Skip to content
felicity.lois// Cloud & devops
Back to Portfolio

SaaS Platform

AWS Infrastructure & CI/CD for SAAS Platform

Project Overview

Designed and deployed a production-grade AWS cloud infrastructure for a SAAS platform that helps founders and small businesses generate authentic, voice-consistent content. The platform processes video uploads through a sophisticated multi-stage pipeline—transcription, visual AI analysis, GPU-accelerated clipping, and generative AI asset creation—delivering marketing-ready quotes, social posts, and email copy. Built on a multi-account AWS architecture spanning seven dedicated accounts (Management, Development, Staging, Production, Shared Services, Audit, Log Archive), the solution implements enterprise-grade security, governance, and compliance controls through AWS Control Tower and Identity Center. The core application runs on ECS Fargate with a fully automated CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy with blue-green deployment strategy for zero-downtime releases. The infrastructure supports compute-intensive video processing workloads on NVIDIA T4 GPU clusters in a dedicated Shared Services account, orchestrated through Elixir/Phoenix on ECS Fargate with Oban job queues.

Problems

  • The platform needed a scalable, secure cloud foundation to support AI-driven video processing and content generation workflows capable of handling variable compute loads and GPU-intensive operations.
  • The platform required automated, repeatable deployments across multiple environments (dev, staging, production) with zero-downtime releases and automatic rollback capabilities.
  • Enterprise-grade security and governance were essential from day one, including centralized identity management, threat detection, compliance monitoring, and audit logging across all environments.
  • Cost optimization during active development required selective enablement of monitoring services while maintaining production-ready security posture.
  • The architecture needed to support cross-account GPU cluster access for video processing while maintaining strict security boundaries and least-privilege access controls.

Goals

  • Establish a multi-account AWS organization with Control Tower guardrails to enforce security, compliance, and operational best practices across all environments.
  • Implement a fully automated CI/CD pipeline from GitHub through build, test, and blue-green deployment to ECS Fargate, respecting permission sets and deployment approval workflows.
  • Build a resilient, high-availability application platform using ECS Fargate Multi-AZ deployments, RDS Multi-AZ failover, and CloudFront global distribution.
  • Deploy centralized security monitoring and threat detection via GuardDuty, Security Hub, and CloudTrail with automated alerting through AWS Chatbot.
  • Create a scalable video processing pipeline leveraging GPU acceleration for transcription (Whisper), visual analysis (Rekognition), semantic segmentation (Hugging Face), and multi-aspect-ratio transcoding (FFmpeg).
  • Ensure production readiness with comprehensive observability (CloudWatch Logs, Metrics, Synthetics), secrets management (AWS Secrets Manager), and disaster recovery capabilities (cross-account backups, Multi-AZ failover).

Role & Responsibilities

  • Architected and implemented the entire AWS infrastructure spanning seven accounts with Control Tower, Identity Center, and Security Hub for centralized governance and security.
  • Designed and deployed the ECS Fargate application platform including VPC networking (public/private subnets across multiple AZs), Application Load Balancer, and container orchestration.
  • Built the complete CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy with blue-green deployment strategy, integrating GitHub source control and ECR container registry.
  • Implemented RDS PostgreSQL Multi-AZ database with automated backups, encrypted at rest and in transit, supporting the application's project, asset, and metadata persistence requirements.
  • Configured S3 and CloudFront for video storage, asset delivery, and global content distribution with optimized caching policies.
  • Established security monitoring and compliance through GuardDuty threat detection, Security Hub finding aggregation, CloudTrail audit logging, and IAM permission sets via Identity Center.
  • Deployed CloudWatch observability stack including log aggregation, custom metrics, Synthetics endpoint monitoring, and Chatbot integration for incident alerting.
  • Set up AWS Secrets Manager and Parameter Store for secure credential and configuration management across the pipeline.
  • Coordinated cross-account GPU cluster integration in the Shared Services account for video processing workloads with secure IAM role-based access.

Architecture & Deployment Flow

  • AWS Control Tower and Identity Center in the Management account govern all child accounts (Dev, Staging, Prod, Shared Services, Audit, Log Archive) with centralized SSO, permission sets, and guardrails.
  • GitHub hosts application code (Elixir/Phoenix) and infrastructure definitions, triggering CodePipeline on commit.
  • CodeBuild compiles the Elixir application, runs tests, builds Docker images, and pushes to Amazon ECR.
  • CodeDeploy orchestrates blue-green deployments to ECS Fargate in private subnets across multiple availability zones, with automatic rollback on failure.
  • Application Load Balancer distributes traffic from the internet to ECS Fargate containers in private subnets.
  • RDS PostgreSQL Multi-AZ provides active-passive database failover with automated backups and cross-account replication to the Audit account.
  • Amazon S3 stores video uploads and generated assets; CloudFront accelerates global content delivery.
  • GPU Cluster (Shared Services account) runs NVIDIA T4-accelerated workloads for Whisper transcription, Hugging Face semantic segmentation, and FFmpeg multi-aspect-ratio transcoding; orchestrated via ECS Fargate and Oban job queues.
  • AWS Lambda coordinates transcription and Rekognition jobs, with results returned via webhook to ECS Fargate.
  • CloudWatch ingests logs from ECS containers, Lambda functions, and RDS; custom metrics track job queue depth, processing latency, and resource utilization.
  • CloudWatch Synthetics proactively monitors application endpoints with HTTP health checks; CloudWatch Alarms trigger alerts on failures, delivered via AWS Chatbot to Slack.
  • GuardDuty continuously analyzes CloudTrail logs and VPC Flow Logs for threats; findings aggregated in Security Hub and forwarded to the Audit account.

Key Implementation Details

Multi-Account AWS Organization

Seven-account structure with Control Tower preventative and detective guardrails enforcing encryption, logging, and access policies across all environments. AWS Identity Center provides SSO and role-based permission sets, eliminating individual IAM users and enforcing least-privilege access.

ECS Fargate & Containerization

Elixir/Phoenix application containerized with Docker, following multi-stage builds and security best practices. ECS tasks deployed across multiple availability zones with auto-scaling based on CloudWatch metrics and Oban job queue depth. Private subnets with NAT Gateway for outbound connectivity; no direct internet access to application containers.

CI/CD Pipeline

GitHub webhook triggers CodePipeline on push to main branch. CodeBuild executes unit tests, integration tests, and builds versioned Docker images. CodeDeploy performs blue-green deployment to ECS Fargate with traffic shifting and automatic rollback on CloudWatch alarm thresholds. Separate pipelines for Dev, Staging, and Production with Identity Center permission sets restricting production deployments to authorized DevOps personnel.

Security & Compliance

GuardDuty enabled across all accounts for threat detection (crypto mining, credential exfiltration, suspicious network activity). Security Hub aggregates findings from GuardDuty, IAM Access Analyzer, and AWS Config. CloudTrail logs all API activity, centralized to Audit account for forensic analysis and compliance reporting. AWS Config (production-only) validates resource configurations against compliance rules. Secrets Manager stores Anthropic API keys, database credentials, and service tokens with automatic rotation.

Monitoring & Observability

CloudWatch Logs aggregates ECS containers, Lambda functions, and VPC Flow Logs with log insights queries. Custom metrics for Oban job queue depth, processing latency, GPU utilization, and API call volumes. CloudWatch Synthetics canary scripts monitor application endpoints every 5 minutes. CloudWatch Alarms trigger on Synthetics failures, high error rates, database CPU/IOPS, and ECS task health. AWS Chatbot delivers alerts to Slack for rapid incident response.

Results & Impact

  • Delivered a production-ready, multi-account AWS infrastructure supporting an early-access launch with enterprise-grade security, governance, and compliance controls from day one.
  • Achieved zero-downtime deployments through blue-green ECS Fargate deployment strategy with automated rollback, enabling rapid iteration and feature releases across dev, staging, and production environments.
  • Implemented comprehensive security posture with GuardDuty threat detection, Security Hub aggregation, CloudTrail audit logging, and Identity Center SSO, providing centralized visibility and control across all seven AWS accounts.
  • Enabled scalable, GPU-accelerated video processing supporting AI-powered content generation workflows (transcription, visual analysis, multi-aspect-ratio clipping, quote/social/email generation) with automated orchestration via Oban job queues.
  • Established proactive observability and incident response through CloudWatch Synthetics endpoint monitoring, custom metrics, log aggregation, and Slack-integrated alerting, ensuring rapid detection and remediation of issues.
  • Optimized infrastructure costs during development by selectively enabling compliance monitoring services (Config enabled only in Production) while maintaining security best practices across all environments.

Technology Stack

Cloud & Multi-Account Governance

  • AWS Control Tower
  • AWS Identity Center
  • AWS Organizations

Networking & Load Balancing

  • Amazon VPC
  • Application Load Balancer
  • CloudFront

Database & Storage

  • Amazon RDS PostgreSQL
  • Amazon S3

Monitoring & Observability

  • Amazon CloudWatch Logs
  • Amazon CloudWatch Metrics
  • Amazon CloudWatch Synthetics
  • AWS Chatbot

Application Framework

  • Elixir
  • Phoenix
  • Docker

Service Mesh

  • Amazon ECS Fargate
  • NVIDIA T4 GPU Cluster
  • AWS Lambda

CI/CD & Deployment

  • AWS CodePipeline
  • AWS CodeBuild
  • AWS CodeDeploy
  • Amazon ECR
  • GitHub

Security & Compliance

  • AWS GuardDuty
  • AWS Security Hub
  • AWS Config
  • AWS CloudTrail
  • AWS Secrets Manager