Skip to content

Standard RaaS Architecture

Source: Confluence — Standard RaaS Architecture (TRIB 53282545)

Overview

Each RaaS customer gets a dedicated AWS account with a standard VPC-based deployment. Customers connect to their Rhapsody instance over a site-to-site VPN through an internet gateway (or optionally a Transit Gateway when HSCN connectivity is also needed).

graph TB
    subgraph Customer_AWS["Customer AWS Account"]
        direction TB
        subgraph VPC["Customer VPC"]
            direction TB
            IGW[Internet Gateway]
            subgraph Public["Public Subnet"]
                VGW[VPN Gateway / Transit GW attachment]
                PROXY["Proxy EC2 Instances\n(Auto Scaling Group, 2 AZs)"]
            end
            subgraph PrivateProd["Private Subnet — Prod (AZ-a)"]
                RAAS_P[Rhapsody EC2 — Prod]
            end
            subgraph PrivateNP["Private Subnet — NonProd (AZ-b)"]
                RAAS_NP[Rhapsody EC2 — NonProd]
            end
            subgraph SecondaryAZ["Secondary Subnet (different AZ)"]
                RAAS_HA[Rhapsody EC2 — HA Failover]
            end
        end
        S3[(S3 Buckets)]
        IAM[IAM Roles]
        R53[Route53 Private Zone]
        SES[SES — Email Relay]
    end

    subgraph Mgmt["RaaS Management Account (640815619001)"]
        MGMT_VPC[Management VPC]
        TGW_MGMT[Transit Gateway]
    end

    CustomerNet[Customer Network] -->|Site-to-Site VPN| IGW
    IGW --> VGW
    VGW --> RAAS_P & RAAS_NP
    VGW -->|Optional: HSCN| TGW_MGMT
    TGW_MGMT <-->|TGW Attachment| VPC
    TGW_MGMT <--> MGMT_VPC

VPN Connectivity

  • There is a site-to-site VPN connection to a VPN Gateway (or Transit Gateway if HSCN is required).
  • The VPN connection goes via the internet gateway of the customer VPC.
  • When a customer stack also needs HSCN connectivity, the VPN connects to the Transit Gateway instead — this shares the TGW with the HSCN management stack.

High Availability

  • A secondary subnet in a different AZ is configured. The Auto-Scaling Group will launch a replacement Rhapsody instance in the secondary AZ if the primary AZ becomes unavailable.

S3 Buckets

Each customer has a set of dedicated S3 buckets:

Bucket Purpose
bootstrap Configuration files used when EC2 instances start
backup Rhapsody area, administration and configuration backups
logs Rhapsody engine logs
support Upload Rhapsody content so support can inspect (may contain PHI — handle carefully)
replica-backup Cross-region replication of backup
replica-logs Cross-region replication of logs
proxy Configuration files for proxy instances

Management VPC

  • Customer stacks connect to the central management VPC via Transit Gateway.
  • The management account (640815619001) provides shared services: proxy instances, HSCN termination nodes, Ansible Tower, and SSM access.

Key AWS Components

Component Purpose
VPC Isolated network per customer
EC2 — Rhapsody Runs the Rhapsody integration engine (prod + nonprod)
EC2 — Proxy Squid proxy; provides outbound internet access from private subnets
S3 buckets Backups, logs, deployment artefacts
Site-to-Site VPN Encrypted connectivity to customer network
Transit Gateway Connects customer VPC to management VPC (and HSCN)
IAM roles Least-privilege access for Ansible, SSM, monitoring
Route53 Private DNS resolution for rhapsody.{env}.{customer}.raas
SES Email relay for Rhapsody alerts
Auto Scaling Group Manages lifecycle of Rhapsody and proxy EC2 instances

Architecture Diagram (DrawIO)

The authoritative DrawIO diagram is maintained in SharePoint:
RaaS Architecture Diagram.drawio