Tenderd

The migration unlocked the outcome that drove it: a production environment region-locked to me-central-1by policy, satisfying the UAE data-residency requirement Tenderd’s government and enterprise customers impose and making the company eligible to pursue UAE public-sector contracts. Governance and security maturity moved with it — the engagement’s readiness assessment scored Cloud Adoption Framework maturity for both Governance and Security moving from 2 to 5 on a five-point scale, with 100% of infrastructure change now flowing through Terraform and CI/CD. The same pattern is now being replicated for Tenderd’s Saudi workloads into me-central-2: the readiness assessment for the Kingdom has been delivered and that migration is in progress.

Tenderd operates a UAE-based fleet and heavy-equipment platform serving construction, energy, logistics, and marine operators. The platform ingests high-volume telemetry from connected equipment, processes it through streaming and data-engineering pipelines, and serves rental, asset-tracking, and operations applications. The incumbent estate ran on Google Cloud Platform — containerized services on Cloud Run and GKE, Compute Engine workloads, Memorystore Redis, PostgreSQL, BigQuery, and Cloud Storage — with managed dependencies on Confluent Kafka, MongoDB Atlas, and Firebase alongside it. That estate could not satisfy the requirement that mattered most: Tenderd’s government and enterprise customers require in-country data, and qualifying for UAE public-sector contracts meant the platform had to run inside the Emirates.

A security and compliance discovery session with Tenderd’s technical stakeholders produced four non-negotiable controls that shaped every design decision that followed: UAE data residency, no standing console access, centralized audit logging, and enforced MFA. The second constraint was operational maturity for a growing engineering team: Tenderd wanted an Infrastructure-as-Code-first model in which all infrastructure change is made through Terraform and peer-reviewed pull requests, with a small group of named administrators holding the only privileged access. Before committing to the larger in-region build, Tenderd also needed the path off Google Cloud proven on a representative workload.

Assess.VeUP began with discovery workshops across the GCP estate — a service-level inventory of the running environment, a per-service translation model mapping each GCP service to its AWS counterpart, and the security and compliance discovery session that fixed the four non-negotiables. A pilot migration, contracted at the end of December 2024, then took one representative containerized workload end-to-end into AWS: a development landing zone with VPC, NAT Gateway, and VPC endpoints; the workload replatformed onto Amazon ECS with AWS Fargate; scheduled tasks on Amazon EventBridge; secrets under AWS Secrets Manager and AWS KMS; Amazon API Gateway and Route 53; and a working CI/CD pipeline deploying the container with unit-test validation. The pilot was the go/no-go gate — it proved the migration mechanics, including the zero-downtime database cutover approach, before Tenderd committed to the full program. A migration readiness assessment consolidated the phase: Cloud Adoption Framework maturity scoring across the perspectives, a full 7Rs disposition of the portfolio, a quantified risk register with owners and mitigations — twelve risks, two rated High: CIDR design and streaming-cutover continuity — and a governed wave plan. The verdict was ready to migrate, with the identified gaps scheduled into the earliest delivery phases and closed there.

Mobilize.The foundation was built before any workload moved, across four named phases over roughly seven weeks from the October 2025 kickoff. Planning & Design fixed the non-overlapping CIDR plan, the region-restriction policy set, and the high-level design. Landing Zone & Governance stood up AWS Control Tower in me-central-1with Security, Infrastructure, and Workloads organizational units and dedicated accounts for production, staging, data-engineering production, data-engineering staging, networking, security, and log archive — no workloads in the management account. Preventive Service Control Policies deny every region except me-central-1, block root-user access keys, enforce MFA, protect AWS CloudTrail and AWS Config from tampering, and require encryption at rest. Amazon GuardDuty, AWS Security Hub, and Amazon Detective run organization-wide, benchmarked against CIS AWS Foundations and the AWS Foundational Security Best Practices standard. Identity & Access federated Google Workspace into AWS IAM Identity Center over SAML, with named, least-privilege permission sets mapped to groups — nobody holds standing credentials, and console access is restricted to four named administrators. Networking Foundation delivered the hub-and-spoke core: an AWS Transit Gateway in the networking account connecting multi-AZ spoke VPCs per workload account, VPC endpoints keeping service traffic on the AWS backbone, Client VPN federated through the corporate identity provider and terminating in private subnets only, and Route 53 private hosted zones with Resolver endpoints for cross-account DNS.

Migrate & Modernize.Delivery ran in governed waves — landing zone and governance first, then identity and networking, then workloads and data — each wave with explicit entry and exit criteria, validation against agreed service-level objectives (99.9% monthly request availability for the customer-facing tier, 99.5% telemetry ingest success, and no streaming message loss across cutover), and a tested rollback path that reverts a wave without touching the ones before it. In the pilot, the documented rollback was falling back to GCP; business sign-off gated every cutover. The 7Rs disposition was Replatform- and Relocate-dominant, which fits a customer already running modern containers: the application tier replatformed onto managed container runtimes, streaming and database dependencies relocated with continuity preserved across cutover — AWS DMS handled database movement, with the zero-downtime MongoDB cutover mechanics established in the pilot — data-engineering pipelines replatformed into dedicated accounts, and deprecated components were retired rather than carried. Refactoring was deliberately deferred to a later modernization phase, once workloads were stable in-region.

Everything shipped as code: separated Terraform repositories for infrastructure and account definition, with terraform validate, tfsec, and checkovgating every pull request. Generative AI accelerated the Infrastructure-as-Code delivery — authoring and modularizing landing-zone Terraform and drafting operational runbooks — with every AI-produced artifact reviewed by an engineer before use. Knowledge transfer closed the engagement as a contracted workstream: workshops, shadowing, Day-2 runbooks covering VPN onboarding, Transit Gateway routing, and cost reviews, and an operating model the platform itself enforces, because infrastructure can only change through Terraform pipelines. On the governed foundation, production compute runs containerized services on Amazon EKS and Amazon ECS with AWS Fargate across Availability Zones, scaling horizontally with demand.

The UAE migration completed in February 2026 and the platform is in production. The same pattern is now being replicated for Tenderd’s Saudi workloads into me-central-2— unblocked by the Riyadh region’s general availability in January 2026 — where the migration readiness assessment has been delivered and the migration is in progress: the same parameterized Terraform, with the region-lockdown policies retargeted for in-Kingdom residency.

The landing zone was designed against the six pillars of the AWS Well-Architected Framework, and the readiness assessment mapped the design to them explicitly. Operational excellence: all change flows through Terraform and CI/CD with automated policy checks, backed by Day-2 runbooks and defined service-level objectives. Security: preventive SCPs, zero standing console access, MFA everywhere, organization-wide GuardDuty, Security Hub, and Detective against CIS and AWS Foundational Security Best Practices, and encryption at rest mandated with keys held in-region under AWS KMS. Reliability: multi-AZ spoke VPCs per workload account, defined RTO/RPO tiers, and per-wave rollback paths validated before every promotion. Performance efficiency: managed container runtimes on EKS and ECS/Fargate, right-sized against measured consumption. Cost optimization: per-account cost isolation, budgets, and documented optimization levers from a governed baseline. Sustainability: managed, right-sized services over self-managed infrastructure, with elastic scaling in place of standing capacity.