IoT · Fleet-telematics IoT platform

Tenderd: a Control Tower-governed, region-locked AWS landing zone in the UAE

Sovereign in-country landing zonePolicy-enforced region lockData residencyMulti-account segmentationPreventive controlsCentralized immutable audit loggingCentralized workforce identityIdentity federation & MFA enforcementEncryption-at-rest enforcementPrivate connectivity & network isolationInfrastructure-as-code foundationCI/CD delivery pipeline automationDay-2 runbooks & team enablementCloud-to-cloud migrationPhased cutover with parity validationContainer platform modernizationConnected device telemetry & alertingInfrastructure observabilitySecrets management & credential eliminationMigration TCO & business case modellingTarget-state architecture design & costed POC

Eligible

UAE public-sector contracts unlocked by in-country residency

2 → 5

governance and security maturity, five-point CAF scale

standing console access — every change through reviewed Terraform

AWS Control TowerAWS Transit GatewayAmazon MSKAmazon GuardDuty

Tenderd’s platform connects vehicles and heavy equipment across the MENA region — construction, energy, logistics, and marine fleets whose telematics drive utilization, maintenance, and emissions decisions. VeUP delivered the pilot migration off GCP and the production landing zone in me-central-1 that the fleet-IoT and data-engineering workloads run on: governed accounts, hub-and-spoke networking, streaming infrastructure, and security tooling with seven-year immutable log retention.

The challenge

Fleet telemetry is relentless — devices in the field emit around the clock, and the platform that ingests, processes, and analyzes that stream must be always-on through its own re-platforming. Tenderd’s move off GCP had to give the IoT workload a home that regulated and public-sector fleet customers would accept: in-region (the UAE), governed account by account, with the data-engineering plane isolated from production serving, and an audit posture strong enough to answer for years of telemetry. The migration also had to be proven safe on a pilot before the fleet-serving production estate committed.

The solution

VeUP validated the migration path with a GCP-to-AWS pilot on Amazon ECS Fargate, then built the production estate the telemetry lives on. AWS Organizations under Control Tower structures the platform into purpose-built accounts — Security, Log Archive, Network, Finance, Production, Staging, and dedicated Data Engineering Production and Staging accounts, so the telemetry-processing plane scales and fails independently of customer-facing serving. A Transit Gateway hub-and-spoke network with multi-AZ VPCs carries traffic between them; Amazon MSK provides the managed-Kafka streaming layer for fleet telemetry; Google Workspace SSO federates through IAM Identity Center; and the whole estate is Terraform infrastructure-as-code with zero non-admin console access. Security telemetry centralizes too — GuardDuty, Security Hub, Detective, Config, and CloudTrail into a log-archive account with seven-year immutable retention — and the entire estate is region-locked to me-central-1 by Service Control Policy for in-region data residency.

Production outcomes

KPI	Result
Pilot-proven migration	GCP-to-AWS pilot on ECS Fargate validated in-region before production commitment — the fleet workload’s migration de-risked by rehearsal, not hope.
Isolated data plane	Dedicated Data Engineering Production/Staging accounts separate telemetry processing from customer serving — blast radius, cost, and scaling managed per plane.
Audit-grade telemetry estate	Centralized GuardDuty / Security Hub / Detective / Config / CloudTrail with 7-year immutable log retention, on an estate region-locked to me-central-1 — an IoT platform regulated fleet customers can audit.
Lessons & continuation	IoT platforms outlive their devices’ data — build the account structure and retention posture for the telemetry’s whole lifetime; and give the data-engineering plane its own accounts before scale forces the separation mid-incident.

AWS services in production

AWS Organizations / Control TowerAWS Transit Gateway (multi-AZ VPCs)Amazon MSKAmazon ECS (Fargate)AWS IAM Identity CenterAmazon GuardDutyAWS Security HubAmazon DetectiveAWS ConfigAWS CloudTrail

Terraform