Multi-Cloud Hybrid Architecture for Regulated Enterprise
Designed and implemented a hybrid multi-cloud architecture connecting AWS workloads with Azure Active Directory and on-premises systems, meeting strict healthcare regulatory requirements.
Industry
Healthcare
Duration
10 months
Engagement model
Hybrid cloud architecture and migration program spanning landing zone design, identity federation, containerization, and compliance validation.
First pass
regulatory compliance audit
<10ms
hybrid network latency
SSO
unified identity across environments
The organization needed to modernize its application portfolio on AWS while maintaining identity federation through Azure AD and keeping certain sensitive workloads on-premises due to regulatory constraints. Network segmentation and audit compliance were non-negotiable.
Client context: A healthcare organization needed to modernize its application portfolio while maintaining regulatory compliance, Azure AD identity federation, and selective on-premises data residency.
We architected a hybrid landing zone on AWS with Transit Gateway for multi-VPC connectivity, Site-to-Site VPN for on-premises integration, and SAML-based federation with Azure AD. Application workloads were containerized on ECS Fargate with .NET backends.
Landing zone design
Architected an AWS hybrid landing zone with Transit Gateway for multi-VPC connectivity and Site-to-Site VPN for on-premises integration.
Identity federation
Implemented SAML-based federation with Azure AD, enabling single sign-on across cloud and on-premises systems with role-based access control.
Application containerization
Containerized .NET backend workloads on ECS Fargate with automated deployment pipelines and approval gates for regulated environments.
Compliance validation
Validated the architecture against regulatory requirements, implemented audit logging, and prepared documentation for compliance submission.
Passed regulatory compliance audit on first submission
Single sign-on across cloud and on-premises systems
Network latency under 10ms between hybrid environments
Fully automated deployment pipeline with approval gates
Architecture
- Transit Gateway for multi-VPC and hybrid connectivity
- SAML-based Azure AD federation with role mapping
- ECS Fargate with .NET backends and approval-gated CI/CD
Business Goals
- Modernize application portfolio without disrupting clinical workflows
- Maintain regulatory compliance for sensitive healthcare data
- Unify identity management across cloud and on-premises systems
Constraints
- Certain workloads must remain on-premises due to regulatory requirements
- Azure AD identity federation is mandatory for all applications
- Network segmentation and audit trail requirements are non-negotiable
Tech Stack
Services