Set up a server
GCP
Modernizing end-of-life Linux hosts without touching user configuration
Two long-lived hosts were sitting on an end-of-life distribution: an R Shiny server and a scientific license server. We took the Shiny host through a staged in-place upgrade across LTS releases, rebuilt every R package from source and lost no data. We migrated the license server to a clean current build against a step-by-step runbook we wrote for it, which also cut its disk footprint substantially. We brought user-facing configuration through both unchanged.
- Ubuntu Pro/ESM
- R
- RStudio Server
- Shiny Server
- nginx
- Schrödinger
- Maestro
Network and VPN
AWS + GCP
A highly available VPN between AWS and GCP
Research workloads needed to reach a license server and a directory on the other cloud, so we bridged them first with a single tunnel and then rebuilt that as a highly available dual-tunnel site-to-site VPN. We joined the host on the second cloud to the managed directory domain on the first, documented the full connectivity matrix as a diagram, and narrowed network exposure to the license server alone. We applied later tunnel endpoint changes with BGP verification and no interruption.
- AWS Site-to-Site VPN
- GCP HA VPN
- Cloud Router
- BGP
- AWS Managed AD
- Shared VPC
AWS
Standardizing security group architecture against lateral movement
Security groups had grown per-server, leaving open paths for lateral movement. We proposed a standard built around usage class rather than host (public and private tiers, minimum open ports, VPN as a precondition) and rolled it out development first, production second. We caught the ports missed in the cutover proactively and swept out local administrator accounts outside the domain in the same pass.
- EC2
- Security Groups
- VPC
- AWS SSO
- Site-to-Site VPN
Domain, DNS and SSL
AWS
Recovering from an expired VPN certificate chain
When the certificate authority, server and client certificates behind a managed Client VPN reached their expiry date, every user lost access at once. We traced the cause from the VPN logs to the expired chain, reissued the certificates and redistributed the client configuration the same day, and access came back inside the working session. We wrote up the gap that allowed it (no expiry alerting on the certificate manager) and put renewal on a calendar.
- AWS Client VPN
- ACM
- OpenVPN
- CloudWatch
- PKI
Move to the cloud
AWS + GCP
Migrating a research application stack to the second cloud
Applications we moved from one cloud to the other came out with the usual post-migration breakage, so we rebuilt domain, DNS and TLS around the new addresses. When an integration kept dropping after a fixed number of API calls, we traced it to a missing static external address on the host, and fixed it by assigning one. For a platform that had only been reachable over VPN, we rebuilt access on a managed load balancer with automatic certificates.
- GCP Compute Engine
- Route 53
- AWS ALB
- ACM
- Static IP
- Dotmatics
Backups and monitoring
AWS + GCP
Backup plans and the restores that proved them
We defined daily and weekly backup plans and assigned the critical hosts to them: database, scientific application and directory servers. We used those plans when things broke: we recovered failed builds and corrupted configurations from specific restore points, and on the second cloud we restored a snapshot and swapped the address to put a replacement host in place of a broken one, fast enough to keep the working day.
- AWS Backup
- EBS Snapshot
- GCP Snapshot
- Static IP
- Oracle
Users and access
GCP
Replacing default service accounts across a GCP organization
We brought an unmanaged fleet of research compute instances under a five-phase program (discovery, vulnerability review, decision, execution, documentation) and replaced the default compute service accounts with custom accounts scoped per bucket. We moved the production hosts inside a single planned window with no interruption. Where an instance could not be changed in place, we rebuilt it and carried its data and repository history across intact, then made the mounts durable across reboots.
- Compute Engine
- IAM
- Service Accounts
- GCS
- gcsfuse
- Cloud Logging
AWS
Consolidating research access onto a single identity layer
Domain ownership was still sitting with a departed employee. When that surfaced as a security alarm, we used the opening to build one identity layer instead of patching the old one. We stood up a managed directory with file shares, client VPN and single sign-on on top, closed SSH exposure to the internet and moved compute hosts into a dedicated research network. We separated out the roles that had accumulated on the directory management server and hardened the host.
- FSx
- AWS Managed Microsoft AD
- AWS Client VPN
- AWS SSO
- VPC
- Route 53
AWS + GCP
Scoped data exchange with contract research organizations
We put data sharing with outside research partners on a repeatable pattern instead of ad hoc grants: identities scoped to a single prefix or bucket with no delete rights where that was enough, cross-account bucket policies or presigned URL flows where compliance required it. We passed credentials over an authenticated channel, caught over-broad policies before they shipped, and moved large transfers to multipart upload.
- S3
- GCS
- IAM
- Bucket Policy
- Presigned URL
- Multipart Upload
AWS
Secure desktops for overseas CRO teams
Scientists at an overseas contract research organization needed to work inside the research platform without being issued VPN or directory accounts of their own. We took a managed desktop service from proof of concept to a production architecture (transit gateway peering, a directory connector, scoped network rules), then migrated the estate onto a newer streaming protocol with no loss of access, consolidating the network path in the same move.
- AWS WorkSpaces
- Transit Gateway
- AD Connector
- VPC
AWS
Layered least-privilege access for an outside service provider
When an external provider came in, we gave it a layered access model: a delete-protected operational administrator role bounded by a permissions boundary, named individual identities for each person, MFA required, and elevation routed through an approval workflow. Before the handover, we wrote down what the provider could and could not do.
- AWS IAM
- Permissions Boundary
- IAM Roles
- MFA
- AWS Organizations
Security scan and report
AWS
Closing CIS and HIPAA audit findings, then bringing the audit in-house
We took on the findings from external CIS Controls, CIS Benchmark and HIPAA scans item by item: MFA coverage, key rotation, flow logging, configuration recording. We placed buckets holding regulated data under conformance pack rules with the provider's business associate agreement in place. Over time we moved the assessment itself in-house and made it continuous; threat detection, configuration rules and a security hub took the place of a periodic outside scan.
- AWS Config
- Security Hub
- GuardDuty
- CIS Benchmark
- VPC Flow Logs
- AWS Artifact
Dashboards
AWS + GCP
Organization-wide audit logging with a live dashboard
Storage audit logs sat scattered across a multi-project cloud organization, so we centralized them through an organization-level aggregated sink, sending them to a partitioned analytics warehouse for querying and to an archive bucket for retention. We moved the dashboard off a prototype framework onto a proper application stack and put it behind an internal load balancer, reachable over VPN only. Where the platform's managed certificates could not cover that topology, we terminated TLS on the other cloud and chained it across.
- BigQuery
- Cloud Logging
- Aggregated Log Sink
- Cloud Run
- Internal Load Balancer
- AWS ALB
- ACM
Lower the cloud bill
AWS
Cost cleanup: reclaiming an idle cloud estate
We turned monthly usage and cost reporting into an owned inventory, tagging every instance, volume, image and snapshot and attributing each to a named owner. We confirmed ownership one by one before touching anything, then retired the idle estate: orphaned volumes, stale images, an accumulated snapshot backlog and long-dormant compute. Behind it we put idle-stop routines and a tagging discipline so the estate would not grow back.
- EC2
- EBS
- AMI
- EBS Snapshot
- Cost Explorer
- Compute Optimizer
- Trusted Advisor
Run a research platform
AWS
Building HPC Slurm clusters for scientific workloads
We gave simulation and sequencing workloads scheduler-managed clusters (Slurm on managed cluster infrastructure, GPU node types included) and provisioned them as code, so any cluster could be rebuilt from its template. When a network move broke the controller's reachability, we traced the failure through the scheduler daemon and brought the cluster back. We then reused the same template for later workloads.
- Slurm
- AWS ParallelCluster
- CloudFormation
- EC2 GPU
- VPC
AWS
An Oracle 12c to 19c upgrade for a scientific data platform
Instead of upgrading in place, we cloned the production hosts from the overnight backups into the same placement group, so the test environment matched production exactly. We rehearsed the upgrade on the clone, revalidated the application tier against it, and ran the cutover inside a planned window, keeping the old hosts intact as our rollback path. We carried the same clone-stage-cut pattern through the platform's later development and production lifecycle work.
- Oracle 19c
- EC2
- Placement Group
- AMI
- EBS Snapshot
- Windows Server
AWS
A dedicated account for structural biology and cryo-EM workloads
We moved structural biology and cryo-EM work into its own account, separate from the main estate: cluster scheduling, reconstruction software and a web front end for job submission. We decommissioned the legacy network, peered the new account back to the primary one, bridged directory access with a connector, and carried the license path to the other cloud over the existing VPN. We built governance, lifecycle rules and configuration monitoring into the account from the start.
- AWS ParallelCluster
- CryoSPARC
- Open OnDemand
- VPC Peering
- AD Connector
- AWS Config
AWS + GCP
Standing up and running scientific data analysis platforms
We built development and production instances for two scientific data analysis platforms, and after self-signed certificates proved a dead end we settled TLS permanently on managed load balancers with certificates from the cloud's certificate manager. We integrated single sign-on with the vendor over OIDC and supervised the services so they survived restarts. When the platforms later moved to the second cloud, we carried their access path across intact.
- Dotmatics
- Certara D360
- AWS ALB
- ACM
- Okta OIDC
- EC2