The Problem
Multi-cloud architectures create real security challenges that most organizations underestimate until they try to build them. Data moving between cloud providers typically crosses the public internet unless you explicitly engineer private connectivity — and public internet transit means exposure, latency variability, and compliance risk. Ometrics had data residing in Azure but needed that data accessible in AWS for their analytics processing workflows. Their compliance and security requirements were non-negotiable: no data could touch a public endpoint in transit, the database replica could not have a public IP under any circumstances, and every access event needed to be fully auditable with tamper-evident logs. Standard connectivity options like public peering or VPN-over-internet weren't acceptable. They needed an architecture that treated security as the starting constraint, not an afterthought.
How We Solved It
We implemented a private encrypted tunnel between Azure and AWS using AWS Site-to-Site VPN with BGP dynamic routing, so failover between tunnel endpoints is automatic and does not require manual intervention. The VPN terminates into a dedicated AWS VPC designed from the ground up with no public subnets — there is no path for traffic to enter or exit this environment via the public internet. The RDS SQL Server replica lives in private subnets with no public accessibility flag enabled. Database administration happens exclusively through an EC2 proxy instance managed via AWS Systems Manager Session Manager, which means no open SSH ports, no bastion host, and no credentials to rotate or leak. Defense-in-depth security is applied at every layer: strict Network ACLs limit traffic flows between subnets, security groups enforce minimal ingress rules per service, AWS WAF protects the analytics API layer, and CloudTrail captures every API call across the environment with logs written to a dedicated S3 bucket on a retention policy. The entire environment — VPN configuration, VPC layout, subnet structure, RDS instance, EC2 proxy, IAM roles, and security groups — is defined in Terraform with zero manual console work, making the infrastructure fully reproducible and auditable.
What We Delivered
- Secure Azure-to-AWS data bridge established
- Database fully isolated with zero public exposure
- Entire environment codified in Terraform