KeyPulse Systems developed a core B2B customer licensing engine engineered to issue cryptographically signed license keys, process billing webhooks, and provide programmatic validation APIs for enterprise client deployments. Following successful verification in local development containers, KeyPulse engaged New Paradigm Systems (NPSys) to design, commission, and validate a secure, highly available, and cost-controlled cloud hosting architecture on Amazon Web Services (AWS).
Migrating out of unmanaged local Docker setups presented acute engineering hurdles common to early-stage SaaS platforms:
Unmanaged Container Runtimes: Local setups executed containers as the root user without health probe instrumentation, non-blocking I/O configuration, or compatibility testing for target cloud hypervisors.
Credential Exposure Risks: Sensitive assets—including database master passwords, JWT cryptographic signing keys, and webhook verification tokens—resided in plaintext configuration files on local developer storage.
Network Layer Vulnerability: The persistence layer lacked network isolation, leaving transactional database tables exposed to broader network routing without zero-trust microsegmentation.
Uncontrolled Cloud Cost Exposure: Standard multi-tier cloud architectures frequently incur unintentional baseline fees (such as managed NAT Gateways at ~$65–$70/month), which would violate the client's strict startup operational budget.
The Solution & Technical Highlights
Serverless Compute on AWS Graviton (ECS Fargate)
Architected container execution on AWS ECS Fargate using 64-bit ARM Graviton infrastructure (0.25 vCPU, 512MB RAM). Graviton provides ~20% cost efficiency over x86 counterparts while matching local Apple Silicon developer environments bit-for-bit. Containers execute under a dedicated non-root user (appuser, UID 1000) to eliminate host privilege escalation vectors.
Zero-NAT Dual-AZ Microsegmentation
Provisioned a custom dual-AZ Virtual Private Cloud (keypulse-vpc, 10.0.0.0/16) in us-west-2 with chained security groups (ALB :443 → ECS :8000 → RDS :5432). By utilizing public subnets with direct public IPs for outbound traffic while locking inbound access strictly to the ALB, NPSys eliminated costly managed NAT Gateways, instantly saving ~$65–$70/month in baseline fees.
Zero-Plaintext Centralized Secrets Governance
Decoupled application configuration from secrets using AWS Systems Manager Parameter Store. Sensitive database URLs, JWT signing tokens, and webhook secrets are stored as KMS-encrypted SecureString parameters and injected directly in-memory at container boot via IAM least-privilege execution roles. Zero plaintext credentials exist in source code or disk.
Application Load Balancer & Health Probing
Deployed an internet-facing Application Load Balancer (keypulse-alb) handling HTTPS traffic on port 443 and forwarding to target group keypulse-tg. Integrated native automated health probing against GET /healthz every 15 seconds, automatically deregistering any container task that fails to query the PostgreSQL database.
Isolated Relational Database (RDS PostgreSQL 16)
Provisioned Amazon RDS PostgreSQL 16 in private database subnets (keypulse-db-subnet-group) on a db.t4g.micro instance with 20 GiB gp3 SSD storage. Public routing is permanently disabled, and ingress is strictly firewalled to accept traffic exclusively on TCP 5432 from the ECS security group.
Proactive Budget Guardrails & ECR Scanning
Implemented an AWS Budgets hard cap policy (keypulse-monthly-cap) set to $200.00/month with automated SNS email notifications at 80% and 100% spend. Configured Amazon ECR with Tag Immutability and continuous Scan-on-Push CVE vulnerability detection, guaranteeing deterministic rollbacks and supply-chain hygiene.
Key Outcomes & Impact
Fully Serverless Operations: Zero EC2 instances to manage, patch, or maintain. Operating on AWS ECS Fargate completely eliminated server administration overhead, OS vulnerability surface, and capacity sizing guesswork.
Ultra-Lean Cost Profile Under $50/Month: By eliminating managed NAT Gateway infrastructure while maintaining strict security group firewalls, the deployment operates safely inside the client's budget framework with projected ongoing baseline costs under $50.00/month.
