GoBubble migrates 21 workloads from GCP to Amazon EKS with zero downtime

GoBubble’s zero-downtime migration landed a full AWS-native estate — EKS inference plane, data lake, pipelines — inside a fixed 12-week window. An estate built that fast needs a governance layer that keeps it aligned with how it was designed: security-baseline settings that must not quietly loosen, encryption-at-rest that must stay on across every data store, and an audit trail of what changed and when, strong enough to stand up to future scrutiny. Manual review does not scale to a platform where dozens of services change weekly; the baseline had to be codified and continuously evaluated.

VeUP made AWS Config the recording and evaluation layer of the new estate. The configuration recorder captures changes to all resource types across the in-scope accounts and regions, so every mutation of the platform — cluster, network, data store, IAM — has a configuration history. On top of that record, CIS AWS Foundations and AWS Foundational Security Best Practices conformance packs evaluate the estate continuously, turning the security baseline into machine-checked rules — including the encryption-at-rest posture on the data stores — rather than a document. Config history and snapshot files land in an encrypted Amazon S3 bucket for durable evidence, and findings flow into AWS Security Hub, where they sit alongside the platform’s other security signals as one triage queue. Drift is not a quarterly discovery; it is an event with a timestamp and an owner.