Lasken cuts 3-year TCO 58% in a 6-week healthcare-platform migration to AWS
Amazon EC2
Amazon RDS (SQL Server)
AWS CodePipeline
AWS WAFVeUP migrated Lasken Health’s German digital-health platform from on-premises Windows/IIS VMs to a multi-account, Multi-AZ, Terraformed AWS estate in eu-central-1 (Frankfurt) in six weeks, with the database on RDS for SQL Server Multi-AZ. Result: 58% lower 3-year TCO and ~10x faster releases.
The challenge
Lasken Health’s patient-information-sharing platform — an Angular SPA + ASP.NET (.NET 8) API + Microsoft SQL Server 2022 three-tier app — was built by an external agency and ran on on-premises Windows Server / IIS VMs in a single data center: a single production-only instance with no Dev/Test, no HA, no DR, no infrastructure-as-code, and manual deployments. As a German digital-health platform handling EU patient data, it needed GDPR data sovereignty (in-region hosting), a real SDLC, high availability, and a defensible, auditable architecture — and it needed to move off the agency’s hosting onto an AWS estate it could govern and scale itself.
The solution
A 6-week end-to-end migration (Nov 4 - Dec 13 2024) to a multi-account AWS estate in eu-central-1 (Frankfurt): 1 management + 3 workload accounts (Dev/Test/Prod), production Multi-AZ across two Availability Zones, all defined in Terraform. 7Rs mix: rehost the .NET API tier on Windows EC2 (Auto Scaling); replatform the web tier from Windows/IIS to Linux/Apache on EC2 (eliminating Windows web-tier licensing); replatform the database to Amazon RDS for SQL Server 2022 Multi-AZ (managed backups, PITR, synchronous-standby failover); replace the on-prem SMTP relay with Amazon SES. Edge: Amazon Route 53 -> public ALB (AWS WAF) -> Linux/Apache web tier -> internal NLB -> .NET API tier (private subnets) -> RDS. AWS IAM, KMS, and Secrets Manager replace credentials-in-VMs; AWS CodeBuild + CodePipeline (GitHub -> Dev -> Test -> Prod) replace manual deploys; Amazon CloudWatch for monitoring/logging/alerting.
Production outcomes
| KPI | Result |
|---|---|
| Production outcomes | 58% lower 3-year TCO ($297,135 capability-equivalent on-premises -> $125,949 on AWS incl. migration, with the investment paying back in roughly three months); environments 1 -> 3 (Prod-only -> Dev/Test/Prod) with availability 1 AZ -> 2-AZ Multi-AZ production HA; ~10x faster releases (manual hours -> automated CI/CD minutes); ~100x faster infrastructure provisioning (weeks -> Terraform minutes); disaster recovery none -> RPO/RTO in minutes (RDS Multi-AZ + automated backups); Windows web-tier licensing 100% eliminated; GDPR-aligned-by-architecture in eu-central-1. |
| Engagement window | The six-week migration ran from early November to mid-December 2024, and the platform went live in production in January 2025. |
| Cost / TCO posture | Three-year TCO fell 58% — $297,135 for a capability-equivalent on-premises estate to $125,949 on AWS including the migration — with the investment paying back in roughly three months. Cost governance runs on AWS Budgets and Cost Anomaly Detection, with a quarterly TCO refresh and a monthly cost review. |
| Lessons & continuation | Within a fixed 6-week window, a rehost+replatform 7Rs mix delivers HA, a real SDLC, and a 58% TCO cut without a full refactor — defer containerization (ECS/EKS) and API re-architecture to a phased modernization roadmap; Terraform IaC for all three environments is the load-bearing control for GDPR auditability. |
Amazon VPC
ALB + NLB
Amazon Route 53
AWS IAM
AWS KMS
AWS Secrets Manager
Amazon SES
AWS CodeBuild
Amazon CloudWatch