VeUP
← All case studies
Well-Architected Reviews · Resilience & Cloud Operations
Shipium wordmark

Shipium proves multi-region DR on Amazon EKS with an AWS Well-Architected Review

Well-Architected ReviewAdvisoryHigh-risk-issue remediation roadmapDisaster-recovery validationCost-optimization deep diveManaged billing & resellCommitment & RI optimizationStanding cost-optimization mechanismResilience-gap assessment (RTO/RPO)Observability-gap assessmentPer-service spend attribution
Proven DR
cross-region failover exercised with FIS game-days
7
high-risk issues, each with a named owner and timeline
2 Regions
active-active platform independently assessed
Amazon EKSAurora Global DBAWS FISRoute 53

VeUP delivered a six-pillar AWS Well-Architected Review of Shipium's active-active, two-Region SaaS shipping platform on Amazon EKS, surfaced 7 owner-assigned High-Risk Issues with a 30-60-90 roadmap, and validated disaster recovery with AWS Fault Injection Service cross-region game-days.

The challenge

Shipium runs a high-throughput, container-native shipping platform across two AWS Regions on mature Amazon EKS clusters with strong observability. As it scaled, the team needed an independent, structured assessment to surface the gaps engineering velocity outruns — edge protection at ingress, provable disaster recovery, autoscaling driven by application behavior rather than raw CPU, and resilience in the analytics tier — with a prioritized, owner-assigned remediation plan, not just a checklist.

The solution

A full six-pillar AWS Well-Architected Review consolidated in the AWS Well-Architected Tool through a scoped, ExternalId-gated read-only cross-account IAM role, producing a prioritized High-Risk Issue register and a sequenced 30-60-90 roadmap. VeUP then engineered the resilience proof with AWS Fault Injection Service, running cross-region failover game-days against the active-active architecture: Amazon EKS in both Regions (Terraform + Helm), Amazon Aurora PostgreSQL Global Database, Amazon S3 cross-region replication, Amazon ElastiCache global datastores, Amazon Route 53 region swap, and Amazon Redshift Serverless analytics. Representative remediations: piloting an ALB with AWS WAF managed rules at the edge, moving HPA onto application SLOs (RPS, latency, queue depth), and separating analytics via Redshift WLM/QMR. A managed FinOps review surfaced Savings Plans and commitment opportunities across Aurora, ElastiCache, and compute.

Production outcomes

KPIResult
Production outcomesA complete six-pillar Well-Architected Review, run against the live production workload through scoped cross-account access. Seven High-Risk Issues surfaced and prioritized, each assigned to a named customer owner with a remediation timeline, on a sequenced 30-60-90 day roadmap that separates quick wins from larger programs. And disaster recovery proven, not assumed: AWS Fault Injection Service game-days exercised a timed Region-impairment scenario and Route 53 failover against the active-active EKS architecture.
Engagement windowThe Well-Architected Review was delivered at the end of September 2025, with remediations underway and the engagement ongoing.
Cost / TCO postureA managed FinOps review surfaced Savings Plans and commitment opportunities across Amazon RDS/Aurora, ElastiCache, and compute (top spend: RDS, then compute, then caching; resources split across Oregon and Virginia). The savings sit on Shipium's roadmap as recommendations — not claimed outcomes.
Lessons & continuationProvable DR beats documented DR — FIS game-days turn an RTO/RPO target into evidence; autoscaling on application SLOs (RPS/latency/queue depth) tracks real demand far better than raw CPU; edge protection (WAF managed rules) belongs in front of an ingress that previously had none.
AWS services in production
Amazon EKSAmazon Aurora PostgreSQL Global DatabaseAmazon S3 cross-region replicationAmazon ElastiCacheAmazon Route 53Amazon Redshift ServerlessAWS WAFAWS Fault Injection Service

Architecture

The Well-Architected Review took Shipium's active-active platform from an unprotected NLB/NGINX edge and CPU-based autoscaling to an ALB + AWS WAF edge, SLO-driven autoscaling, and isolated Redshift Serverless analytics — with disaster recovery proven through AWS FIS cross-region game-days.

Target-state AWS architecture: the active-active platform in two Regions behind an ALB with AWS WAF managed rules, EKS multi-AZ clusters autoscaling on application SLOs, Aurora PostgreSQL Global Database, ElastiCache Global Datastore and S3 cross-region replication in bi-directional sync, and Redshift Serverless analytics with WLM/QMR separation.
The remediated target state — a protected edge, autoscaling that tracks real demand, both Regions kept in sync, and failover proven with FIS game-days.
Previous-state architecture: active-active Amazon EKS clusters in us-west-2 and us-east-1 with Route 53 failover into an unprotected NLB/NGINX ingress, CPU/replica-based autoscaling, and Redshift Serverless without workload separation.
Where the review started — strong active-active bones, an unprotected edge, autoscaling on raw CPU, and disaster recovery not yet proven.

What the review surfaced, pillar by pillar:

Operational Excellence
  • Review run through the AWS Well-Architected Tool
  • Read-only cross-account role — no standing access
  • 30-60-90 roadmap with named owners per issue
Security
  • ALB with WAF managed rules at the edge
  • Roughly 6ms latency budget for edge protection
  • Secrets Manager synced into EKS
Reliability
  • DR proven in a cross-region game-day
  • Route 53 failover; Aurora Global Database
  • ElastiCache Global Datastore and S3 replication in sync
Performance Efficiency
  • Autoscaling on app SLOs — RPS, latency, queue depth
  • Redshift Serverless workload isolation for analytics
Cost Optimization
  • Savings Plans opportunities flagged across data tier and compute
  • Spend profile mapped across both regions