Case Study Main Image

GCP Landing Zone Implementation

Apr 03, 2023

Introduction

A major healthcare insurance provider faced significant challenges in managing its on-premises infrastructure, which was complex and costly to maintain. They sought to modernize their IT infrastructure by migrating to the cloud to improve their data management capabilities, enhance scalability, and reduce infrastructure costs. To achieve this, the client partnered with Intuitive.Cloud, a cloud consulting firm that specializes in cloud architecture design, migration, and optimization. Together, we designed and implemented a Google Cloud Platform (GCP) landing zone that provided a secure, compliant, and scalable foundation for our client’s cloud infrastructure. This case study discusses the challenges, solutions, and results of this successful cloud migration project.

Challenges

  1. Legacy Infrastructure: The client had a complex on-premises infrastructure that was built over many years. This made it challenging to design and implement a cloud architecture that was aligned with their existing network topology and business requirements.
  2. Compliance Requirements: The client is subject to several regulatory requirements, including HIPAA and HITRUST compliance. Ensuring that the GCP landing zone was designed to meet these compliance requirements added an additional layer of complexity to the project.
  3. Data Migration: Moving large amounts of data from on-premises storage to cloud storage can be a complex and time-consuming process. Intuitive.Cloud worked closely with the client to ensure that the data migration was planned and executed smoothly, with minimal disruption to the client's operations.
  4. Testing and Validation: As part of the migration process, the client needed to test and validate the GCP landing zone to ensure that it was working as expected. This required extensive testing and validation, which added additional complexity to the project.
  5. Training and Change Management: Finally, it was important to ensure that the client's IT team was trained in how to use and manage the new cloud infrastructure. This required significant change management efforts to ensure that everyone was comfortable with the new environment and could use it effectively.

Technology Solutions

The technical solutions used in this project helped the client to achieve their goals of modernizing their IT infrastructure, improving their data management capabilities, and reducing infrastructure costs. Intuitive.Cloud team's expertise in cloud architecture design, migration, and optimization helped to ensure that the technical solutions were implemented smoothly and effectively, and that the client's cloud infrastructure was secure, compliant, and scalable.

  1. VPC Network Topology: Intuitive.Cloud designed a VPC network topology for the client that provided secure and isolated environments for different workloads. This allowed the client to segment their network and control access to resources based on user identity and other factors. The VPC network topology also provided a scalable and flexible environment for deploying and managing cloud resources.
  2. IAM Policies: Intuitive.Cloud implemented IAM policies to control access to resources within the GCP landing zone. This included defining roles and permissions for different users and groups, implementing multi-factor authentication (MFA), and enforcing password policies. IAM policies were also used to control access to sensitive data and ensure compliance with regulatory requirements.
  3. Security Controls: Intuitive.Cloud implemented a range of security controls to protect the client's cloud infrastructure. This included configuring firewall rules to control traffic to and from the internet, implementing network segmentation to isolate workloads, and configuring data encryption to protect sensitive data at rest and in transit. Intuitive Cloud also helped the client to develop a disaster recovery plan and implement backup and restore procedures.
  4. Cloud Resource Optimization: Intuitive.Cloud provided guidance on best practices for managing cloud resources and optimizing performance and cost. This included using automation tools to simplify resource management, implementing resource quotas and usage limits, and leveraging GCP's autoscaling capabilities to automatically adjust resource capacity based on demand.
  5. Monitoring and Reporting: Intuitive.Cloud helped the client to implement monitoring and reporting tools to track performance and identify issues in real-time. This included setting up alerts and notifications for key metrics, developing custom dashboards to track usage and costs, and conducting regular performance and capacity reviews.

Network Design:

Brief on Network Design:

The network design follows a hub-and-spoke topology, with a hub VPC network that connects to on-premises networks and spoke VPC networks that contain the workloads. Because VPC network peering is non-transitive, spoke networks cannot communicate with each other directly.

  • A production environment which includes a hub VPC network and multiple spoke VPC networks that contain the workloads.
  • The spoke VPC networks are connected with the hub VPC network using VPC network peering.
  • Connectivity to on-premises locations passes through Cloud Interconnect connections in the hub VPC network.
  • On-premises networks are connected through the Cloud Interconnect instances using separate VLAN attachments.
  • The development environment has the same VPC structure as the production environment.

Security Design:

Brief on Security Design:

The above diagram represents the following:

  • VPC Service Controls defines a perimeter around sensitive resources that helps to restrict access from outside the perimeter.
  • Security Command Center monitors the environment for insecure configurations and threats.
  • A centralized log sink collects audit logs from all projects.
  • Google default encryption at rest encrypts all data that persists to disk.
  • Google default encryption in transit applies to layer 3 and layer 4 network paths.
  • Access Transparency gives you visibility and control over how Google can access your environment.

Resource Hierarchy Design:

Brief on Resource hierarchy:

As shown in the preceding diagram, there were three application environments that have different policies, access controls, regulatory requirements, and processes. The environments are as follows:

  1. Dev and QA environment: This environment is managed by developers who are both internal employees and consultants. They continuously push code and are responsible for quality assurance. This environment is never available to your business' consumers.
  2. Testing environment: This environment is used for regression and application testing, and supports the B2B offerings of the clients who use deployed as Restful APIs
  3. Production environment: This environment hosts all product offerings that are validated, accepted, and launched. The prod environment is subject to Payment Card Industry Data Security Standard (PCI DSS) regulations, uses hardware security modules (HSMs), and integrates with third-party processors for items such as authentication and payment settlements. The audit and compliance teams are critical stakeholders of this environment. Access to this environment is tightly controlled and limited mostly to automated deployment processes.

Implementation Strategy

To achieve this, the client partnered with Intuitive Cloud, a Google Cloud Premier Partner, to design and implement a GCP landing zone. Intuitive.Cloud worked closely with the client to understand their business requirements and regulatory compliance needs. We then developed a landing zone that included the following key components:

  1. Networking: Intuitive.Cloud designed a network architecture that was aligned with the client's existing network topology. This included setting up a virtual private cloud (VPC) with multiple subnets to isolate different workloads.
  2. Security: Intuitive.Cloud implemented a comprehensive set of security controls to ensure that the client's data and applications were secure in the cloud. This included setting up network security policies, access controls, and data encryption.
  3. Identity and access management (IAM): Intuitive.Cloud implemented IAM policies that controlled access to resources within the GCP environment. This included setting up role-based access controls (RBAC) to ensure that users had the appropriate level of access to resources.
  4. Automation: Intuitive.Cloud used Infrastructure as Code (IaC) tools like Terraform and Deployment Manager to automate the deployment and management of resources in the GCP environment. This allowed the client to provision resources quickly and consistently in the cloud.
  5. Monitoring: Intuitive.Cloud implemented a monitoring and logging framework to track and analyze activity within the GCP environment. This provided the client with visibility into their cloud infrastructure and helped them identify and resolve issues quickly.

Conclusion

By partnering with Intuitive.Cloud, the client was able to migrate its on-premises data center to the cloud smoothly and securely. They were also able to achieve their data management goals and regulatory compliance requirements. The GCP landing zone provided the client with a strong foundation for building out its cloud infrastructure, and the automation and monitoring tools made it easy to manage its resources in the cloud.

Main Logo
Rocket