GoBubble migrates 21 workloads from GCP to Amazon EKS with zero downtime

An ML inference API is a uniquely attractive target: every request an attacker sends costs the platform real GPU time, making unfiltered abuse a denial-of-wallet attack even when it never breaches anything. GoBubble’s moderation endpoints are public by design — customers integrate them directly — and the migration’s fixed 12-week window meant edge protection had to ship with the platform, not follow it. The inference plane needed a filtered, observable front door that could tell legitimate integration traffic from floods, probes, and malformed abuse before any of it reached a GPU.

VeUP implemented AWS WAF as a delivered control in the production build. The web ACL sits on the public inference API path — Amazon CloudFront at the edge (with Lambda@Edge handling EMEA/MENA delivery logic), AWS WAF filtering behind it, and the EKS-served GPU inference plane only ever seeing traffic that passed both. The control operates inside the platform’s multi-account AWS Organizations landing zone with IAM Identity Center for workforce access, and its context is continuously verified: AWS Config conformance packs hold the estate’s baseline, GuardDuty watches for threat activity, and Security Hub aggregates findings — including the edge’s — into one queue. Amazon CloudWatch custom metrics and composite alarms tie the WAF’s behavior to the inference plane’s health, so a spike in blocked traffic and a spike in GPU latency are read together.