Multi-VPC Architecture
1. Patient Services VPC
Purpose
External-facing healthcare applications.
Hosts
- Application Load Balancer
- Amazon ECS
- Lambda
- Appointment APIs
- Patient Portal
- Mobile APIs
Users
- Patients
- Caregivers
2. Clinical AI VPC
Purpose
Runs AI-powered clinical services.
Hosts
- Amazon Bedrock
- Step Functions
- Lambda
- Prompt Management
- Guardrails
- Amazon Translate
- Amazon Transcribe
- Amazon Polly
Example
Patient uploads voice:
"I've been experiencing chest pain for three days."
Workflow
Speech
↓
Transcribe
↓
Translate
↓
Summarize
↓
Clinical recommendation
↓
Doctor notification
3. Knowledge VPC
Purpose
Enterprise knowledge retrieval.
Contains
- Amazon Q Business
- Amazon Bedrock Knowledge Bases
- Amazon OpenSearch Serverless
- Medical Guidelines
- Clinical SOPs
- Research Papers
- Hospital Policies
- Confluence
- SharePoint
Example
Doctor asks:
"Show the latest hypertension treatment protocol."
Amazon Q Business retrieves trusted hospital knowledge with citations.
4. Software Engineering VPC
Purpose
Used by development teams.
Contains
- Amazon Q Developer
- GitHub Enterprise
- CodeBuild
- CodePipeline
- CodeArtifact
- Development EC2 instances
Example
Requirement
↓
Amazon Q Developer
↓
Generate code
↓
Run tests
↓
Create Pull Request
5. Clinical Data VPC
Highly secured.
Contains
- Amazon Aurora PostgreSQL
- Amazon ElastiCache
- Amazon S3
- DynamoDB
Stores
- Patient records
- Appointments
- Laboratory reports
- Prescriptions
- Medical history
This VPC is accessible only through approved application services.
6. Legacy Hospital Systems VPC
Many hospitals still operate legacy applications.
Contains EC2 instances hosting:
- Hospital Information System (HIS)
- Laboratory Information System (LIS)
- Pharmacy Management
- Billing System
- PACS gateway
- SOAP APIs
These systems cannot be exposed directly to AI services.
Instead:
Bedrock
↓
Lambda
↓
Transit Gateway
↓
Internal Load Balancer
↓
EC2
↓
Legacy HIS
This preserves existing investments while enabling AI-powered workflows.
7. Shared Security & Governance VPC
Dedicated security services include:
- AWS CloudTrail
- AWS Config
- AWS Security Hub
- Amazon GuardDuty
- Amazon Inspector
- Amazon Macie
- IAM Identity Center
- AWS KMS
- AWS Secrets Manager
This VPC continuously monitors the entire AWS Organization.
Multi-AZ Deployment
Every production workload spans multiple Availability Zones.
Example
Availability Zone A
Patient Portal
Lambda
Aurora Writer
EC2
────────────────────────
Availability Zone B
Patient Portal
Lambda
Aurora Reader
EC2
────────────────────────
Automatic Failover
If one Availability Zone fails, patient services remain available.
Networking
Instead of directly connecting VPCs,
the organization uses:
- AWS Transit Gateway
- AWS PrivateLink
- Interface VPC Endpoints
- Gateway Endpoints
- Route 53 Resolver
- Internal Application Load Balancers
- Network Load Balancers
- AWS Network Firewall
This creates a hub-and-spoke architecture with centralized routing and inspection.
Example End-to-End Workflow
A doctor dictates patient notes after an appointment.
- Voice recording is uploaded to Amazon S3.
- Amazon EventBridge starts an AWS Step Functions workflow.
- Amazon Transcribe converts speech to text.
- Amazon Bedrock summarizes the consultation and suggests follow-up actions.
- Amazon Q Business retrieves relevant clinical guidelines and treatment protocols.
- A Lambda function securely updates the patient's Electronic Health Record stored in the Clinical Data VPC.
- A legacy Hospital Information System running on EC2 is notified through an internal Application Load Balancer.
- Amazon Q Developer assists the engineering team in implementing a new feature requested by clinicians, generates code changes, creates tests, and opens a pull request.
- AWS CloudTrail, AWS Config, Security Hub, GuardDuty, and Amazon Macie audit the entire workflow, monitor configuration drift, detect threats, and ensure patient data remains compliant with organizational policies.
No comments:
Post a Comment