Qualiphy (Healthcare – Amazon EKS + RDS + Compliance)

For this environment, a structured multi-account setup was provisioned to support Dev, Stage, Release and Prod environments, each running in a dedicated Amazon VPC spanning multiple Availability Zones (AZs) to ensure resilience, security, and high availability. All resources are provisioned and maintained through AWS CloudFormation, ensuring Infrastructure as Code consistency across environments.

In the development environment, applications run in Amazon EKS clusters with CI/CD fully automated through AWS Code Pipeline, which integrates with Bitbucket and AWS Code Build. Docker images are stored in Amazon ECR, and new builds are automatically deployed into the cluster. The staging environment mirrors production closely, with EKS worker nodes deployed in private subnets behind an Elastic Load Balancer and integrated with an Amazon RDS MySQL database running in a private subnet with daily backups and 7-day retention. The CI/CD pipeline follows the same flow, ensuring every deployment tested in staging reflects production behavior. In production, highly available EKS clusters run across multiple AZs and serve traffic through an Elastic Load Balancer, while RDS MySQL operates in Multi-AZ mode with automated failover, daily backups, and secure credential management through AWS Secrets Manager.

The network architecture enforces private subnet isolation for all worker nodes, databases, and sensitive workloads. Access is tightly controlled through IAM roles, NAT gateways, and security groups, with AWS Secrets Manager ensuring that credentials remain encrypted, rotated, and centrally managed. Supporting services such as AWS Systems Manager, IAM, S3, and CloudFormation provide centralized management, secure storage, and governance.

The environment is designed with high availability and failure resilience in mind. EKS worker nodes and RDS MySQL are deployed across multiple AZs, with Elastic Load Balancing distributing traffic only to healthy nodes. Amazon EKS leverages AWS’s managed control plane for fault tolerance, while NAT gateways ensure resilient outbound connectivity. At the database layer, MultiAZ RDS MySQL ensures automatic failover, with AWS Backup providing daily snapshots and 7-day retention for point-in-time recovery. During failover or node replacement, Secrets Manager ensures uninterrupted reconnections between applications and services.

Scalability is achieved at every layer. Amazon EKS worker nodes auto scale based on CPU, memory, and custom application metrics in both Stage and Prod. Elastic Load Balancers automatically adapt to traffic spikes, and RDS MySQL supports both storages auto-scaling and read replicas to handle growing workloads. Code Pipeline manages deployments seamlessly, while Amazon S3 provides near-infinite scalability for artifacts, logs, and state files. Secrets Manager scales transparently to manage growing application secrets.

The design balances tradeoffs between Multi-AZ and Multi-Region. The current strategy favors Multi-AZ for cost-efficiency, with AWS Backup configured for cross-region recovery if needed. Similarly, managed services like Amazon EKS, RDS MySQL, and Secrets Manager are leveraged to reduce operational overhead while ensuring reliability and security. Private subnet architecture strengthens data protection but requires precise NAT Gateway and Secrets Manager integration for outbound access and connectivity.

The overall architecture is validated with evidence artifacts, including a multiaccount architecture diagram showing Dev, Stage, Release and Prod environments with EKS, RDS MySQL, Elastic Load Balancers, Code Pipeline, Code Build, and Amazon ECR. Documentation highlights HA and scalability features such as Multi-AZ deployments, RDS MySQL daily backups, EKS auto scaling, and Secrets Manager integrations. Failure handling is addressed comprehensively across the application, database, networking, and credential layers. With AWS Backup, CloudFormation, and Secrets Manager forming the backbone of resilience and automation, this environment ensures that applications remain highly available, secure, and easily recoverable.