/SERVICES

The Challenge

SkeyDrone has a capable and experienced development team and a well-functioning platform on DigitalOcean. As their product matured and their customer base grows the demands on the infrastructure began to evolve.

Aviation-grade reliability and security wasn't optional. The platform handles real-time data from air navigation services, coordinates with air traffic control, and supports regulated flight operations.

Several infrastructure needs came into focus:

• Credential hygiene at scale.
• Network isolation per service.
• Regulatory-grade auditability.
• Modern delivery practices.

SkeyDrone chose NubeX as their infrastructure partner to architect and implement this next-generation platform on AWS.

The Solution

We approached this as a true migration-plus-modernization: not a copy-paste move, but a deliberate redesign of the infrastructure layer to match the security and reliability expectations of an aviation-adjacent platform. Where we work closely together with the SkeyDrone application team, listening to their input and working with that information.

A Purpose-Built AWS Foundation

The AWS environment was designed from day one around a multi-account structure:

• A management account hosting AWS Organizations, IAM Identity Center (federated with Microsoft Entra ID), SCPs, and tag policies
• A shared account for centralized container images (ECR), encrypted with customer-managed KMS keys
• An audit account as the delegated administrator for GuardDuty, Security Hub, AWS Config, Inspector, and IAM Access Analyzer, aggregating security findings across the entire organization
• A backup account for cross-account backup policies and vaults
• Separate workload accounts for production, acceptance, and development, each with its own EKS cluster(s), VPC, and managed services

The entire infrastructure is defined in Terraform and managed through protected pipelines using OIDC-based authentication, no long-lived AWS credentials in CI/CD.

Zero Static Credentials with EKS Pod Identity

One of the most impactful improvements was eliminating static credentials from the workload layer as much as possible. With over 50 microservices across the applications, managing individual passwords for each service's database and storage access was a significant operational and security burden SkeyDrone wanted to get rid off.

EKS Pod Identity solves this cleanly: each pod assumes a scoped IAM role, and temporary credentials are injected automatically by AWS: no secret rotation, no credential leakage risk, no shared access keys.

Microsegmentation with Security Groups for Pods

Kubernetes NetworkPolicies handle pod-to-pod traffic effectively, but they can't cleanly restrict which pods reach managed AWS services like RDS or DocumentDB, those controls live at the VPC level, not inside the cluster.

We implemented Security Groups for Pods (SGP) to close this gap. Each microservice gets its own AWS security group attached directly to its pods:

Together with Kubernetes NetworkPolicies for east-west traffic, this gives the platform true microsegmentation: every service is isolated to exactly the infrastructure it needs, enforced at two independent layers.

Managed Services, Properly Isolated

Self-hosted databases and message brokers were replaced with fully managed AWS equivalents:

• Amazon RDS (PostgreSQL): per-microservice IAM users with scoped access
• Amazon DocumentDB: separate databases per application (Hub vs DAA), dedicated users with readWrite on their own database only
• Amazon MQ for RabbitMQ: separate vhosts per application, per-application credentials
• Amazon ElastiCache (Valkey): cache layer with SG-enforced access

Each managed service's security group is configured to only accept connections from the specific pod security groups that need access, making the access matrix explicit and auditable in infrastructure code.

Tiger Cloud, Managed TimescaleDB via AWS Marketplace

SkeyDrone's platform relies heavily on time-series data: drone telemetry, tracking feeds, and real-time sensor streams. Previously, TimescaleDB ran as a self-hosted workload inside their Kubernetes cluster, adding operational overhead and placing the database lifecycle squarely on the development team's plate.

As part of the migration, we worked together with SkeyDrone and the Tiger Data team (the creators of TimescaleDB and the company behind Tiger Cloud) to evaluate the best path forward. The conclusion was clear: Tiger Cloud, the fully-managed TimescaleDB offering available through the AWS Marketplace, was the right fit. It removes the operational burden of running and tuning a time-series database while keeping the full power of TimescaleDB available to the application.

The key challenge was connectivity. Tiger Cloud runs as a SaaS service, but routing all time-series data over the public internet wasn't acceptable for a platform of this nature. Together with the Tiger Data team, we set up VPC peering between the SkeyDrone AWS VPC and the Tiger Cloud environment. Traffic between SkeyDrone's microservices and the TimescaleDB instance never leaves the AWS network: it stays on the private backbone, with no exposure to the public internet and no data transfer costs between regions.

The result: a fully managed, production-grade time-series database that integrates seamlessly into the private network fabric, with no operational overhead on the SkeyDrone side.

GitOps with ArgoCD and Azure DevOps

Deployments follow a GitOps model with ArgoCD running as a managed EKS capability, no self-managed ArgoCD infrastructure to maintain anymore. Each environment (dev, acc, prod) has its own ArgoCD instance watching its own cluster.

Azure DevOps pipelines build container images, push to ECR, and trigger ArgoCD syncs via project-scoped JWT tokens. The app-of-apps pattern keeps environment configuration clean and composable, adding a new service is as simple as adding an ArgoCD Application manifest and the corresponding Helm values.

Authentication to ArgoCD is handled through IAM Identity Center, no separate ArgoCD user management, no credentials to rotate.

All existing Helmcharts were analyzed and recreated following current best practices and making them as generic as possible with room for options, this allows the team to quickly adopt new microservices that already follow the existing security level out of the box.

Security Perimeter

CloudFront sits in front of all public endpoints, with all ALBs kept internal and only accessible via CloudFront. Each application has its own WAF web ACL with:

• AWS Managed Rule Groups (core protections, known bad inputs)
• Rate limiting tailored to each application's traffic patterns
• WAF logs, VPC Flow Logs, ELB access logs, and EKS control plane logs centralized in the audit account

GuardDuty, Security Hub, and Inspector run organization-wide, with findings aggregated in the dedicated audit account.

The Result

The SkeyDrone platform is now running on a cloud-native AWS foundation that matches the security and reliability expectations of an aviation-grade product. Static credentials have been replaced with identity-based access throughout the stack as much as possible. Network access between services is explicitly defined and enforced at the infrastructure level. Deployments are fully automated, auditable, and reversible.

The SkeyDrone development team brought deep application knowledge to the table, we brought the cloud infrastructure expertise. The result is a platform the team can confidently operate and extend, with the security controls and observability needed to serve their users at scale.

Want to modernize your cloud infrastructure with the same level of care? Get in touch.

/INSIGHTS

Your trusted partner for Cloud Neutral Platform Managed Services