POS Malaysia's AWS Excellence: Enhancing Security, Reliability, and Cost Optimization

July 28, 2023 | Resonances type: Case study

Executive Summary

Pos Malaysia is the national courier service provider and sole licensee for universal postal services in the country, delivering to more than 10 million addresses across the nation. With a track record of over 200 years, the Pos Malaysia Group has progressed from a traditional postal service into a dynamic mail and parcel services, financial services and supply chain solutions provider with the largest delivery and touchpoint network in Malaysia. Pos Malaysia’s Integrated Parcel Centre (IPC) was upgraded to process over 300,000 items a day. With the growing demand, Pos Malaysia incorporates various technologies to deliver several services to its customers and to realize its vision, “We deliver. We connect. We improve lives.”

AWS Best Practice Recommendations Implemented

Security Pillar

•  Enable IAM key rotation for more than 90 days.
•  Configure password policy to match organization standards.
•  Implement AWS Secrets Manager in SSM parameter.
•  Enable IMDSv2 to secure EC2 instances where IAM roles are enabled.

Reliability Pillar

•  Enable multi-account strategy to plan for DR setup.
•  Enable auto healing layer by leveraging AWS Autoscaling group for business-critical instances.
•  Enable Route53 for more control over the data plane.

Performance Pillar

•  Enable metrics for infra and app layer with application insights to have more control of all layers.
•  Use AWS Config to have a proper audit of all the resources.

Conclusion

The POS Digital account has made significant enhancements across multiple fronts in its AWS environment. These include improved security through the implementation of Multi-Factor Authentication (MFA), adherence to IAM best practices, and the deployment of IMDSv2 to safeguard all EC2 instances. Additionally, the account has bolstered reliability by establishing an auto-scaling group for a highly dependable system, validated through distributed load testing using Apache JMeter. Cost optimization efforts have been prioritized by enabling AWS Compute Optimizer to fine-tune resource allocation and address Reserved Instances (RIs) for cost efficiency. Lastly, security standards have been elevated with end-to-end monitoring spanning both infrastructure and application layers, aided by application insights and the introduction of canary scripts for synthetic monitoring at the web layer to proactively identify and address potential issues.