AWS Architecture and Networking Proof of Concept

The Challenge

Prior to March 2020, Alpine’s candidate management solution, CertMetrics™, predominantly managed credentials for in-person testing. The CertMetrics team had already been working to support increased remote, proctored testing needs. But as COVID-19 emerged, the possibility of in-person testing diminished overnight, and demand for remote testing soared.

This rapid shift to predominantly remote testing placed additional importance on the CertMetrics system and made uptime and reliability even more critically important. When in-person testing occurs, there’s more “give” in the system to compensate for unexpected downtime. With a remote testing model, a dependable system is absolutely necessary; if the system goes down, people are not able to take exams and obtain needed credentials, which can directly affect their careers. In addition, Alpine was planning on a huge influx of customers with the launch of a new offering in 2021, and their systems were not set up to handle the potential added demand. Alpine recognized the immediate need to leverage the scalability and reliability of the cloud, so they researched cloud providers and prepared to move to Amazon Web Services (AWS).

Why Amazon Web Services

Amazon Web Services already utilized Alpine for their certification management, so it only seemed natural to build on that existing relationship. Through the research process, Alpine realized that moving the CertMetrics workload to AWS offered several benefits; in addition to reliability, Alpine was interested in the potential scalability, flexibility, security, redundancy and cost efficiency. Alpine was also drawn to the benefits that infrastructure as code in the cloud could offer (version control, repeatability, etc.), plus additional tools and services like analytics, machine learning and data visualization. Alpine turned to 1Strategy, an AWS Partner Network (APN) Premier partner, for guidance and education through the migration process.

The Benefits

Since Alpine was new to AWS, there were three main project goals: Establish an AWS foundation (account/organization structure, governance, security and networking) to support growth, get a proof of concept of CertMetrics up and running, and equip the Alpine team with the skills needed to confidently manage their AWS environment.

The first step of the foundation was an AWS account strategy to support easy isolation and management of different workloads and environments (e.g., development, testing and production). To achieve this, the team architected an organizational structure aligning with current best practices then implemented those accounts and organizational units (OUs) via AWS Control Tower. Control Tower gave Alpine a “one-stop shop” for account management and simplified single sign-on and the implementation of core security services and guardrails in all accounts.

Once Control Tower’s “out-of-the-box” guardrails were in place, the security and governance work continued. First up were additional, custom guardrails focused on security controls and cost mitigation. From there, the team focused on designing permission sets in AWS Single Sign-On (SSO); these permission sets, when combined with the isolation-focused account strategy, made it straightforward to govern access to infrastructure with fine-grained, role-based access control. Finally, Alpine and 1Strategy utilized AWS Key Management Service (KMS) and AWS Certificate Manager to simplify encryption of data at rest and in transit.

The remaining piece of the foundation was hybrid networking and DNS to support connectivity between AWS and Alpine’s on-premises environment. This was accomplished via a hub-and-spoke architecture utilizing AWS Transit Gateway, a site-to-site VPN and various VPCs, all maintained in (and shared from) a single account. The result was a resilient, easy-to-use network architecture that also protected critical infrastructure—the network resources—in an isolated account. By leveraging Route 53 for DNS management (via inbound/outbound resolvers, resolver rules and private hosted zones), Alpine was able to seamlessly manage connectivity between resources across environments and domains.

Finally, the combined team architected and implemented the Windows-based CertMetrics application on top of this new foundation. To support high availability and automatic scaling in response to load, the web servers were implemented as an autoscaling group fronted by an application load balancer. These web servers utilized an FSx file system, which in turn leveraged AWS Managed Microsoft Active Directory to govern access. An EC2-based SQL Server setup using availability groups provided the right blend of support for database customizations, as well as high availability for the database tier. The result was that the CertMetrics app could then realize the benefits of AWS: stability, high availability (HA), automatic scaling and ease of management.

Just as important as what was accomplished is how it was accomplished: in partnership, with 1Strategy mentoring Alpine every step of the way. Since Alpine was new to AWS, it was critical for the team to become comfortable with working in the cloud. Both teams committed significant time and energy to this effort, and the Alpine team proved to be adept learners. Through regular teaching sessions, pair- and mob-architecting, guided practice with infrastructure as code, and thorough documentation, the team quickly got “AWS ready.”

“I think it was awesome to get our hands dirty and go through the process. It helped us understand the structure, procedure and purpose—then it all started to come together at the end,” said Jim Phay, Alpine system administrator. “We can not only talk the talk, but also walk the walk. We know where we’re strong and where there is room for improvement.”

As a result, the Alpine team is now well-positioned to take CertMetrics forward into production on AWS and is already contemplating the next steps in their cloud journey.

“I’m extremely thrilled with the way this went and the progress that was made,” said Blair Harris, vice president of technology solutions at Alpine. “We’re ready to move things forward. It’s fantastic! Working with 1Strategy on migrating to the AWS cloud has been invaluable for our team. We’ve learned a lot, and we’re ready to take the next steps.”

Alpine is committed to providing an enterprise-level candidate, credential and exam data management experience. Moving to the cloud is the next step in this evolution. AWS gives Alpine the ability to meet client requirements and SLAs while freeing up critical resources to focus on expanding product capabilities. 1Strategy’s expertise and training enabled Alpine to rapidly educate their staff on cloud technologies and establish the framework needed to migrate to AWS.