Executive Summary

Nextnet is a Silicon Valley-based AI Enterprise software company serving the Life sciences and healthcare industry as its first target market. The company has successfully built and deployed a comprehensive AI-powered SaaS platform leveraging AWS managed services and Infrastructure as Code (IaC). This case study demonstrates how AWS CDK and a well-informed choice of AWS services enabled rapid development, consistent deployments across multiple environments, and seamless integration of cutting-edge AI capabilities, while maintaining enterprise-grade security and scalability that can withstand any level of technical tier-1 VC due diligence.

Key Results:

Serverless architecture with a significantly reduced infrastructure management overhead.
Multi-environment deployment (development, staging, production) with consistent configurations and resources isolation/sharing.
AI-powered features using AWS Bedrock with Retrieval-Augmented Generation (RAG) capabilities.
Cross-account security model with automated DNS delegation for automated domain and subdomain management.
Complete infrastructure reproducibility by simply pressing the "Deploy" button.
Modern and secure passwordless authentication flow, powered by AWS Cognito and AWS Amplify Gen 2 at its core.

Project Overview

Business Challenge

Nextnet aims to:

Become the world's most trusted AI knowledge platform for all aspects of human health and well-being.
Provide AI-powered chat and search capabilities, along with a fully interactive, graph-based link analysis grounded in actual scientific evidence.
Instant results despite petabytes of ingested structured, semi-structured and unstructured multimodal data.
Provide scientists not only with a conversation interface but also an immersive exploration tool in the form of a densely interconnected knowledge graph, as well as the ability to switch between them seamlessly.
Handle user authentication, authorisation and a complex matrix of feature-access logic.
Accommodate variable traffic and usage patterns.
Maintain segregated identical environments for rapid iteration, scientific validation by a board of selected industry key opinion leaders, and a guarantee of resilient, fault-tolerant production workloads.
Ensure enterprise-grade security and compliance in preparation for upcoming US and European compliance scrutiny.

Solution Architecture

The solution leverages AWS managed services stacks, orchestrated entirely through AWS CDK, eliminating the need for manual infrastructure provisioning and ensuring consistent, repeatable deployments that are also validated against AWS's Well-Architected principles at build time.

Technical Architecture

Note: The showcased snippets are anonymised excerpts of the IaC deliverable. Front-end code was omitted.

Core Infrastructure Components

1. Frontend & Hosting

// AWS Amplify Gen 2 for serverless, distributed web hosting and more.
const app = new App(this, 'App', {
appName: 'Core Application',
sourceCodeProvider: new CodeCommitSourceCodeProvider({ repository }),
customRules: [CustomRule.SINGLE_PAGE_APPLICATION_REDIRECT],
…
});

AWS Services Used:

AWS Amplify Gen 2: Serverless web hosting with CI/CD and supercharged DX (Developer Experience)
Amazon Route53: DNS management with cross-account delegation
AWS Certificate Manager: SSL/TLS certificate automation
Amazon CloudFront: Global content delivery network
AWS CodeCommit: Git-based code version control.

2. Authentication & API

// AWS Cognito for user management, authentication and authorisation
const userPool = new UserPool(this, 'UserPool', {
customDomain: { domainName: `auth.${domain}` }
…
});

// AWS AppSync for a serverless GraphQL API
const api = new GraphqlApi(this, 'Api', {
authorizationConfig: {
defaultAuthorization: { authorizationType: AuthorizationType.USER_POOL }
}
…
});

AWS Services Used:

AWS Cognito: User authentication and authorization
AWS AppSync: Managed GraphQL API with real-time subscriptions
AWS DynamoDB: NoSQL database with automatic scaling
AWS OpenSearch: Reverse-index full-text search engine.
AWS Amplify Gen 2: The 'auth' and 'data' parts of the framework.

3. AI/ML Integration

// AWS Bedrock Knowledge Base for RAG
const knowledgeBase = new KnowledgeBaseVector(this, "KnowledgeBase", {
id: env.KNOWLEDGE_BASE_ID,
executionRoleArn: env.KNOWLEDGE_BASE_EXECUTION_ROLE_ARN,
});

// AWS Lambda functions with AWS Bedrock integration
backend.chat.resources.lambda.addToRolePolicy(
new PolicyStatement({
actions: ["bedrock:InvokeModelWithResponseStream"],
resources: [`arn:aws:bedrock:*::foundation-model/${modelId}`],
})unknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown nodeunknown node);

AWS Services Used:

Amazon Bedrock: Foundation models (Claude 3.5 Haiku, Claude 3.7 Sonnet, Claude 4 Sonnet, Amazon Titan v2)
AWS S3: For a multimodal document storage
Amazon Bedrock Knowledge Base: RAG
AWS RDS: pgVector-powered vector database
AWS Amplify Gen 2: The AI Kit for agentic conversational and generational logic

4. Storage & Data Management

// AWS S3 buckets for different data types
const storage = defineStorage({
name: "storage",
access: (allow) => ({
"profile-pictures/*": [allow.authenticated.to(["read", "write"])],
"knowledge-base-sources/*": [allow.authenticated.to(["read"])],
}),
});

AWS Services Used:

Amazon S3: Object storage for files, knowledge base sources, and backups
Amazon DynamoDB: Primary database with point-in-time recovery
Amplify Gen 2: For authentication-integrated CDN cloud storage of static assets

Multi-Environment Architecture

Cross-Account Strategy

The solution implements a sophisticated multi-account strategy:

// Production Account
const crossAccountDelegationRole = new Role(this, "CrossAccountRole", {
assumedBy: new AccountPrincipal("111111111111"),
roleName: "CrossAccountDelegationRoleCoreApplicationProduction",
});

// Development Account
const devDelegationRole = new Role(this, "DevDelegationRole", {
assumedBy: new AccountPrincipal("222222222222"),
roleName: "CrossAccountDelegationRoleCoreApplicationDevelopment",
});

Environment Separation:

Production Account: Full production workload with main branch deployment
Development Account: Development environment with basic authentication
Staging (Preview) Account: For thorough validation by the selected board of industry professionals and advisors
Root Account: Centralised domain management and cross-account IAM roles

Key Benefits of AWS CDK Implementation

1. Infrastructure as Code Advantages

Reproducibility: Every infrastructure component is defined in code, ensuring identical deployments across environments.

// Environment-specific configurations
if (process.env.ENV === 'prd') {
const main = app.addBranch('main', {
…
});
} else {
const develop = app.addBranch('develop', {
basicAuth: BasicAuth.fromCredentials('SOME_USERNAME',
SecretValue.unsafePlainText(process.env.SOME_PASSWORD)),
…
});
}

Version Control: All infrastructure changes are tracked, reviewed, and approved through standard development workflows.

Consistency: CDK ensures consistent resource naming, tagging, and configuration across all environments.

Minimalism: The entire deliverable is contained within a single code repository.

2. AWS Managed Services Benefits

Zero Infrastructure Management: By leveraging fully managed services, the team eliminated:

Server provisioning and maintenance
Database administration
Security patching
Capacity planning
Backup management

Most importantly, it could deliver industry-standard functionality on a very tight budget, fast.

Automatic Scaling: Services like DynamoDB, Lambda, and Amplify automatically scale in response to demand, eliminating the need for manual intervention.

Built-in Security: Thanks to the AWS shared responsibility model, managed services provide enterprise-grade security features out of the box:

Encryption at rest and in transit
IAM integration
VPC isolation where needed
Compliance for certifications

3. Cost Optimisation

Pay-per-Use Model: Serverless architecture ensures costs scale directly with usage.

// DynamoDB with on-demand billing
const table = new Table(this, "Table", {
billingMode: BillingMode.PAY_PER_REQUEST,
pointInTimeRecovery: true,
});

No Idle Resources: Lambda functions and other serverless services only incur costs when actively processing requests.

At times, it takes some solution architecture creativity to squeeze every cent out of the monthly AWS bill. But if you're in a good engineering company, you can operate on a very low burn rate. For example, let developers create and destroy a database upon request by sending a Slack message. Automatically destroy the database when it is not in use for 1 hour.

Advanced Features Implementation

AI-Powered Capabilities

Retrieval-Augmented Generation (RAG)

// Knowledge base integration for contextual AI responses
backend.retrieveAndGenerateResponse.resources.lambda.addToRolePolicy(
new PolicyStatement({
actions: ["bedrock:Retrieve", "bedrock:RetrieveAndGenerate"],
resources: [`arn:aws:bedrock:*:*:knowledge-base/${knowledgeBaseId}`],
})
);

Multi-Model AI Strategy

Claude 3.5 Haiku: Keyword generation and lightweight tasks
Claude 3.7 Sonnet: Complex RAG responses and document analysis
Claude 4 Sonnet: Advanced chat functionality and reasoning

Security Implementation

Cross-Account Access Control

const crossAccountPolicy = new PolicyDocument({
statements: [
new PolicyStatement({
actions: ["route53:ChangeResourceRecordSets"],
resources: [hostedZone.hostedZoneArn],
conditions: {
"ForAllValues:StringEquals": {
"route53:ChangeResourceRecordSetsActions": ["UPSERT", "DELETE"],
},
},
}),
],
});

Secrets Management

new secretsManager.Secret(this, "SecretKey", {
secretName: "secret-key",
secretStringValue: SecretValue.unsafePlainText(props.secretKey),
});

Payment Integration

// Stripe event processing with EventBridge
new Payments(backend.createStack('payments'), 'payments', {
destinationId: env.STRIPE_EVENTBRIDGE_DESTINATION_ID,
graphqlApi: backend.data.resources.graphqlApi,
…
});

Deployment Strategy

Environment-Specific Deployments

The CDK configuration automatically adapts based on environment variables:

// Production configuration
if (env.ENV === "prd") {
this.hostedZone = new PublicHostedZone(this, "HostedZone", {
zoneName: "domainname.com",
caaAmazon: true,
});
} else {
// Development configuration
this.hostedZone = new PublicHostedZone(this, "HostedZone", {
zoneName: `${env.ENV}.domainname.com`,
});
}

CI/CD Integration

AWS Amplify provides built-in CI/CD with:

Automatic builds on code commits
Environment-specific deployments
Rollback capabilities
Build artefact management

Performance & Monitoring

Observability Stack

// AWS X-Ray tracing for distributed systems
backend.data.resources.cfnResources.cfnGraphqlApi.xrayEnabled = true;

// AWS CloudWatch logging
const graphQlApiLogsRole = new Role(backend.data, 'GraphQlApiLogsRole', {
assumedBy: new ServicePrincipal('appsync.amazonaws.com'),
managedPolicies: [
ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSAppSyncPushToCloudWatchLogs')
],
…
});

Data Protection

// Point-in-time recovery for all AWS DynamoDB tables
Object.values(
backend.data.resources.cfnResources.amplifyDynamoDbTables
).forEach((tableConfig) => {
tableConfig.pointInTimeRecoveryEnabled = true;
});

Results & Business Impact

Technical Achievements

100% Serverless: Zero server management overhead.
Multi-Region Ready: Architecture supports global expansion.
Auto-Scaling: Handles traffic spikes without manual intervention.
Cost-Effective: Pay-per-use model optimises operational costs.

Development Velocity

Rapid Prototyping: New features deployed in minutes, not hours.
Consistent Environments: Development environments mirror the production environment.
Automated Testing: Infrastructure changes were tested before deployment.
Team Collaboration: Infrastructure changes reviewed, like application code.

Operational Excellence

High Availability: Built-in redundancy across AWS availability zones (AZ).
Disaster Recovery: Automated backups and point-in-time recovery.
Security Compliance: Enterprise-grade security without additional overhead.
Monitoring: Comprehensive observability with minimal configuration.

Lessons Learned & Best Practices

CDK Best Practices Implemented

Environment Parameterisation: Use environment variables for configuration differences.
Resource Tagging: Implement a consistent tagging strategy for accurate cost allocation and management.
Security by Default: Principle of least privilege in all IAM policies.
Modular Design: Reusable constructs for common patterns.

AWS Managed Services Strategy

Prefer Managed Over Self-Managed: Choose managed services to reduce operational overhead
Leverage Service Integration: Use native AWS service integrations for better performance
Plan for Scale: Design with auto-scaling capabilities from day one
Monitor Everything: Implement comprehensive monitoring and alerting

Conclusion

This case study demonstrates how AWS CDK and managed AWS services enable organisations to build sophisticated, AI-powered applications without the traditional infrastructure complexity. By treating infrastructure as code and opting for the right cloud tools, Nextnet achieved:

Faster Time-to-Market: Reduced infrastructure setup from months/weeks to days/hours.
Lower Operational Costs: Eliminated infrastructure management overhead.
Enhanced Reliability: Leveraged AWS's proven managed services.
Improved Security: Built-in enterprise-grade security features.
Scalable Architecture: Ready for global expansion and traffic growth.

The combination of AWS CDK for infrastructure definition and AWS managed services for runtime capabilities provides a robust foundation for modern application development. Organisations looking to build on AWS should strongly consider this approach for its balance of flexibility, reliability, and operational simplicity.

Want to Build it, too?

A few suggestions:

Start with CDK: Begin infrastructure projects with AWS CDK from day one
Embrace Managed Services: Prefer AWS managed services over self-managed alternatives
Implement Multi-Environment Strategy: Plan for development, staging, and production from the beginning
Invest in Monitoring: Implement comprehensive observability early in the project
Plan for AI Integration: Consider AI/ML capabilities as first-class citizens in your architecture

This architecture pattern provides a blueprint for building modern, scalable, and maintainable applications on AWS while minimising operational complexity and maximising development velocity.

This case study represents a real-world implementation of AWS best practices, demonstrating the power of Infrastructure as Code combined with managed services for building production-ready applications.

#case-study