Federal Cloud Platform Modernization for an Enterprise Application Platform Provider
Extending a Commercial Cloud Platform into AWS GovCloud and Building a Cell-Based Architecture for DoD IL5 Workloads
An enterprise application platform provider needed to expand its cloud architecture to support increasingly demanding federal workloads.
Historically, much of the provider's federal hosting footprint had been concentrated in its existing AWS environments. New federal customer requirements introduced a different challenge: dedicated environments needed to be established in AWS GovCloud (US-West) and integrated with external federal control environments.
At the same time, the company was evolving toward a newer cell-based deployment architecture using Crossplane. That architecture had initially been developed primarily for commercial customers and needed additional controls, configuration options, and infrastructure patterns to support U.S. Department of Defense Impact Level 5 (IL5) workloads.
Stackular designed and implemented the AWS GovCloud environments and networking required for two federal customer deployments and is extending the provider's Crossplane-based cell architecture to support DoD IL5 requirements.
The work is creating a more repeatable federal deployment model while allowing the provider to retain a common platform architecture across commercial and government environments.
Shared platform architecture with an isolated federal deployment profile
- Commercial DeploymentCommercial deployment profile
- Federal Deployment ProfileDoD IL5 enablement in progress
- Federal CellIsolated deployment unit
- AWS GovCloud (US-West)
- Controlled Network Boundary
- Federal Customer Control EnvironmentExternal customer-controlled environment
The Challenge
Supporting federal customers involves substantially more than moving an application into another AWS region.
The provider already operated a mature cloud platform, but new federal deployments required environments in AWS GovCloud (US-West).
The environments needed to integrate with customer-controlled federal infrastructure while maintaining appropriate:
- network boundaries
- routing
- workload isolation
- security controls
- deployment automation
- configuration management
- operational visibility
The networking challenge was particularly significant because the provider's cloud environment could not function as an isolated application environment.
It needed to integrate reliably with a larger federal control environment.
At the same time, the provider's platform architecture itself was changing.
The company was moving toward a cell-based architecture managed through Crossplane, creating an opportunity to build federal requirements into the next generation of the platform rather than continuing to treat every government deployment as a specialized one-off environment.
Designing and Deploying AWS GovCloud Enclaves
Stackular designed and implemented AWS GovCloud enclaves for two federal customers.
The customer identities remain confidential.
The work included establishing the infrastructure in AWS GovCloud (US-West) and designing the networking necessary to connect the application platform with the customers' federal control environments.
This required more than provisioning AWS resources.
The architecture had to account for:
- controlled network boundaries
- routing between environments
- segmentation
- customer connectivity
- platform services
- monitoring
- operational management
- deployment repeatability
The objective was to meet the requirements of the immediate federal deployments while establishing patterns that could support additional government environments in the future.
Why AWS GovCloud Changes the Architecture
A mature SaaS platform often accumulates assumptions about where and how its infrastructure operates.
Those assumptions can become embedded in:
- network topology
- address spaces
- region-specific services
- routing
- automation
- deployment pipelines
- security configuration
- operational tooling
Moving workloads into AWS GovCloud therefore requires more than reproducing an existing commercial-region deployment.
Federal environments need to account for a different operating context and, depending on the workload, additional security and compliance requirements.
Stackular helped extend the platform architecture into that environment while preserving as much of the provider's existing operational model as possible.
Federal Networking Integration
Networking was one of the most challenging aspects of the work.
The AWS GovCloud environment needed to interact with infrastructure controlled outside the provider's platform.
Conceptually, the architecture spans two administrative domains:
Two administrative domains connect through a controlled boundary
- Platform provider environmentEnterprise Application Platform in AWS GovCloud
- Integration boundaryControlled Boundary
- External environmentFederal Customer Control EnvironmentCustomer-controlled administrative domain
The challenge is not simply creating connectivity.
The architecture must establish exactly:
- what can communicate
- where communication can occur
- how traffic is routed
- what boundaries exist
- which systems own each part of the connection
- how failures are detected
- how changes are controlled
This required Stackular to design and implement the networking specifically for the federal operating environment rather than assuming the patterns used for commercial customers would be sufficient.
Building Repeatable Federal Infrastructure
A single successful government deployment is useful.
A repeatable government deployment capability is significantly more valuable.
Without standardization, each new federal customer can become a separate infrastructure project with:
- different automation
- different configurations
- different operational procedures
- different network patterns
Over time, those environments become difficult and expensive to maintain.
Stackular therefore approached the work as a platform-engineering problem.
The objective was to establish patterns that could eventually become standard capabilities of the provider's deployment platform.
Moving Toward a Cell-Based Architecture
The provider is transitioning toward a cell-based deployment architecture.
Rather than operating every customer and workload through a single large shared environment, cell architecture divides the platform into smaller, repeatable deployment units.
Conceptually:
A platform composed of smaller, repeatable deployment units
- Cell A
- Cell B
- Cell C
A cell can contain the infrastructure and services necessary to support a defined set of workloads.
This architecture can provide advantages including:
- workload isolation
- smaller failure domains
- independent scaling
- controlled deployment
- customer segmentation
- regional flexibility
- more predictable infrastructure
Those characteristics are particularly useful when commercial and federal workloads need different security and configuration profiles.
Infrastructure Management with Crossplane
The provider uses Crossplane as a key part of the new cell architecture.
Crossplane allows cloud infrastructure to be exposed through declarative APIs and reusable platform abstractions.
Instead of every application team independently constructing AWS resources, the platform team can define approved infrastructure patterns.
Conceptually:
Crossplane turns platform requirements into approved AWS resources
- InputApplication / Platform Requirement
- Platform APICrossplane API
- Reusable abstractionApproved Infrastructure Composition
- Cloud resourcesAWS Resources
This gives the organization a mechanism for encoding architectural and security expectations into reusable infrastructure components.
Stackular is implementing the Crossplane changes necessary to extend those abstractions for federal deployments.
Extending Commercial Cells for DoD IL5
The original cell architecture was designed primarily for commercial customers.
The next challenge is enabling those same architectural patterns to support DoD IL5 workloads.
Rather than creating a completely separate federal platform, Stackular is implementing additional hooks and controls within the cell architecture.
Conceptually:
Shared cell architecture with commercial and federal profiles
- Commercial ProfileCommercial Cell
- Federal ProfileDoD IL5 Cell — enablement in progress
- Additional Controls
- Federal Networking
- IL5 Configuration
- Security Enforcement
This approach allows the platform to retain common architectural foundations while adding the stricter configuration required by federal workloads.
Designing for DoD IL5
DoD Impact Level 5 applies to workloads requiring stronger protection than lower-impact cloud environments.
For the platform provider, supporting IL5 means federal requirements must influence the infrastructure architecture itself.
Stackular is implementing the capabilities needed for the cell architecture to support areas including:
- stronger environment isolation
- federal network integration
- infrastructure configuration
- security controls
- deployment behavior
- observability
- operational boundaries
- policy enforcement
The work is currently in progress.
The architecture is being designed and implemented for DoD IL5 workloads, but the case study should not claim that the overall platform has completed an IL5 authorization process unless and until that occurs.
Avoiding a Separate Federal Product
One of the most important architectural objectives is avoiding an entirely separate federal version of the software platform.
That pattern often evolves into:
Parallel platforms create separate engineering paths
- Commercial pathCommercial Platform
- Commercial Engineering
- Federal pathFederal Platform
- Separate Federal Engineering
Over time, this creates:
- duplicated code
- duplicated infrastructure
- inconsistent releases
- slower feature delivery
- operational divergence
- additional support cost
The preferred target is:
Common foundations with deployment-specific controls
- Commercial ControlsCommercial Cells
- Federal ControlsDoD IL5 Cells — enablement in progress
This allows the provider to share as much of the product and platform architecture as possible while applying stricter controls to federal deployments where necessary.
Infrastructure as a Platform Capability
The Crossplane work represents a shift from infrastructure automation toward platform engineering.
Instead of maintaining scripts specifically for individual customer environments, the provider can expose standardized infrastructure capabilities.
For example, a deployment could eventually be influenced by characteristics such as:
- deployment class
- cloud partition
- region
- customer type
- network profile
- security profile
- compliance requirements
The infrastructure platform can then translate those requirements into approved AWS resources and configurations.
That provides a much more scalable approach to supporting federal customers than manually customizing each environment.
Key Technical Decisions
Why AWS GovCloud?
Federal workloads can have requirements that make AWS GovCloud the appropriate hosting environment.
Using GovCloud is only one part of the solution, however.
Applications, networks, deployment processes, security controls, and operations still need to be designed appropriately for the workload.
Why AWS GovCloud (US-West)?
The new federal deployments required environments in AWS GovCloud (US-West).
There was no broader architectural claim that the western region itself was inherently preferable.
The platform needed to accommodate the customer's deployment requirement without assuming its existing infrastructure patterns would translate automatically.
Why Dedicated Federal Enclaves?
Dedicated enclaves allow federal workloads to operate within clearly defined infrastructure and network boundaries.
They also create an environment where federal-specific controls can be applied without unnecessarily imposing those requirements on every commercial workload.
Why Is Networking So Important?
Provisioning compute resources is often relatively straightforward.
Integrating a SaaS platform with an externally controlled federal environment is much more complex.
Networking defines:
- trust boundaries
- connectivity
- traffic paths
- segmentation
- operational responsibility
Errors at this layer can affect both availability and security.
Why Cell-Based Architecture?
Cells establish repeatable workload boundaries.
They can improve:
- isolation
- scalability
- regional deployment
- fault containment
- customer segmentation
- policy enforcement
They also provide a natural unit for applying different security profiles.
Why Crossplane?
Crossplane allows a platform team to define reusable infrastructure abstractions.
Those abstractions can encode approved deployment patterns so application teams do not need to understand every low-level cloud implementation detail.
This creates an effective mechanism for making federal infrastructure requirements part of the platform itself.
Why Extend the Existing Platform Instead of Creating a Federal Fork?
A separate federal platform can become expensive to maintain and difficult to keep aligned with the commercial product.
Adding federal controls to a shared architecture allows the organization to maximize common engineering while still enforcing the stricter requirements of DoD workloads.
Results to Date
The broader DoD IL5 cell-enablement work remains in progress, so the case study should distinguish completed work from ongoing work.
Two Federal AWS GovCloud Environments Implemented
Stackular designed and deployed AWS GovCloud environments for two federal customers.
Federal Networking Implemented
Stackular designed and implemented the networking required to integrate those environments with external federal control environments.
AWS GovCloud Expansion
The provider's platform was extended into AWS GovCloud (US-West), requiring new deployment and networking patterns.
Repeatable Federal Architecture Patterns
The work established architectural patterns that can support future federal deployments rather than treating each customer as an isolated infrastructure project.
Crossplane Federal Extensions Under Development
Stackular is implementing the hooks and controls required to extend the provider's next-generation cell architecture to DoD IL5 workloads.
Shared Commercial and Federal Architecture
The target architecture preserves common platform capabilities while allowing federal cells to receive stricter configuration and controls.
Technologies and Architecture
- AWS GovCloud (US-West)
- Network Segmentation
- Routing
- Federal Cloud Enclaves
- Multi-Region / Multi-Environment Cloud Architecture
- DoD IL5
- Federal Workload Isolation
- Declarative Infrastructure
Lessons for SaaS Platforms Entering Federal Markets
GovCloud Is a Hosting Foundation, Not a Complete Federal Architecture
Moving an application into AWS GovCloud does not automatically solve the federal architecture problem.
Organizations still need to design:
- networking
- isolation
- security controls
- operations
- deployment processes
- system integrations
around the requirements of the workload.
Federal Networking Should Be Designed Early
Networking can become one of the most difficult portions of a federal deployment.
It should not be treated as an implementation detail after the application architecture is complete.
Avoid One-Off Federal Environments
A successful first government deployment can easily become a template for continued manual customization.
Instead, identify reusable infrastructure patterns and convert them into platform capabilities.
Build Federal Requirements Into the Platform Roadmap
If government customers are strategically important, federal requirements should influence the platform architecture itself.
Adding federal controls only after a commercial architecture is complete can create significant technical debt.
Share Architecture Where Possible
Commercial and federal environments do not necessarily need separate products.
A shared platform architecture with different security and deployment profiles can significantly reduce engineering fragmentation.
Cells Provide More Than Scalability
Cell architecture can also create useful boundaries for:
- security
- isolation
- failure containment
- customer segmentation
- compliance configuration
This makes cells particularly valuable for regulated and government workloads.
Platform Engineering Can Make Compliance More Repeatable
Crossplane and similar infrastructure platforms can encode approved deployment patterns.
That shifts federal implementation knowledge from individual engineers and one-off scripts into reusable platform abstractions.
Frequently Asked Questions
What is AWS GovCloud?
AWS GovCloud is an isolated AWS environment designed to host sensitive workloads for U.S. government agencies and customers that need to satisfy specific regulatory and compliance requirements.
Using GovCloud does not by itself make an application compliant with a particular federal impact level. The complete system architecture and operating model must satisfy the relevant requirements.
What is a federal cloud enclave?
A federal cloud enclave is a logically isolated cloud environment designed for a government workload and its associated networking, security, operational, and access requirements.
The exact definition and architecture depend on the workload and customer environment.
What is DoD IL5?
Impact Level 5 is a U.S. Department of Defense cloud information impact level for workloads that require stronger protections than lower impact levels.
Supporting IL5 requires appropriate controls across the complete system rather than simply selecting a particular cloud service or region.
Why use a cell-based architecture for federal workloads?
Cells provide independent deployment boundaries that can be useful for:
- isolation
- security configuration
- customer separation
- scaling
- fault containment
A federal cell can therefore use a stricter control profile while still sharing the same fundamental architecture used by commercial cells.
What is Crossplane?
Crossplane is an open-source framework for building cloud infrastructure control planes.
It allows platform engineering teams to expose standardized infrastructure capabilities through declarative APIs.
How can Crossplane help support federal deployments?
Crossplane allows federal infrastructure requirements to be encoded into reusable deployment patterns.
Instead of configuring every federal environment manually, approved network, infrastructure, and security patterns can become part of the platform.
Does supporting AWS GovCloud require rewriting the application?
Not necessarily.
The amount of change depends on how tightly the application and platform are coupled to particular cloud environments.
Applications built around automation, APIs, infrastructure abstraction, and portable deployment patterns are generally easier to extend into new environments.
Why not maintain separate commercial and federal platforms?
Separate platforms can create duplicated engineering, divergent features, slower releases, and increased operational expense.
A common architecture with specialized federal controls can preserve more engineering leverage.
Why is networking often difficult in federal cloud deployments?
Federal environments frequently need to integrate with networks and security controls outside the SaaS provider's own cloud environment.
That creates complex requirements around:
- routing
- segmentation
- trust boundaries
- connectivity
- ownership
- troubleshooting
These concerns often require more architectural work than basic cloud-resource provisioning.
Related Services
Related Case Studies
Application Portfolio Modernization for a Federal Biomedical Research Agency
A federal biomedical research agency relied on a diverse portfolio of custom applications to support scientific, administrative, financial, and operational activities.
