AWS Landing Zone for an AI Video Platformon Terraform and GitOps
An AI platform generating personalised video from patient records, financial portfolios and CRM data ran it all inside one AWS account with no separation between production and test. Kansoft rebuilt the foundation as a governed multi-account landing zone, which is what made regulated verticals sellable.
A regulated data workload on an unregulated foundation.
Datareel generates thousands of hyper-personalised videos from enterprise data, which means its pipelines ingest patient records, financial portfolios and CRM datasets belonging to customers in healthcare, banking, insurance and travel.
Those customers ask architectural questions during procurement. The answers depended on an estate that lived in a single AWS account, where production workloads and test environments shared one security boundary. The product was ready for regulated industries; the infrastructure was not.
Architecture diagram for this engagement is being drawn.
Five limits imposed by a single-account estate.
None of these were visible while the platform served one kind of customer. All of them became blocking the moment a healthcare or banking prospect asked how data was isolated.
No workload separation
Production, staging and development ran in one account with no boundary between them, making blast radius containment impossible and environment-specific access control unenforceable.
Two days to stand up an environment
Provisioning was manual and took roughly 48 hours per environment. Every new client onboarding or vertical expansion queued behind hands-on configuration work.
Governance by convention
With no centralised policies or guardrails, any team could provision anything. Nothing prevented untagged resources, non-approved instance types or configurations that would not survive review.
Regulatory controls that did not exist
Expansion into healthcare, Indian financial services and European markets required architectural controls the estate simply did not have. Processing sensitive data without environment isolation was itself the audit finding.
Engineering time spent firefighting
Manual management produced drift between environments and inconsistent security posture, and the resulting incident volume consumed engineering capacity that belonged to the product.
Start from the regulatory controls, not the Terraform.
Retrofitting isolation onto a running estate is how landing zone projects stall. Mapping HIPAA, GDPR and RBI control requirements to AWS architectural patterns before any code was written is what let the account structure be right the first time.
Foundation
An AWS Organizations multi-account structure with dedicated accounts for production, staging, development, security, logging and shared services, plus cross-account networking and IAM.
Automation
A library of composable, versioned Terraform modules covering VPC design, compute, storage, IAM and security controls, so provisioning is consistent across every account.
Governance
Preventive and detective controls through Sentinel and Open Policy Agent, enforcing tagging standards, restricting resource types and validating security configuration before anything is created.
Self-service
Templates letting product teams provision their own environments inside the guardrails, removing the infrastructure team as a bottleneck without removing the controls.
Built so the guardrails cannot be stepped around.
The point of this architecture is that a non-conforming resource is prevented rather than found later, and every change has a reviewable record.
From one account and a manual runbook to a foundation that provisions itself.
Four measured changes between the single-account estate and the governed landing zone now underneath the platform.
Four changes that mattered as much as the numbers.
The speed figures are what the engineering team feels. The commercial change is that regulated verticals stopped being blocked by an architecture diagram.
Regulated verticals became sellable
Account-level isolation, centralised logging and enforced policy give concrete answers to the architecture questions healthcare, financial services and European prospects ask during procurement.
Onboarding stopped being a bottleneck
A new client environment is a self-service template run rather than two days of manual configuration, so expansion is not rate-limited by the infrastructure team.
Drift stopped recurring
Every environment is defined in version-controlled Terraform and deployed through GitOps, so environments stay identical instead of diverging between deployments.
Engineering time returned to the product
A 60% drop in incidents and a 50–70% drop in infrastructure tickets is capacity moved from firefighting back to the AI pipeline that generates the revenue.
How the work was shaped.
Governance designed in, not bolted on.
Compliance controls added to a running estate produce exceptions, workarounds and an audit trail nobody trusts. Mapping the control requirements of three different regulatory regimes to account structure, network design and IAM before writing Terraform is slower to start and far cheaper to live with. Combining that with policy-as-code guardrails and self-service templates is what lets a platform serve regulated industries without the infrastructure team reviewing every request.
Related Case Studies
Xamarin to .NET MAUI Migration for Manufacturing Mobile Apps
A cement manufacturer moved three business-critical apps from end-of-life Xamarin to .NET MAUI in roughly 15 days each, all at UAT inside four weeks.
Procurement Modernization for Manufacturing on .NET 6 and Angular
A cement manufacturer re-engineered its ASP.NET Web Forms procurement platform into a .NET 6 and Angular stack on Azure, keeping every workflow intact.
Angular Frontend Modernization for Travel Tech from Google Web Toolkit
A travel technology platform moved its back office from Google Web Toolkit to Angular module by module, with both systems live and no disruption.