Dinesh Sai ← All projects

Case study · Cloud & IaCProduction, MedTech

Cloud infrastructure that is reproducible, auditable and cheaper.

Infrastructure as code for medical-device and scientific-instrument software at Danaher (HemoCue and SCIEX): modular Terraform across AWS regions, a self-hosted installer that provisions a full environment in one run, and FinOps work that cut cloud spend by 40%.

  • Role: Lead DevOps Engineer
  • AWS · Terraform · Python
  • HIPAA & GDPR environments
Terraform/main.tf (public lab)
# One subnet per availability zone,
# driven by variables, not copy-paste.
resource "aws_subnet" "subnets" {
  count             = length(var.subnet_cidrs)
  cidr_block        = var.subnet_cidrs[count.index]
  vpc_id            = aws_vpc.main.id
  availability_zone = var.availability_zones[count.index]
}
From a public lab repository. Production modules are confidential.
40%cloud cost reduction
80%faster time-to-deploy
10AWS services in Terraform modules
50%less manual release effort

Results from my work at Danaher, as listed on my resume.

The problem

Regulated software can't run on hand-built infrastructure.

Medical diagnostics software has to prove where it runs and how that environment was built. Every environment must be reproducible, every change traceable, and every account audit-ready for HIPAA and GDPR. Hand-configured cloud resources fail all three, and they also drift from what anyone documented.

The goal was to make every environment a product of code, so dev, staging and production stay alike, auditors can read how they were built, and cost decisions are made on purpose instead of piling up.

What I built

Four pieces of work.

  1. Modular Terraform across regions

    For SCIEX I designed production AWS infrastructure as reusable Terraform modules: VPC, EKS, IAM, RDS, S3, EFS, SES, SQS, CloudFront and Route 53, deployed across multiple regions. For HemoCue I built EKS, VPC, IAM, S3, RDS and security groups to HIPAA- and GDPR-compliant, audit-ready standards.

  2. A self-hosted installer

    I built a Python installer that provisions the AWS infrastructure and then deploys the application with Helm, in one run. Standing up an environment went from a long manual checklist to a repeatable command, and time-to-deploy fell by 80%.

  3. Standardised environments

    Python and Bash automation made provisioning and release identical across dev, staging and production, cutting manual release effort by 50%. Multi-region deployments were standardised the same way.

  4. FinOps

    I rightsized EC2 and RDS instances, planned reserved-instance purchases, and removed idle resources. Together these cut cloud cost by 40% without reducing availability.

Reliability & compliance

Keeping it correct after day one.

Drift and posture

  • Prisma Cloud CSPM enforces security policy in real time across all AWS accounts.
  • Configuration drift is detected continuously, so the code stays the source of truth.
  • IAM least privilege, KMS encryption and CloudTrail audit logging (at Ajmera Infotech).

Resilience

  • Multi-AZ backup and restore for stateful workloads on EKS and RDS.
  • Disaster-recovery simulations, so recovery is rehearsed, not assumed.
  • Blue-green deployment patterns to take the risk out of releases.

Earlier, on AWS-native IaC: at Ajmera Infotech I evaluated and built AWS infrastructure with CDK and CloudFormation (ECS Fargate, API Gateway) for a MedTech platform. That's why I can choose between Terraform and the native tools based on the team, not habit.

In code

Related work you can look at.

Employer infrastructure is confidential. These repositories show the same techniques at a smaller scale.

Stack

Tools used

Want the details?

I can talk through module design, the installer and the FinOps approach in more depth, within what my employer allows.

Get in touch More projects