Schedule a Meeting

AWS Infrastructure Modernization for SOC 2 and HIPAA Compliance

Server infrastructure beside a hospital patient room, with the imaging platform staying live through the move to AWS
  • Terraform modules built
  • AWS environments provisioned
  • Delivery milestones completed
  • Production compliance controls remediated

Introduction

A healthcare technology company operates a HIPAA-compliant platform for exchanging medical imaging records among patients, imaging centers and providers. The platform is a Laravel (PHP) web application with server-rendered Blade views and a companion React Native mobile application, and it had relied on a third-party HIPAA-managed hosting provider for its infrastructure. The client engaged Nalashaa to assess its CI/CD pipelines and release governance within that managed environment.

Partway through the assessment, access limitations inside the managed hosting environment made it impossible to complete the original scope. Rather than let the engagement stall, the client changed direction: it moved to a self-managed AWS environment and asked Nalashaa to build that environment from scratch, deploy the platform into it, and bring it to SOC 2 and HIPAA readiness, without disrupting a live system that patients and providers depend on.

The Challenge

Rebuilding the Platform’s Foundation Without Interrupting Care

  • An Assessment That Could Not Reach Its Own Subject

    The first engagement could not get far enough inside the client’s managed hosting environment to deliver a complete picture. Challenges included:

    • Restricted access within the managed hosting provider’s environment limited how much of the pipeline and release process could actually be reviewed
    • A platform bound to a specific managed host, with no infrastructure defined as code, and no independent environment to migrate to
    • A stalled engagement that risked the relationship if it was simply written off
    • A client that still needed the same underlying questions answered: why deployments were unreliable, and whether the platform could meet audit-grade compliance standards

  • Standing Up Production-Grade AWS From Nothing

    Moving off the managed host meant building an entire HIPAA-aligned AWS environment before a single deployment could happen. Key obstacles:

    • No existing AWS footprint: networking, compute, database and storage all had to be designed and provisioned from scratch, entirely as Terraform-managed infrastructure
    • Two environments, UAT and Production, had to reach parity, both built and validated before the live platform could move
    • A healthcare application with real patients and providers on the other end, so the database export, migration approach and configuration items had to be confirmed before any infrastructure work began

  • Passing an Independent Compliance Bar Without Slowing the Business Down

    Infrastructure alone does not satisfy SOC 2 or HIPAA; both require continuous, evidenced controls. Challenges included:

    • Standing up security monitoring, audit logging and key management from a cold start, then proving each control automatically to a third-party compliance platform
    • Getting the production account’s automated controls to a fully remediated state, not just configured
    • Building deployment governance, approval gates, audit trails and least-privilege access, without introducing friction that would make the client’s own team route around it
    • Doing all of this while the existing platform stayed live and in clinical use

Our Solution: Infrastructure-as-Code First, Compliance Built In From the Start

Nalashaa responded to the stalled assessment with a restructured, outcome-based engagement: rebuild the platform’s infrastructure as code in a self-managed AWS environment, deploy and verify the application there, then harden it to SOC 2 and HIPAA readiness, with the unbilled hours from the original assessment absorbed rather than passed on to the client.

The solution allowed the client to:

  • Own its infrastructure outright, defined entirely in Terraform rather than tied to a managed host
  • Move to AWS with the deployment approach, database migration method and configuration items agreed before any build work began
  • Deploy through a governed CI/CD pipeline with a mandatory approval gate ahead of every production change
  • Reach a fully remediated SOC 2 and HIPAA compliance posture on its production account through automated evidence collection
  • Keep working with Nalashaa on the strength of a corrected course, not a failed engagement

This approach turned an engagement that had stalled into a foundation the client now owns. We delivered the solution across three milestones.

Task 1

Migration Readiness & Infrastructure-as-Code Foundation

SOLUTION HIGHLIGHTS

  • Confirmed application deployment requirements, the database export and migration approach, and required configuration items before any infrastructure was built
  • Established the Terraform foundation: a version-controlled repository with remote state (an S3 backend with a DynamoDB lock) so infrastructure changes are tracked and safe to apply concurrently
  • Authored and tested 14 Terraform modules covering networking, compute, database, storage, load balancing and certificates, with terraform fmt, validate and tflint checks added to the pipeline

TECHNICAL ENHANCEMENTS

  • A VPC with public and private subnets, route tables, an Internet Gateway and a NAT Gateway for outbound-only access from private resources
  • Service Control Policies restricting all infrastructure to a single AWS region

Outcome: A tested, version-controlled infrastructure foundation, ready to provision both environments on demand.

Task 2

AWS Environment Build & Application Deployment

SOLUTION HIGHLIGHTS

  • Provisioned the UAT environment with terraform apply and validated it with a smoke test, then repeated the process for Production
  • Stood up EC2 application servers for the Laravel platform in private subnets for both environments
  • Provisioned RDS for MySQL with encryption at rest, enforced SSL connections and automated minor version upgrades
  • Configured S3 buckets with public access blocked at the account and bucket level, and SSE-S3 encryption enabled
  • Deployed the Laravel platform into the new AWS environment and confirmed it reachable and functioning through basic smoke testing

TECHNICAL ENHANCEMENTS

  • An Application Load Balancer with an HTTPS listener via AWS Certificate Manager, with HTTPS enforced in the application layer and MySQL connections encrypted in transit
  • Security groups closing administrative and database ports to the public internet
  • Hardening steps applied directly in the application: debug mode disabled, configuration files not publicly accessible, remote root database access disabled

Migration approach in practice: the database export and migration method, along with every required configuration item, were agreed with the client before infrastructure work began, so the deployment step itself carried no surprises.

Outcome: Both environments stood up, validated and holding a working copy of the platform, with the production environment ready for the compliance layer.

Task 3

CI/CD Pipeline & SOC 2 and HIPAA Compliance Hardening

SOLUTION HIGHLIGHTS

  • Built a GitHub Actions workflow to lint, test and build the platform, pulling configuration from Secrets Manager rather than the repository
  • Configured AWS CodeDeploy deployment groups for UAT and Production, with appspec-driven install and validation steps and a post-deploy health check and smoke test
  • Added a manual approval gate ahead of every production deployment, enforced branch protection requiring review and passing checks before merge, and logged every deploy to CloudWatch with actor and timestamp
  • Enabled GuardDuty, Inspector, CloudTrail and KMS with key rotation, and connected both AWS accounts to a compliance automation platform for continuous evidence collection
  • Took the production account’s automated compliance controls to a fully remediated state, with the UAT account connected for visibility, and documented backup retention with a completed restore test for auditors

BUSINESS ENABLEMENT

  • A CI/CD pipeline the client’s own team can operate, with governance built in rather than bolted on
  • A production environment with evidenced, continuously monitored compliance controls
  • Infrastructure and pipeline documentation and a Terraform module repository handed over at close

Together, the three milestones took the platform from a stalled assessment to a self-owned, compliant AWS foundation (Figure 1).

Figure 1: Delivery flow, from Terraform foundation through governed CI/CD to SOC 2 and HIPAA remediation

Architecture & Governance

Figure 2: AWS architecture across source control, the client’s VPC and the compliance automation layer

From the client’s standpoint, the architecture delivered

ARCHITECTURE
Environment ownership
A self-owned AWS environment, defined entirely in Terraform, replacing dependence on a third-party managed host.
Network
A network built on private subnets for compute and database, with only the load balancer exposed publicly.
Delivery pipeline
A CI/CD pipeline with a mandatory approval gate ahead of every production change and a full deployment audit trail.
Compliance evidence
Continuous, automated compliance evidence collection, remediated to a fully green state for the production account.
Access and secrets
No permanent IAM access keys or SSH key pairs, and no secrets committed to source control.

This architecture gave the client ownership of its infrastructure and a defensible compliance posture at the same time.

Technology and Controls

CORE TECHNOLOGIES
Infrastructure as code
Terraform, with a remote state backend on S3 and DynamoDB.
Cloud platform
AWS: VPC, EC2, RDS for MySQL, S3, Application Load Balancer, Certificate Manager, Secrets Manager, GuardDuty, Inspector, CloudTrail, KMS and Service Control Policies.
Source control and CI
GitHub and GitHub Actions.
Deployment orchestration
AWS CodeDeploy.
Compliance automation
A third-party SOC 2 compliance automation platform for continuous control evidence.
Application
Laravel (PHP) backend and a React front end, with a companion React Native mobile application.
OPERATIONAL CONTROLS
Production change control
Written client approval required before any production deployment, DNS change, database change or Terraform state update.
Keyless access
No permanent IAM keys or SSH key pairs without explicit written authorization, with temporary role-based access preferred throughout.
Least-privilege access
Every credential granted is scoped to the minimum needed for the agreed scope.
Branch protection
Mandatory code review and passing checks before merge.
Deployment audit trail
Every deploy logged with actor and timestamp.
Scope and change control
A milestone-based delivery plan with a fixed scope, frozen at signing and changed only through a formal change request.

Business Impact & ROI

Infrastructure Ownership
Migrated from a third-party managed host to a self-owned, Terraform-defined AWS environment
Compliance Readiness
Production account’s automated controls remediated to a fully green state, with continuous evidence collection
Deployment Governance
CI/CD with a mandatory approval gate and full audit trail replaced undocumented deployment practices
Security Posture
Encryption at rest and in transit, least-privilege access, no permanent credentials, single-region infrastructure
Continuity of Care
The client’s platform stayed live and reachable throughout, verified by smoke testing at each stage
Relationship Resilience
A stalled assessment was restructured into a delivered engagement, with unbilled hours absorbed rather than charged to the client

Quantifiable Outcomes

Measured against the engagement’s own yardsticks:

  • Terraform modules written, tested and applied across two environments
  • Both UAT and Production environments provisioned, deployed to and verified reachable through smoke testing
  • Both AWS accounts connected to the compliance automation platform; the production account’s automated controls fully remediated
  • Every production change gated behind prior written client approval, with zero net-new application features touched

Strategic Value Delivered

This initiative shows how a healthcare platform can move off a managed host and onto infrastructure it owns outright, meeting audit-grade compliance standards along the way, without ever taking the system out of clinical use. By combining infrastructure-as-code, governed CI/CD and compliance automation, the client now benefits from:

  1. 01Full ownership of a documented, version-controlled AWS environment
  2. 02A defensible, continuously evidenced compliance posture on its production account
  3. 03A deployment process its own team can run, with governance built into every release

Looking Ahead

With the infrastructure and compliance foundation in place, the organization is now positioned to:

  • Pursue formal SOC 2 certification and attestation with its own auditors
  • Extend the UAT account’s compliance remediation to match Production
  • Add automated testing coverage within the CI/CD pipeline and scale the platform on infrastructure it controls end to end

Rebuild the foundation. Prove the controls. Never take the platform down to do it.

Let’s Talk
Copyright ©   Nalashaa.  Privacy Policy  |   Terms and Conditions   |   Sitemap

Cookies help us deliver our services. By using our services, you agree to our use of cookies Privacy Policy. I Accept It!