About Organization
NEC
NEC Bahrain is a Central Bank of Bahrain-licensed currency exchange and money transfer specialist serving individuals and corporates across Bahrain. Operating across multiple branches, NEC offers global remittance, wholesale currency services, corporate payroll solutions, and cash center operations. As a regulated financial institution handling high-volume, time-sensitive transactions, NEC operates under strict compliance and auditability requirements set by the Central Bank of Bahrain
Deliver the right solutions on the leading cloud platform
Cloud Consultancy
Unmatched due to SUDO’s wide knowledge and experience with the top three public cloud providers: AWS, Microsoft Azure and Google Cloud, we provide cloud solutions that work uniquely in line with your business model. With our experienced professionals based in Dubai, UAE you’ll be able to gain deep insights into critical trends and opportunities in cloud technologies, access real-time data analytics, and modernize your entire infrastructure.
The Challenge
Shared AWS Organization
Smartex and Accumex ran inside an AWS Organization NEC did not own, with no root access or billing independence.
Inherited Migration Risk
Singapore estate was built under emergency conditions, leaving latent block-level and metadata risk from cold-snapped EBS volumes.
No Landing Zone or Governance Baseline
No Control Tower, no org-wide CloudTrail, no Config baseline, and no infrastructure as code in place.
Fragmented DNS
Authority split across Cloudflare, GoDaddy, and DNS Made Easy with no rehearsed cutover or rollback path.
No Tested DR Position
No second region, no documented RTO/RPO, and no runbook to defend to the Central Bank of Bahrain or auditors.
Complex Hybrid Estate
FortiGate HA, SD-WAN across 26 branches, on-premises AD, and BYOL SQL Server Enterprise had to survive a 36 to 48 hour cutover window.
Why Choose SUDO
SUDO is a trusted AWS Premier Tier Services Partner with deep expertise in large-scale cloud migrations, enterprise security, landing zone design, and hybrid network architecture on AWS. SUDO brings strong experience in migrating mission critical workloads for regulated financial institutions, with a structured approach to governance, compliance, and operational resilience.
The Solution
SUDO rebuilt NEC’s AWS environment from the ground up, choosing redeploy over lift-and-shift to eliminate inherited risk.
- Established an independent NEC-owned AWS Organization with a hardened root, enforced MFA and documented break-glass procedures, plus AWS Control Tower in Singapore with a full OU structure and SCPs applied at the OU level.
- Deployed Account Factory for Terraform and Landing Zone Accelerator, driving a four-repository GitOps model on hardened self-hosted GitLab, with Terraform state KMS-encrypted, locked and replicated to Frankfurt.
- Six waves rebuilt both applications from clean Windows/IIS golden AMIs, restoring databases to EC2 Always On Availability Groups across two AZs and preserving the Enterprise Edition BYOL. The legacy environment served as a fallback through cutover.
- Preserved the inspection path: perimeter VPC with FortiGate HA pair, Transit Gateway hub-and-spoke with segmented routing, centralized egress, all 26 branches re-pointed, partner tunnels revalidated.
- Stood up IAM Identity Center federated to Entra ID, a role-mapped permission-set catalog, PAM gateway for management sessions, and per-account sealed break-glass, over org CloudTrail, Config conformance packs, GuardDuty, Security Hub, and full Huntress MDR integration.
- Consolidated DNS into Route 53 with a 90-day hybrid retention pattern (DNS Made Easy secondary for the legacy zone, Cloudflare kept at the edge for DDoS, GoDaddy retained as registrar) and Resolver endpoints for hybrid resolution.
- Built tiered DR in Frankfurt in parallel with redeployment: warm standby for Accumex-Prod with 15-minute SQL log shipping and Route 53 health-check failover, pilot light for Smartex, backup-only for UAT, then 4 weeks of hypercare with 24×7 Sev1/Sev2 cover and a full handover pack.
Results & Benefits
The rebuild delivered measurable outcomes across independence, compliance, resilience, and cost for NEC Bahrain.
- Full Cloud Independence: NEC now runs its own AWS Organization, its own root, and its own bill, fully separated from Infinios with independent contracts and vendor relationships.
- Zero Transaction Loss: Production moved in a single planned window with no committed transaction loss; legacy was quiesced only after validation gates passed.
- Eliminated Inherited Risk: The rebuild eliminated the inherited EBS and metadata risk from the emergency migration; every account is Control Tower-governed and SCP-constrained from day one.
- Proven DR Posture: The first end-to-end failover test ran during hypercare with measured RTO and RPO against the committed 4-hour / 15-minute Tier 1 targets.
- Audit-Ready from Cutover: Immutable CloudTrail archive with object lock, Config conformance evidence, access-review trails, backup job evidence above 95% success, patch compliance reporting, and a DR test report.
- Real Operational Ownership: NEC holds the IaC repositories, as-built documentation, runbooks, and dashboards, and new accounts are vended through the AFT pipeline as a reviewable pull request rather than a manual build.
- Predictable Economics: ~$16.5K/month steady state, falling to ~$13.2K with 1-year savings plans, with AWS MAP funding, Promotional Credits, and SUDO co investment covering engagement fees, and the EC2 Always On decision preserving the existing SQL license instead of forcing RDS license-included pricing.
