VeUP
← All case studies
IoT · IoT & Cloud Operations
A clean-energy IoT platform for telecom power infrastructureIdentity protected

Caban hardens a mission-critical IoT energy platform: a 23-finding WAR

Well-Architected ReviewAdvisoryHigh-risk-issue remediation roadmapResilience-gap assessment (RTO/RPO)Cost-optimization deep diveCommitment & RI optimizationStorage tiering & lifecycle policiesStanding cost-optimization mechanismManaged billing & resellObservability-gap assessmentBlast-radius & tenancy isolation reviewTarget-state architecture design & costed POC
23
high-risk findings turned into a phased program
Root cause
one missing IaC foundation behind a whole class of risk
+1 workstream
AWS-referred GenAI invoice automation underway
AWS Well-ArchitectedAWS IoT CoreIoT Device ShadowAmazon RDS

Shared anonymously — the customer’s name is held by VeUP and available on request.

VeUP ran a full AWS Well-Architected Review of the customer's field-deployed IoT energy platform, surfaced 23 high-risk findings across four pillars, then scoped a phased console-to-IaC remediation: VPC isolation, private RDS, a DR strategy, and IoT modernization on MQTT, IoT Device Shadow, and TwinMaker.

The challenge

The customer operates a mission-critical IoT energy platform: field-deployed storage and management devices on telecom sites continuously stream voltage, current, and temperature telemetry to AWS. The platform had grown organically — every piece of infrastructure managed by hand through the AWS console, with no infrastructure-as-code. That one gap was the root cause of a wide class of risk: no automated scaling, no immutable deploys, no repeatable security baselines, publicly reachable databases, internet-facing APIs without network isolation, and no defined disaster-recovery posture. The customer needed an independent assessment and a credible path to operational maturity — without disrupting a platform telecom customers depend on.

The solution

VeUP ran a full AWS Well-Architected Framework Review across Security, Reliability, Cost Optimization, and Operational Excellence, then scoped a phased multi-month remediation and modernization program. The foundational workstream replaces manual console operations with infrastructure-as-code (Terraform/CDK/CloudFormation), with AI-assisted authoring via Amazon Q Developer — the base for automated scaling, immutable deploys, and security baselines. Security remediation introduces VPC isolation, private databases on Amazon RDS, and network segmentation; reliability work defines RTO/RPO targets, a DR strategy, and cross-region replication. On the IoT side VeUP accelerated the roadmap: device telemetry moving from HTTPS to MQTT on AWS IoT Core, plug-and-play device configuration via AWS IoT Device Shadow, and a digital twin of the field fleet explored with AWS IoT TwinMaker. A separate AWS-referred workstream automates invoice validation with generative AI — extracting invoice data, reconciling it against device telemetry, and generating approval recommendations.

Architecture

The estate the customer is moving to — VPC-isolated, Multi-AZ, provisioned entirely as code, with AWS IoT Core, Device Shadow, and TwinMaker at the heart of the fleet — and the hand-operated console estate it leaves behind.

Target-state architecture on AWS: AWS IoT Core (MQTT) with IoT Device Shadow and IoT TwinMaker, a segmented VPC with public and private-app/private-data subnets across two Availability Zones, private Multi-AZ Amazon RDS, Amazon S3, and Security/Observability control rails (KMS, IAM, GuardDuty-class detection, CloudWatch, CloudTrail, VPC Flow Logs), provisioned via Terraform/CloudFormation IaC with CI/CD.
The target estate on AWS — telemetry lands on IoT Core over MQTT, data sits in private Multi-AZ RDS, and every piece is provisioned as code.

Where it started

Assessed baseline · Well-Architected ReviewEnergy-infrastructure IoT — telecom power sites · Manually operated AWS estate
Starting point
A field-deployed device fleet

Energy-storage and management devices on telecom sites, streaming voltage, current, and temperature telemetry to AWS over per-reading HTTPS.

Constraint
Console-managed — no IaC

All infrastructure changed by hand via the AWS Console: no automated scaling, no immutable deploys, no CI/CD — the root cause of 8+ high-risk findings.

Gap
Exposed data and API tiers

Amazon RDS publicly accessible in a default VPC; an internet-facing API tier with no VPN, no segmentation, and IAM access above least privilege.

Gap
No recovery posture

No RTO/RPO targets, no disaster-recovery strategy, no cross-region replication — single-AZ on the critical data tier.

Driver
23 high-risk findings, one root cause

The review traced findings across four Well-Architected pillars back to the hand-operated estate.

The baseline as assessed by the AWS Well-Architected Review that opened the engagement.

Pillar by pillar, what the review found — and where the remediation takes the platform.

Operational Excellence
  • IaC replaces manual console operations
  • CI/CD plan-and-review gate
  • CloudWatch KPI runbook
Security
  • Private subnets with security groups and NACLs
  • KMS-encrypted RDS and S3
  • Least-privilege IAM with detective controls
Reliability
  • Multi-AZ RDS
  • DR strategy: RTO/RPO with cross-region replication
  • Device re-sync and certificate re-issuance on failure
Performance Efficiency
  • MQTT and Device Shadow replace HTTPS polling
  • Compact sub-5KB telemetry payloads
Cost Optimization
  • Serverless analyze path — no idle spend
  • Right-sizing plus commitments for steady-state components
  • Cost-anomaly alerting built into the IaC

Production outcomes

KPIResult
Production outcomesThe Well-Architected Review surfaced 23 high-risk findings across Security, Reliability, Cost Optimization, and Operational Excellence — and turned them into a phased program anchored on a console-to-IaC foundation, with security isolation, disaster recovery, and IoT modernization workstreams. The IoT work is already moving: telemetry shifting from HTTPS to MQTT, device configuration on IoT Device Shadow, and a TwinMaker digital twin under exploration. Post-remediation results and the invoice-processing go-live are still in progress.
Engagement windowAn AWS referral opened the door in late 2025; the Well-Architected Review and Art of the Possible landed in April 2026, and the phased remediation and GenAI invoice-processing builds are now underway.
Cost / TCO postureCost Optimization was one of the four pillars assessed; remediation adds cost-anomaly alerting and right-sizing on the new IaC foundation. The savings themselves land as the roadmap executes.
Lessons & continuationA missing IaC foundation is the single root cause behind a whole class of high-risk findings — fix that first and 8+ HRIs become tractable; provable DR (RTO/RPO + cross-region replication) beats a documented intent; MQTT + IoT Device Shadow is the right telemetry primitive for a frequently-reporting energy fleet versus HTTPS request/response.
AWS services in production
AWS Well-Architected FrameworkAWS IoT Core (MQTT)AWS IoT Device ShadowAWS IoT TwinMakerAmazon RDSAmazon Q DeveloperAWS CDK
Tooling
Terraform