Build and configure the AWS PoV environment, including VPC, subnets, route tables, security groups and controlled outbound paths.
- Implement AWS DMS for MongoDB CDC, including full load and ongoing change replication from the named secondary.
- Configure DMS endpoints, replication task, checkpointing, CDC latency monitoring and recovery procedures.
- Use AWS DMS to capture ActionEntry, Transaction, Movement and related in-scope collections.
- Route DMS output into Amazon Kinesis Data Streams as the single event log.
- Use Amazon Kinesis Firehose to write immutable raw change history into the S3 event store.
- Build an Amazon S3 event store with Object Lock governance mode, retention controls and replay-ready storage.
- Implement PostgreSQL RDS as the financial ledger target.
- Implement Amazon DynamoDB as the audit target, including single-table design, tenant-scoped keys, on-demand capacity and PITR.
- Use AWS Secrets Manager to store and control access to the read-only MongoDB CDC credential.
- Use AWS KMS customer-managed keys for RDS, DynamoDB, S3, Kinesis, Secrets Manager, pseudonymisation and report signing.
- Configure AWS CloudTrail for account-wide audit logging, including DynamoDB data events.
- Configure CloudWatch logging and metrics for DMS, pgAudit logs, tunnel status, alarms and operational evidence.
- Use VPC Flow Logs to evidence that MongoDB traffic only traverses the approved path.
- Implement AWS Site-to-Site VPN as the preferred encrypted transport path between AWS and the Hetzner private network.
- Define fallback direct controlled access if the VPN path is not available by the required P0 timeline.
- Build CloudWatch alarms, EventBridge rules and Step Functions workflows to suspend CDC automatically when source-impact thresholds are breached.
- Implement a Lambda-based source-impact guard to monitor canary reads, member role, oplog headroom and DMS latency.
- Run reconciliation workloads as containerised Python jobs on ECS Fargate, orchestrated by Step Functions and scheduled by EventBridge Scheduler.
- Run replay tooling as ECS Fargate batch jobs using S3 event-store data and RDS isolated replay schemas.
- Run JMeter load-testing harness on ECS Fargate against the ReThink-IT-provided MongoDB 5.0 replica set.
- Capture DMS lag, JMeter throughput and synthetic-event latency metrics through CloudWatch.
- Implement cross-tenant isolation using tenant-specific IAM roles and DynamoDB LeadingKeys conditions.
- Correlate isolation test cases with CloudTrail, DynamoDB data events and PostgreSQL pgAudit logs.
- Use Terraform 1.5+ for all AWS infrastructure provisioning.
- Use GitHub Actions with OIDC to deploy AWS infrastructure with protected environments, PR plans and apply-on-merge controls.
- Store Terraform state remotely with locking.
- Produce CloudTrail-derived reports proving zero manual AWS console-originated mutations.
- Build Athena-based reporting over CloudTrail logs for deployment evidence.
- Create Glue catalogue and Athena-queryable AI-ready export over partitioned Parquet data in S3.
- Implement S3 quarantine prefixes and alarms for non-conforming events.
- Build OpenSearch projection as an optional P3 component, with fallback to MongoDB and destruction after testing.
- Maintain AWS evidence artefacts including transport-security packs, reconciliation reports, event-loss reports, replay logs, lag reports, CloudTrail reports and teardown evidence.
- Perform AWS teardown and provide empty inventory, zero-billing and destruction confirmation evidence.
- Manage the AWS infrastructure cost envelope, including the Site-to-Site VPN cost within the stated EUR 150/month estimate.