A clean-energy IoT platform for telecom power infrastructure

the customer operates a mission-critical IoT energy platform: field-deployed storage and management devices on telecom sites continuously stream voltage, current, and temperature telemetry to AWS. The platform had grown organically — all infrastructure was managed by hand through the AWS console with no infrastructure-as-code, the root cause of a wide class of risk: no automated scaling, no immutable deploys, no repeatable security baselines, publicly reachable databases, internet-facing APIs without network isolation, and no defined disaster-recovery posture. the customer needed an independent assessment and a credible path to operational maturity without disrupting a platform telecom customers depend on.

VeUP ran a full AWS Well-Architected Framework Review across Security, Reliability, Cost Optimization, and Operational Excellence, then scoped a phased multi-month remediation and modernization program. The foundational workstream replaces manual console operations with infrastructure-as-code (Terraform/CDK/CloudFormation), with AI-assisted authoring via Amazon Q Developer — the base for automated scaling, immutable deploys, and security baselines. Security remediation introduces VPC isolation, private databases on Amazon RDS, and network segmentation; reliability work defines RTO/RPO targets, a DR strategy, and cross-region replication. On the IoT side VeUP accelerated the roadmap: device telemetry migrated HTTPS to MQTT on AWS IoT Core, plug-and-play device configuration via AWS IoT Device Shadow, and a digital twin of the field fleet explored with AWS IoT TwinMaker. A separate AWS-referred workstream automates invoice validation with generative AI — extracting invoice data, reconciling it against device telemetry, and generating approval recommendations.

An AWS Well-Architected annotated view of the platform: the console-managed, publicly-exposed previous state on the left; the VPC-isolated, IaC-provisioned target state — AWS IoT Core (MQTT), IoT Device Shadow, IoT TwinMaker, private multi-AZ Amazon RDS, and the Security/Observability control rails — on the right, with the six Well-Architected pillars called out below.