CASE STUDY 01 // ENTERPRISE AI SAASAWS ap-south-2 · 100% Terraform

Paatam: Enterprise AI SaaS & Cloud Infra

Architected the full enterprise backend and cloud infrastructure from High-Level Design (HLD) to production deployment. Features a 4-tier tenant hierarchy, 153 live REST endpoints, zero-trust RBAC across 5 roles, and a decoupled serverless AI grading pipeline.

153

Production REST Endpoints

4-Tier

Multi-Tenant Hierarchy

230+

Automated Integration Tests

4 SQS + 4 DLQ

Self-Healing Pipeline

The Engineering Challenge

Synchronous Bottlenecks in AI Exam Evaluation

In educational institutions, grading multi-page handwritten student exam sheets is subject to sudden, extreme traffic spikes. When 35 teachers simultaneously upload classroom exam bundles (averaging 35 multi-page PDF scripts each), synchronous HTTP processing caused:

HTTP 504 Gateway Timeouts while waiting for external OCR and LLM grading APIs
Database connection starvation in PostgreSQL due to hundreds of open connection holds
Orphaned jobs and unrecoverable silent data loss upon transient network interruptions

High-Level Design (HLD)

Architecture & Data Flow

Multi-Tenant Isolation & Sonyflake IDs

Data isolation strictly follows Corporate ➔ Branch ➔ Class ➔ Section governed by zero-trust RBAC middleware across 5 roles (Super Admin, Corporate Admin, Branch Admin, Teacher, Student). Sequential database IDs are replaced with Sonyflake 64-bit distributed IDs to prevent enumeration attacks and guarantee future horizontal sharding capability.

Isolated 3-Tier VPC & RDS Proxy

Deployed in AWS ap-south-2 via Terraform. ECS Fargate containers run in private subnets with NAT Gateway routing. Amazon RDS Proxy sits before PostgreSQL 16, multiplexing thousands of incoming connections into a stable connection pool to eliminate exhaustion.

Decoupled Serverless Queues

Multi-stage asynchronous pipeline: Direct S3 presigned URL uploads trigger SQS queues (ocr-queue, eval-queue) with 15-minute visibility timeouts. Dedicated Dead-Letter Queues (DLQs) retain failed messages for 14 days.

EventBridge Self-Healing Sweeper

An Amazon EventBridge cron trigger runs every 15 minutes, waking a Sweeper Lambda function to query Postgres for orphaned jobs stuck in-flight and automatically re-enqueue them idempotently.

Live Topology Visualizer

Paatam Request & Pipeline Canvas

Click any component to inspect Terraform & cost

Production Ingress & Compute Topology

AWS ap-south-2

BrowserHTTPS :443

Region: AWS ap-south-2 (Hyderabad)IaC: 100% Terraform (S3 State + DynamoDB Lock)

Application Load Balancer

AWS WAF + ALB

$22.50 / mo

est. run-rate

Terminates HTTPS traffic via AWS ACM certificates in ap-south-2. Rate limits abuse (max 2,000 req/5m) and forwards traffic across private ECS target groups.

Key Specifications

TLS 1.3 Termination
Cross-zone load balancing
HTTP/2 enabled
Target health checks :3000/health

Terraform DefinitionHCL

HCL

resource "aws_lb" "main" {
  name               = "paatam-prod-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets            = aws_subnet.public[*].id
  enable_deletion_protection = true
}

Infrastructure as Code

Core Terraform Modules

terraform/modules/ecs_rds_proxy.tf

# RDS Proxy Configuration for Paatam SaaS
resource "aws_db_proxy" "postgres" {
  name                   = "paatam-rds-proxy"
  debug_logging          = false
  engine_family          = "POSTGRESQL"
  idle_client_timeout    = 120
  require_tls            = true
  role_arn               = aws_iam_role.rds_proxy.arn
  vpc_security_group_ids = [aws_security_group.rds_proxy.id]
  vpc_subnet_ids         = aws_subnet.isolated_db[*].id

  auth {
    auth_scheme = "SECRETS"
    description = "PostgreSQL 16 master credentials"
    iam_auth    = "DISABLED"
    secret_arn  = aws_secretsmanager_secret.db_credentials.arn
  }
}

resource "aws_db_proxy_default_target_group" "target_group" {
  db_proxy_name = aws_db_proxy.postgres.name

  connection_pool_config {
    connection_borrow_timeout    = 120
    max_connections_percent      = 90
    max_idle_connections_percent = 50
  }
}