Supply chain & logistics · Multi-year AWS migration
A supply chain and logistics company was partway through a multi-year move of its systems into AWS, shifting workloads out of its old data centers and into a new, organized cloud setup. During this kind of move, things break in hard-to-predict ways. A workload would shift over, a connection between systems would suddenly stop working, and an engineer would need a firewall change right away to keep shipments and orders flowing. The change would be made quickly — often broader than necessary and without proper documentation — and the business kept running, but the security shortcut was left for someone to clean up later.
The hard part was the constant pull between moving fast and staying safe. Teams under pressure to keep operations running needed firewall changes within hours to fix broken connections or let newly moved systems talk to each other. Wait too long and the business could be disrupted; cut a corner and it would likely become an audit problem down the line. Over time this produced a steady build-up of overly broad rules and undocumented exceptions.
The real issue was that the speed of the move and the rules meant to keep it secure were working against each other, with nothing in place to balance the two. The line between a genuine emergency and simple convenience kept blurring, and there was no reliable way to make sure temporary exceptions stayed temporary. Leadership wanted to keep the migration moving without ending up with a permanent backlog of loose, unmanaged firewall rules once it was done.
We built a two-tier segmentation model that split enforcement by purpose: Amazon Network Firewall handled macro-segmentation and inspection (broad policies between trust zones, egress filtering, east-west inspection), while security groups handled workload-level micro-segmentation.
Exception governance changed the dynamics entirely. Every temporary exception now requires a business justification, an expiry date, a named owner, and risk acceptance at the right level — exceptions without an expiry simply couldn't be created. Firewall and VPC Flow Logs fed dashboards engineering teams could query themselves, and anti-patterns were documented alongside the patterns so the same debates didn't get relitigated on the next wave.
Completed migration phases with zero blocking incidents attributable to firewall or network policy
Auditable trail for every temporary exception, with automatic expiry forcing review
Reduced network security escalations by ~50% through self-service log visibility
Reusable network security playbook of patterns and anti-patterns adopted for later waves
Open exceptions inherited from hypercare reduced from over 90 to under 25 within two quarters
Velocity and governance only conflict when there's no framework holding them together. Forcing every exception to carry an expiry and an owner let the migration keep its pace while ensuring the security debt got paid down on a schedule — not discovered at audit time.