A software / engineering-intelligence SaaS platform
AWS-validated reference — full details available to AWS Partner Validation or on request. (Customer name held on file with VeUP.)
VeUP ran a full six-pillar AWS Well-Architected Review of the customer production engineering-intelligence SaaS — 57 best-practice questions — surfacing 47 prioritized risk items (31 High, 16 Medium), each mapped to a pillar with a concrete remediation, plus a top-5 remediation roadmap.
The challenge
the customer runs a production engineering-intelligence SaaS on AWS (us-east-1) that had grown organically alongside the business. The team had strong foundations in deployment automation and identity but had never had the architecture independently measured against AWS best practice. As it scaled toward larger enterprise customers, the customer needed an objective, prioritized read on where the workload carried real risk — particularly resilience, security, and cost governance — before that risk surfaced as downtime or unbounded spend. Specific concerns: a monolithic application (single codebase, single Docker image) with no service boundaries; a 24-hour RTO/RPO defined on paper but no cross-region replication and no DR testing; no formal cloud financial management; internal service-to-service traffic without mutual TLS; data encrypted at rest with default AWS-managed keys; and ad-hoc incident management.
The solution
VeUP conducted a structured AWS Well-Architected Framework Review across all six pillars — Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability — covering 57 best-practice questions, combining stakeholder interviews with evidence-based scoring to produce a per-pillar risk profile, prioritized findings, and a concrete remediation per item. Top remediation approaches: decompose the monolith toward service/bulkhead boundaries, automate cross-region replication for critical databases, and establish a DR-test/Game Day cadence to validate the 24h RTO/RPO; establish cost ownership, AWS Budgets, cost-allocation tagging, and move the web tier onto EC2 Auto Scaling; introduce mutual TLS (or AWS App Mesh) for internal auth and upgrade encryption at rest to AWS KMS customer-managed keys; standardize investigation/deployment runbooks; and document and recovery-test the Amazon Aurora backups. VeUP built on existing strengths — Terraform IaC + CI/CD, SSO/SAML, Datadog/Grafana — so the roadmap extended investment rather than replacing it. Separately, VeUP scoped a three-phase agentic ticket-evaluation engagement on Amazon Bedrock AgentCore (Bedrock governance layer with per-tenant metering, Guardrails, and an LLM-as-a-Judge loop; an AgentCore Gateway; and a Strands supervisor orchestrating PM-Evaluator, Architect-Evaluator, and LLM-Judge sub-agents) — currently funding-gated.
Production outcomes
| KPI | Result |
|---|---|
| Production outcomes | 6 of 6 AWS Well-Architected pillars assessed across 57 best-practice questions; 47 prioritized risk items surfaced and documented (31 High Risk, 16 Medium Risk), each mapped to a pillar and paired with a concrete remediation approach; per-pillar risk visibility delivered (Reliability 10H/2M, Security 7H/4M, Cost Optimization 7H/0M, Operational Excellence 6H/3M, Performance Efficiency 1H/2M, Sustainability 0H/5M); a top-5 strategic findings roadmap ranked by business impact. The three-phase agentic Bedrock AgentCore engagement is scoped (AoP delivered, validated in the 2026-04-27 review) and funding-gated — no delivered-outcome metric exists yet for the agentic build. |
| Engagement window | 2026-02-27 (WAFR review date); Marketplace Bundle Closed Won 2024-08-13; Sell live 2025-12-09 → WAFR delivered 2026-02-27; remediation + 3-phase agentic engagement scoped/funding-gated; ongoing |
| Cost / TCO posture | Cost Optimization was one of six pillars assessed (7 High-Risk items); the remediation establishes cost ownership, AWS Budgets, cost-allocation tagging, and EC2 Auto Scaling to align supply with demand. Realized savings are roadmap recommendations, not claimed outcomes. |
| Lessons & continuation | A monolith's blast radius is itself a Reliability finding — decoupling toward service boundaries is the high-leverage remediation; an RTO/RPO defined on paper without DR testing is unproven until Game Days validate it; upgrading from default to KMS customer-managed keys and adding mutual TLS are concrete, enterprise-readiness security moves a scaling SaaS should make before, not after, the enterprise deal. |
AWS Well-Architected Framework · Amazon Aurora · AWS KMS (customer-managed keys) · AWS Budgets · Amazon EC2 Auto Scaling · AWS App Mesh · Amazon Bedrock AgentCore (scoped)
Architecture
The six-pillar Well-Architected Review baselined the customer's existing AWS us-east-1 environment and mapped each finding to a concrete remediation — from monolith decomposition and cross-region DR to AWS KMS customer-managed keys, mutual TLS via AWS App Mesh, and AWS Budgets cost governance.
