01
Build
The FastAPI service is packaged as a versioned container image and stored in the artifact registry.
Back to selected work
On-Prem / AI Integration
FastAPI Delivery on Hydra / EPaaS with Vault and Self-Service Promotion
An on-premises delivery pattern for FastAPI services, Vault-backed secrets, AI API calls, and use case team-owned artifact and config promotion.
Built a Hydra / EPaaS delivery workflow for FastAPI services using Vault for runtime secrets, upstream AI application and API integration, and self-service promotion of the same artifact and environment config into production.
- Role
- Cloud / DevOps Engineer
- Engagement
- On-prem platform delivery
- Context
- Internal enterprise platform
- Focus
- Vault-backed delivery, team-owned promotion, and AI API integration
The challenge
Making the platform useful, secure, and operable from day one.
Use case teams needed to deploy and promote their own FastAPI artifacts and environment config, including project log streams and metrics, without waiting on the platform team for every release. Runtime secrets needed to come from Vault, and the service still had to call upstream AI applications and APIs safely.
01
Vault was the approved source for runtime secrets.
02
Use case teams needed to promote their own artifacts from lower environments to production.
03
The same immutable artifact needed to move through the promotion path.
04
Environment config included project log streams and metrics.
05
AI API calls needed timeouts, retries, and clear failure handling.
06
Production promotion needed guardrails, traceability, and rollback options.
End-to-end architecture
How the platform connects from user action to operational control.
Scroll horizontally to follow the complete architecture flow.
How I built it
Delivery work from foundation to production operations.
Immutable FastAPI artifact
Containerized the service with Docker and stored a versioned image so every environment received the same tested build.
Vault-backed secrets
Connected FastAPI to Vault for runtime secret retrieval and removed credentials and API keys from source control and images.
Hydra / EPaaS deployment
Created deployment configuration for Hydra and the EPaaS runtime with environment-specific settings kept outside the application.
Self-service artifact promotion
Defined a release flow where use case teams promoted the same image from development and testing into production with review gates.
Project config promotion
Included project log streams and metrics configuration in the promotion path so observability settings followed the release.
AI application integration
Connected FastAPI endpoints to AI applications and APIs using timeouts, retries, and clear error responses.
What changed
Outcomes that made the platform easier to trust and operate.
Secrets stored in Vault
Runtime secret retrieval moved API keys and credentials into the approved Vault path.
Teams own promotion
Use case teams could promote their own artifacts instead of depending on the platform team for every release.
Config moves with release
Project log streams and metrics settings were promoted as controlled environment configuration.
One artifact to production
Promoted the same container image across environments, reducing build drift and release risk.
Reliable AI calls
Added controlled timeout and retry behavior around upstream AI applications and APIs.
Controlled releases
Used deployment checks, traceability, and rollback options before production promotion.
Technology stack
Tools used across the platform.
FastAPIPythonDockerHydraEPaaSVaultArtifact RegistryProject Log StreamsMetrics ConfigurationCI/CD PipelinePrometheusGrafana
Lessons
What I would carry into the next platform.
Runtime secrets should come from Vault, never from source code or image layers.
Promoting one immutable artifact is safer than rebuilding code for every environment.
Use case teams move faster when they own promotion with clear platform guardrails.
Project log streams and metrics should be treated as part of the release config.
AI integrations need the same resilience controls as any other external dependency.
Next case study
Secure GenAI Member Support on AWS
Built and operated the cloud foundation for GenAI-enabled member support workflows, connecting Amazon Connect, event-driven services, container workloads, data stores, and operational guardrails.