A Tier 2 payments service lifted onto native AWS in a new region, without forking a single line of it.

01 Architecture

• Two CloudFormation stacks in AWS CDK (TypeScript): DNS and certificates deploy first and export into the VPC stack that follows.
• VPC across 3 availability zones, all subnets PRIVATE_ISOLATED. No NAT gateway, no internet gateway, roughly $300/month saved and a smaller attack surface.
• AWS reached through gateway and interface VPC endpoints only, private DNS enabled, one security group allowing 443 from the VPC CIDR.
• NLB in front of ECS tasks, ACM certificates with cross account Route 53 delegation, flow logs to CloudWatch and S3.
• Legacy Java service containerized into Docker, with runtime internals rewired for ECS: credential propagation through task roles, entrypoint patched at the Dockerfile layer.

02 What is in it

• One codebase runs on both the legacy platform and native AWS. No fork, no divergence, no branch to reconcile.
• Cross account DNS delegation designed from scratch with no existing pattern, then the IAM exposure it created resolved without weakening compliance.
• 15 DynamoDB tables globalised and 5 downstream services reconnected before cutover.
• Consumer testing onboarded, all activities validated, beta and production both complete with zero escalations.
• Adoption driven across dependent teams through design docs, onboarding wikis and on call SOPs.