Tamil Nadu e-Governance Agency (TNeGA)
Migration and Modernization of WhatsApp Citizen Interaction Services on AWS
Project Overview
The Tamil Nadu e-Governance Agency (TNeGA) operates WhatsApp-based citizen interaction services that enable communication and delivery of government services through WhatsApp Business API.
The existing application environment faced challenges related to scalability, availability, security governance, and operational monitoring. TNeGA required a secure, scalable, and highly available AWS Cloud environment to support growing citizen engagement requirements and future service integrations.
TNeGA partnered with Ilios Digital, an AWS Partner, to design, migrate, and deploy the WhatsApp Bot application using Amazon Web Services (AWS). The engagement focused on improving application availability, strengthening security controls, enabling container-based scalability, and establishing centralized monitoring and operational management while minimizing service disruption.
The solution was deployed in the AWS Mumbai Region (ap-south-1), supporting data residency requirements and government security expectations.
Challenges
The existing application environment presented several operational and technical challenges.
Limited Scalability
The existing application environment had limited capacity to dynamically handle increasing citizen interactions during peak periods. Manual resource provisioning increased operational effort and delayed scaling activities.
High Availability Constraints
Limited redundancy across critical application components increased the risk of service disruptions. The environment required improved availability through Multi-AZ deployment and load balancing.
Security and Compliance
Centralized logging, threat detection, identity governance, and auditability required improvement to align with TNeGA and government security requirements.
Operational Visibility
Limited real-time monitoring and proactive alerting made incident detection, troubleshooting, and operational management more challenging.
Future Growth
The application required a scalable AWS Cloud environment to support additional citizen services, integrations, and increasing messaging workloads.
Project Objectives
Improve application availability through Multi-AZ deployment.
Enable container-based application deployment and horizontal scaling.
Strengthen security, identity management, and governance.
Establish centralized monitoring, logging, and alerting.
Improve operational efficiency and incident management.
Support future expansion of citizen engagement services.
Maintain data residency within the AWS Mumbai Region.
Solution Overview
Ilios Digital designed and implemented an AWS Cloud solution using Amazon Elastic Kubernetes Service (Amazon EKS), managed and self-managed database components, secure networking, and centralized monitoring.
The solution includes Amazon VPC with public and private subnets across multiple Availability Zones, Amazon EKS for containerized application workloads, Amazon RDS for MySQL with Multi-AZ deployment, and supporting services including MongoDB, Redis, and Apache Kafka.
Application traffic is managed through Amazon Route 53, AWS WAF, Application Load Balancer, and Network Load Balancer. AWS security and monitoring services provide identity management, threat detection, vulnerability assessment, centralized logging, and operational alerts.
Architecture Overview
The solution follows a multi-tier, Multi-AZ architecture in the AWS Mumbai Region.
Click the diagram to view it full size.
Four-Phase Migration Approach
Ilios Digital followed a structured migration methodology aligned with AWS best practices.
Assess
- Evaluated the existing application environment and dependencies.
- Identified migration risks, scalability requirements, and security gaps.
- Designed the target AWS architecture.
Mobilize
- Created the AWS account and Landing Zone.
- Configured IAM, Amazon VPC, networking, and baseline security controls.
- Established centralized monitoring and logging.
Migrate
- Deployed Amazon EKS and supporting AWS services.
- Provisioned database, caching, and messaging components.
- Configured load balancers and network connectivity.
- Migrated application workloads while minimizing service disruption.
Optimize
- Prepared containerized workloads for horizontal scaling.
- Implemented cost monitoring and budget alerts.
- Strengthened security controls using AWS-native services.
- Configured monitoring, logging, and operational alerting.
Security and Compliance
Security was a key design consideration throughout the engagement.
Identity and Access Management
Implemented least-privilege IAM roles, multi-factor authentication (MFA), and periodic access reviews.
Threat Detection
Amazon GuardDuty provides continuous threat detection, while Amazon Inspector supports vulnerability assessments.
Data Protection
AWS KMS supports encryption key management, with secure S3 bucket policies and encryption at rest and in transit.
Audit and Logging
AWS CloudTrail records API activity, while Amazon CloudWatch provides centralized monitoring and operational visibility.
These controls support alignment with TNeGA and government security requirements.
Operational Model
Ilios Digital provides operational support through the following activities:
- ✓AWS resource and application monitoring.
- ✓Automated notifications through Amazon SNS.
- ✓Ticket-based incident management with 9x5 support.
- ✓Periodic AWS cost reviews and security assessments.
- ✓Monitoring, troubleshooting, and operational support.
AWS Services
Network Isolation and Connectivity
Services: Amazon VPC
- Provides isolated networking using public and private subnets.
- Distributes application workloads across multiple Availability Zones.
- Uses Internet Gateway, NAT Gateway, route tables, and security groups for controlled connectivity.
- Keeps backend application and database components in private subnets.
Containerized Application Services
Services: Amazon EKS
- Hosts containerized WhatsApp Bot application workloads.
- Uses Amazon EC2 worker nodes based on Graviton and AMD instance families.
- Supports horizontal scaling and application availability across Availability Zones.
- Provides managed Kubernetes orchestration for application deployment and management.
Traffic Management
Services: Application Load Balancer, Network Load Balancer
- Application Load Balancer manages application-layer traffic distribution.
- Network Load Balancer supports network-layer traffic distribution.
- Integrates with AWS WAF for web application protection.
- Improves application availability through health checks and load balancing.
Relational Database Services
Services: Amazon RDS for MySQL
- Hosts relational application data.
- Uses Multi-AZ deployment to improve database availability.
- Supports automated backups and database recovery capabilities.
Data and Messaging Services
Services: MongoDB, Redis, Apache Kafka
- MongoDB provides document-oriented data management.
- Redis supports application caching.
- Apache Kafka handles messaging and event-streaming requirements.
- These services run on Amazon EC2 instances as described in the deployed architecture.
Storage Services
Services: Amazon S3, Amazon EBS
- Amazon S3 stores application backups and deployment artifacts.
- Amazon EBS provides persistent block storage for application and supporting services.
Security and Data Protection
Services: AWS WAF, AWS KMS
- AWS WAF protects application endpoints against common web exploits.
- AWS Key Management Service (AWS KMS) manages encryption keys.
- Supports encryption of data at rest and in transit.
Access Governance
Services: AWS Identity and Access Management, IAM Access Analyzer, AWS Certificate Manager
- IAM roles and policies enforce least-privilege access.
- IAM Access Analyzer helps identify unintended access.
- AWS Certificate Manager manages SSL/TLS certificates.
Security Monitoring and Threat Detection
Services: Amazon GuardDuty, Amazon Inspector, AWS CloudTrail, Amazon CloudWatch
- Amazon GuardDuty provides threat detection.
- Amazon Inspector supports vulnerability assessment.
- AWS CloudTrail records AWS API activity.
- Amazon CloudWatch provides centralized monitoring and alerting.
Operational Monitoring and Notifications
Services: Amazon CloudWatch, Amazon SNS, AWS Backup
- Amazon CloudWatch monitors application and AWS resource metrics.
- Amazon SNS delivers operational notifications and alerts.
- AWS Backup supports centralized backup management.
Business Outcomes
The AWS migration and modernization established a secure and scalable AWS Cloud environment for TNeGA's citizen interaction services.
Improved Availability
- ✓Multi-AZ architecture improves resilience across Availability Zones.
- ✓Load balancing supports reliable application traffic distribution.
Enhanced Scalability
- ✓Containerized workloads on Amazon EKS support horizontal scaling.
- ✓The architecture is designed to accommodate future citizen service expansion.
Stronger Security
- ✓Centralized threat detection and vulnerability assessment.
- ✓Improved identity governance and access controls.
- ✓Centralized audit logging and security visibility.
Operational Efficiency
- ✓Improved incident detection through centralized monitoring.
- ✓Automated notifications and reduced manual operational intervention.
- ✓Structured ticket-based support and operational reviews.
Cost Transparency
- ✓AWS cost monitoring and budget alerts improve visibility into resource consumption.
- ✓Periodic cost reviews support ongoing optimization.
Customer Value
Through the AWS migration and modernization engagement with Ilios Digital, TNeGA established:
- ✓A secure and highly available AWS Cloud environment for citizen interaction services.
- ✓Improved resilience for critical WhatsApp-based application workloads.
- ✓Container-based application deployment with horizontal scaling capabilities.
- ✓Centralized security monitoring, logging, and operational alerts.
- ✓A foundation for future expansion of government digital services.
Why Ilios Digital
- ✓Experience in AWS migration and government-sector workloads.
- ✓Focus on AWS security, governance, and compliance.
- ✓Structured migration methodology aligned with AWS best practices.
- ✓Ongoing AWS managed services and cost optimization support.
Conclusion
The TNeGA WhatsApp Bot modernization engagement demonstrates Ilios Digital's capabilities in migrating and modernizing citizen-facing government applications using AWS services.
By combining Amazon EKS, Multi-AZ database services, secure networking, AWS-native security controls, and centralized monitoring, Ilios Digital established a scalable and resilient AWS Cloud environment to support TNeGA's citizen interaction services and future digital governance initiatives.