VeUP
← All case studies
Level 1 MSSP · Glue catalog & ETL
A North American healthcare commercial-intelligence SaaS platformIdentity protected

Healthcare-data platform hardens AWS identity under live incident response

Well-Architected ReviewAdvisoryCentralized workforce identityIdentity federation & MFA enforcementHigh-risk-issue remediation roadmapTarget-state architecture design & costed POCWorkload placement & runtime selectionMigration TCO & business case modellingGo-to-market strategy advisory
Multi-billion-row
healthcare dataset brought under least-privilege access
1 governed path
three identity sources federated to scoped roles
Known-good
credentials rotated, data integrity restored
AWS GlueAmazon S3Amazon AthenaAmazon RDS

Landing 200 TB in Amazon S3 is transport; making it a data platform is cataloging. In this healthcare commercial-intelligence platform’s replatform off Google BigQuery, VeUP made AWS Glue the integration layer that turns the landed estate into governed tables: Glue crawlers discovering structure across the migrated data, the Glue Data Catalog holding the authoritative schema, and Amazon Athena querying it all in place.

The challenge

The platform’s analytics ran over healthcare-provider and medical-claims data at multi-billion-row scale, structured for years around BigQuery’s table model — and BigQuery’s cost model, which was charging warehouse storage rates for data accessed roughly twice a month. Moving to lake economics on AWS only works if the lake stays coherent: every dataset’s schema mapped faithfully from the Google source, structure discoverable rather than tribal, and the whole estate queryable by the product and its analysts on day one. Without a real catalog, a 200 TB lake is just an expensive pile of objects.

The solution

VeUP delivered the integration layer with AWS Glue at its center. The migration’s schema discovery and mapping translated each Google-side structure to its AWS target as the VeUP-built data mover carried the estate from GCS into Amazon S3; Glue crawlers then walked the landed data, inferring and registering structure into the Glue Data Catalog as the single authoritative registry of what the platform holds. That catalog is what makes the rest of the architecture work: Amazon Athena queries the S3 data through it — serverless analytics selected over a provisioned warehouse on the economics — while the Amazon RDS-backed web tier continues serving the customer-facing provider profiles alongside. The result is a lake with warehouse discipline: schemas versioned in the catalog, new datasets registered by crawler rather than by folklore, and every downstream consumer — product, analysts, reporting — reading from one definition of the data.

Production outcomes

KPIResult
Catalog coverageThe full ~200 TB migrated estate cataloged via Glue crawlers into the Glue Data Catalog — multi-billion-row healthcare datasets discoverable and governed from the moment they landed.
Schema fidelitySource-to-target schema discovery and mapping executed as part of the move — BigQuery-era structures preserved as analyzable AWS-native tables, not lossy exports.
Query readinessAthena serving analytics through the catalog with no cluster to operate — the replatformed workload live for the product and its analysts on lake economics.
Lessons & continuationThe catalog is the contract of a data lake — invest in crawlers and schema mapping during the migration, and every future engine, report, and team inherits one truth; skip it, and the lake decays into objects nobody trusts.
AWS services in production

AWS Glue (crawlers + Data Catalog, integration layer) · Amazon S3 (200 TB lake) · Amazon Athena · Amazon RDS (profile web tier) · Amazon CloudWatch