challenge

At the business level, the company faced limited scalability – on-premises infrastructure made it impossible to quickly scale capacities for peak loads, which directly affected customer experience quality and operational costs. At the process level, the pain had three dimensions. First, development teams spent significant time deploying new environments every time – there was no standardized, secure way to get a ready environment with the required hybrid configuration. Second, the SOC team lacked a single interface for security monitoring – each environment required a separate approach. Third, consumers of internal managed services could not connect to SaaS solutions using corporate credentials with unified billing.

Why now?

The growth in the scale of !FEST operations made manual approaches to infrastructure management unacceptable. At the same time, the demand for data analytics and ML matured – gathering data from the POS network, analyzing user behavior, and building ML models on the on-premises stack was either impossible or too expensive. The need to migrate customer web services to the cloud finally made transformation inevitable.

Fears and how we addressed them

The main concerns at the start related to security and control: how to ensure compliance in a cloud environment at a level familiar to on-premises? Won't the migration become a long and painful process that paralyzes current work? Our answer was the Landing Zone concept as a single controlled gateway between business teams and cloud infrastructure. Instead of letting teams straight into GCP, we designed a structure where security, IAM, and network configuration are built into the architecture itself rather than being manual settings.

solution

We designed, implemented, and automated the deployment of the GCP Landing Zone – a single platform that became the interface between all internal stakeholders and cloud services. Architecturally, the solution covers four levels. Data Project – a central environment for working with data: Cloud Storage and Pub/Sub for collection and streaming, Dataflow for processing, Cloud SQL and Firestore for storage, Cloud ML and Kubernetes for analytics and ML workloads, and Cloud Run for services. Shared Networking Project – a secure hybrid network via VPC, Cloud Interconnect, and Cloud Routes. CI/CD Project – Cloud Source Repositories, CI/CD Pipelines, and Artifact Registry. Monitoring & Audit – a single center of visibility via Cloud Monitoring and Logging, Cloud IAM, Key Management Service, and Cloud Security Scanner.

result

• Development teams gained the ability to autonomously deploy secure environments – without queues and manual configurations from the ops team.

• The SOC team received a single dashboard for monitoring the security of all environments for the first time.

• Consumers of managed services connect to SaaS via corporate credentials with unified billing.

• At the business level, the platform cleared the way for scaling that was previously physically impossible: real-time POS network data processing, ML on actual operational data, and rapid launch of new digital products.