Automating CI/CD across four environments for a consumer SaaS platform

The client operates a consumer SaaS platform in the devotional-services space, offering a digital platform that connects users with devotional and religious services online. The platform is built as a set of containerised microservices, delivered to end users as a cloud-native, always-on application, and is designed to support features and services across the devotional-services domain through independently deployable, independently scalable components.

• As the platform grew, the client needed a standardised, automated way to build, test, and release its microservices consistently across multiple environments, while keeping each environment securely isolated. CitiusCloud was engaged, under the formal scope of the agreed engagement, to design and operate a multi-environment DevOps automation solution spanning Dev, Stage, Pre-Prod, and Production, covering CI/CD, infrastructure, and security end to end.

Before the engagement, the client released its microservices manually across several environments. With multiple services to coordinate, this manual, error-prone approach was slow, inconsistent, and difficult to scale as the number of services and environments grew.

• This lack of standardisation carried real operational and financial risk: without a dedicated, repeatable release process, service configuration and secrets diverged across environments, causing runtime failures that were hard to trace, and the absence of standardised automation increased operational overhead and delayed releases for the team on top of their regular responsibilities.
• The existing infrastructure also could not cleanly separate or independently scale workloads across environments, which limited visibility into environment-specific issues and left Dev, Stage, Pre-Prod, and Production workloads without proper isolation from one another.

The proposed solution was to re-architect the platform as containerised microservices running on Amazon ECS Fargate, and to automate the entire path from code commit to deployment across all four environments. The approach was sequenced to first establish serverless, independently scalable services with proper network isolation, and then layer fully automated CI/CD, centralised data/configuration management, and end-to-end observability on top of that foundation.

• As part of the solution, 13+ services were deployed as serverless containers on ECS Fargate that scale independently, fronted by an Application Load Balancer with path-based routing and AWS Cloud Map for service discovery. Automated CI/CD was established using GitHub Actions, so that every service builds, tests, is scanned (Trivy) and signed (Cosign), pushes to Amazon ECR, and deploys to ECS automatically on each push, removing all manual release steps. Persistence, caching, messaging, and configuration were consolidated on managed AWS services (RDS PostgreSQL, ElastiCache Redis, Amazon MQ, and S3), simplifying operations across environments.
• On the architecture side, separate VPCs and security groups were configured per environment with VPC peering, ensuring Dev, Stage, Pre-Prod, and Production workloads cannot cross boundaries. Centralised secrets management (Secrets Manager), TLS via ACM, edge protection through CloudFront and WAF, and full observability via CloudWatch logs, metrics, and SNS alarms were put in place.

The solution was delivered primarily on Amazon ECS Fargate, using AWS Cloud Map for service discovery and an Application Load Balancer for path-based routing across 13+ containerised microservices. GitHub Actions drove the automated CI/CD pipeline, with Docker used for containerisation, Trivy for vulnerability scanning, Cosign for image signing, and Amazon ECR as the container image registry.

• Data, messaging, and configuration were handled through RDS PostgreSQL, ElastiCache (Redis), Amazon MQ (RabbitMQ), and S3, while networking and security were reinforced through VPC, Route 53, IAM, Secrets Manager, ACM, CloudFront, and WAF. CloudWatch and SNS worked together to provide logging, metrics, and alerting.

The engagement eliminated manual deployment effort by replacing hand-run release steps with fully automated pipelines across 13+ microservices and four environments, removing the errors that came with manual releases. Pay-as-you-go Fargate and managed AWS services also reduced operational cost by removing idle infrastructure and ongoing maintenance overhead, while standardised pipelines enabled faster, more frequent, low-risk deployments across every environment.

• Beyond the process improvements, the client gained serverless containers that scale automatically with demand, per service and per environment. Secrets management, least-privilege IAM, image scanning/signing, and WAF strengthened the platform's overall security posture, and network-isolated, multi-AZ infrastructure gave the client clearer separation of responsibility between Dev, Stage, Pre-Prod, and Production.