At a Glance

Industry: Healthcare Services

Goal: Replace a single legacy AWS account with a governed, multi-account landing zone built entirely in Terraform, with isolated US, Canada, and UK regions and foundational security, and give the team a sequenced roadmap to migrate existing workloads, support HIPAA and GDPR data residency, and add a future Ireland region.

OpsGuru Services: Cloud Foundation and Landing Zone Design, Cloud Security and Compliance Architecture, Infrastructure as Code, Migration Planning, Knowledge Transfer

Tech Stack:

• Account Governance and Identity: AWS Control Tower, AWS Organizations, AWS IAM Identity Center, service control policies

• Security and Audit: Amazon GuardDuty, AWS Security Hub, AWS CloudTrail, AWS Systems Manager Session Manager

• Region-Isolated Networking: Amazon VPC, AWS Transit Gateway, NAT Gateway

• Infrastructure as Code: Terraform

• Migration Planning: Amazon EC2, Amazon RDS, AWS Database Migration Service (roadmap), AWS Savings Plans (advisory)

Outcomes:

• 13 accounts provisioned as code: A governed multi-account structure replaces a single legacy account, and every account is created and managed through Terraform.

• 3 isolated regional network hubs: US, Canada, and UK environments each have their own network, with no connection between regions, which supports HIPAA and GDPR data residency.

• A 6-phase migration roadmap: About 50 production Amazon EC2 instances, several databases, and a GPU workload are mapped to target accounts, with about 24 weeks estimated for the last five phases if OpsGuru performs the full migration.

• All deliverables completed in about three weeks: Every item in the fixed-fee scope was delivered, and the client is ready to start the next phase within one to two weeks.

• A repeatable pattern for new regions: Because the whole environment is code, a new region such as Ireland can be stood up from the same templates.

Protecting Sensitive Health Information Across Borders

Organizations that handle health information carry a heavy responsibility. In the United States, HIPAA governs protected health information, or PHI, and sets strict rules for how it is stored, accessed, and shared. In the United Kingdom and Europe, GDPR adds its own requirements, including rules on where personal data can be stored. Companies operating across several countries must meet all these obligations at once, and the cloud environment they run in must make that practical.

The client provides healthcare-related services and operates in the United States, Canada, and the United Kingdom. Its workloads include sensitive health data, and it is preparing to open a new region in Ireland. Going into this engagement, the client ran its production workloads on AWS in a single account, with about 50

Amazon EC2 instances, several databases, and a GPU workload. That setup had supported the business through its growth, and the team knew the environment well. The client was also already working with OpsGuru for managed cloud operations.

As the company expanded across regions and its compliance obligations grew, it needed a more structured foundation: separate accounts, clear guardrails, and regions kept apart to protect data residency. It chose to build that foundation with OpsGuru so the new environment would return directly to managed operations once complete.

From One Legacy Account to a Structure Built for Compliance

The client needed a governed environment that matched its regulatory obligations, along with a realistic path for moving its existing workloads into it.

• Every Workload in One Account: All production resources lived together in a single legacy account. Without separate accounts for different workloads and environments, it was difficult to limit who could reach what or to contain the impact of any one issue.

• No Foundational Guardrails: The environment lacked service control policies to limit what any account could do, centralized sign-in through AWS IAM Identity Center, and centralized logging. These are core controls for organizations handling health data.

• Networking Without Built-In Resilience: Regions were connected through a mesh of VPC peering and self-managed VPN appliances with no high availability. The setup was complex to manage and exposed the business to single points of failure.

• Data Residency Across Several Regions: The client operates in three regions today and is adding a fourth, and its US workloads carry PHI while its UK environment falls under GDPR. Data had to stay in the right place, which required regions isolated from one another.

• No Roadmap Into a Landing Zone: A landing zone is a pre-configured, secure multi-account AWS environment that serves as the starting point for all workloads. The client had no plan for how to move from its current account into one, or in what order.

Terraform-Managed Governance, Isolated Networks, and a Sequenced Migration Roadmap

Phase 1: Discovery and Design

OpsGuru began with discovery questions and a working call to shape the target design. Discovery changed two assumptions in the original scope. The scope had assumed no compliance frameworks, but the team found VPCs tagged for PHI and a UK environment bound by GDPR. The client confirmed that HIPAA and GDPR both apply, and the design was adjusted to match. The scope had also assumed a single region, while the client actually runs three and is adding Ireland. To meet data residency needs, the team designed an isolated AWS Transit Gateway for each region. With a design that reflected the client’s real obligations, the team moved into the build.

Phase 2: Governance, Security, Networks, Infrastructure as Code, and the Migration Roadmap

• Governed Multi-Account Landing Zone: An AWS Control Tower landing zone built on AWS Organizations provisions 13 accounts, with AWS IAM Identity Center for sign-in and service control policies attached per organizational unit. The team raised the account-creation quota so all accounts could be created as planned.

• Foundational Security and Audit: Amazon GuardDuty watches for threats, AWS Security Hub brings findings together, and AWS CloudTrail logs are centralized. AWS Systems Manager Session Manager provides secure access to servers without opening them to the network.

• Region-Isolated Networking: Each of the US, Canada, and UK regions has its own AWS Transit Gateway and Amazon VPCs in a hub-and-spoke design, with no connectivity between regions. This keeps data where it belongs and supports GDPR.

• Everything as Terraform Code: The entire landing zone, from the Organization and accounts to networking, security, and identity, is defined in Terraform. Environments can be reviewed, repeated, and extended, and a new region can be built from the same code.

• Phased Migration Roadmap: A six-phase plan maps about 50 production Amazon EC2 instances, several Amazon RDS databases, and a GPU workload to target accounts. It covers IAM and security group remediation, uses AWS Database Migration Service for databases, and sequences the work from the smallest, lowest-risk region (Ireland) to the largest (Ohio).

Phase 3: Legacy Account Strategy, Roadmap Review, and Handover

The client wanted its legacy account to join the new Organization without inheriting the new guardrails. OpsGuru proposed placing it in an organizational unit that is not registered with AWS Control Tower, and buying the AWS Savings Plan from the new management account, sized to usage across the whole organization. The client favoured this recommended approach, and at closeout it was awaiting AWS confirmation. The roadmap was reviewed with the client’s team, and OpsGuru ran a Terraform walkthrough and knowledge-transfer session so its engineers can manage and extend the code. Migrating the applications and data themselves was outside this engagement, and the client plans to handle that work in-house.

We needed a foundation that would stand up to HIPAA and GDPR as we grow into new regions. The OpsGuru team delivered it, and they were transparent with us at every step. We now have a clear, sequenced path for moving our workloads, and we are ready to start the next phase. — Director, Compliance and DevOps

The Outcome: A Compliant Starting Point That Repeats in Every New Region

In about three weeks, the client moved from a single legacy account to a governed, code-managed foundation, with a clear plan for what comes next.

Technical Outcomes: A Governed, Repeatable Environment

• 13 accounts provisioned as code: Workloads can now be separated by account and controlled by policy. Every account was created through Terraform, which makes the structure consistent and easy to audit.

• 3 isolated regional network hubs: The US, Canada, and UK each have their own hub-and-spoke network with no cross-region connectivity. Keeping regions separate directly addresses HIPAA and GDPR data residency questions.

• Foundational security from day one: Threat detection, centralized findings, and centralized audit logs are in place across the environment, along with guardrails that limit what accounts can do.

• A six-phase path with real numbers behind it: About 50 production Amazon EC2 instances and several databases are mapped to target accounts. If OpsGuru performs the full migration, phases two through six are estimated at about 24 weeks, giving the client a concrete figure to plan against.

Organizational Outcomes: Clarity, Confidence, and Momentum

• All deliverables completed within a fixed scope: The team delivered every item in the fixed-fee engagement in about three weeks, even though discovery expanded the compliance and region requirements.

• A transparent working relationship: The client’s technical sponsor described the team as great to work with and very transparent. The client also favored the recommended Savings Plan approach after reviewing the roadmap.

• Ready to start the next phase: The client wants to begin the Ireland build-out within one to two weeks, estimated at about a week and a half to two weeks of work. Later phases cover the UK, Canada, Ohio, and network consolidation.

• A clear picture of what is still open: At closeout, three items remained: AWS confirmation of the Savings Plan approach, a decision on VPN design, with a self-managed option favored, and a plan for consolidating Active Directory. Managed cloud operations will be applied to the new environment, and the same pattern can serve other compliance-sensitive healthcare workloads.