies (SCPs) to restrict region usage and ensure tagging compliance.

2. Financial Management Practices

  • Consolidated billing enabled with AWS Organizations, providing a single view of spend across staging and production.
  • Cost allocation tags (environment, workload, owner) activated for granular tracking.
  • AWS Budgets with cost anomaly detection and alerts configured, ensuring proactive financial governance.
  • Weekly Billing Alerts in Slack using custom implementation of AWS Lambda Function, Cost Explorer API and Webhook APIs.

3. Monitoring and Observability Solutions

  • Amazon CloudWatch Metrics & Alarms configured for EC2, RDS, and ALB.
  • CloudWatch Logs Insights used for centralized application and infrastructure log analysis.
  • VPC Flow Logs enabled for network visibility.
  • CloudTrail continuously records API activity for security investigations.
  • Proactive alerting with SNS notifications, reducing downtime risks.

4. Compliance and Auditing Capabilities

  • AWS Config enabled across all accounts to track configuration drift.
  • Key AWS Config Rules applied:
    • restricted-ssh – Detect unrestricted SSH access.
    • rds-storage-encrypted – Ensure encryption of database storage.
    • iam-user-mfa-enabled – Enforce MFA for IAM users.
  • Compliance data aggregated and retained centrally in a Log Archive S3 bucket.
  • Quarterly compliance reports generated via AWS Config conformance packs.

5. Operations Management Processes

  • Terraform adopted for IaC to standardize provisioning and decommissioning.
  • AWS Systems Manager Patch Manager automated patching of Amazon Linux and Windows instances.
  • Change management process integrated with Jira for approvals, testing, and deployment tracking.
  • Regular Well-Architected Framework Reviews conducted to identify and remediate high-risk issues (HRIs).

4. Quantitative Business Impact

MetricBeforeAfter Implementation
Governance ViolationsManual detectionReduced by 80% through Control Tower guardrails
Deployment TimeDays/weeksHours with Terraform automation
Monitoring CoverageLimited logs only100% coverage across EC2, RDS, ALB, VPC, and API activity
Compliance Audit ReadinessNot audit-readyAudit-ready with AWS Config + CloudTrail
Patch ManagementManual, inconsistentFully automated via Systems Manager

5. Outcomes

  • Improved Governance: Multi-account setup with automated preventive & detective guardrails.
  • Cost Transparency: Consolidated billing and proactive budget alerts.
  • Enhanced Observability: Full monitoring stack with metrics, logs, and flow logs.
  • Continuous Compliance: Automated checks and reporting with AWS Config and CloudTrail.
  • Operational Excellence: IaC automation, patching, and structured change management reduced human error.

6. AWS Services Used

  • Governance: AWS Control Tower, AWS Organizations, SCPs
  • Financials: AWS Budgets, Cost Explorer, Anomaly Detection
  • Observability: CloudWatch (Logs, Metrics, Alarms, Insights), VPC Flow Logs, CloudTrail
  • Compliance: AWS Config, Conformance Packs, centralized S3 log archive
  • Operations: Terraform, AWS Systems Manager Patch Manager, Jira Integration