Return
Case of success · Manufacturing | Argentina
Cementos Avellaneda
From fragmented connectivity to a secure and managed cloud platform
Cementos Avellaneda migrated their ERP to SAP RISE on AWS on a secure, redundant platform and 100% versioned in Terraform, designed by Nublit. The cutover was executed without incidents and the operation continues to be managed by the same team that built it.
About the Client
Cementos Avellaneda is one of the most important cement companies in Argentina, with decades of experience in the construction materials industry. With distributed operations and a critical infrastructure that supports both production and administrative and commercial systems, the company embarked on a cloud modernization process to accompany the migration of its ERP system to SAP RISE on AWS and consolidate a secure, scalable, and operationally managed technological foundation.
https://www.cementosavellaneda.com.ar/ Argentina
Needs
1
Eliminating the single point of failure in connectivity The company operated with a single WAN connectivity provider, representing a significant operational risk for an organization with critical systems in continuous production.
2
Establishing a secure and governed AWS Organization from scratch Cementos needed an organized AWS account structure, with organizational-level security controls, federated identity with its corporate directory, and complete traceability of all changes.
3
Guaranteeing robust connectivity with SAP RISE The migration of the ERP to SAP RISE on AWS required private, secure, and highly available connectivity between the customer's on-premises environment and the SAP-managed VPC.
4
Moving from implementation to managed operations with the same team The client was looking for a partner who would not only build the platform, but also operate it in the long term, with deep knowledge of the environment and without rotating teams between the project phase and the support phase.
What was done?
AWS Organization + Secure Landing Zone
A fully-fledged AWS Organization was designed and implemented from scratch with a structure of OUs (Management, Security, Infrastructure, Workloads, Suspended). Four initial accounts were created. Service Control Policies were applied at the organizational level: restriction of regions, protection of immutable logs, requirement of MFA for sensitive operations, blocking of root users, and mandatory encryption of resources.
Federated identity with Microsoft Entra ID
IAM Identity Center was implemented with full federation to the existing corporate directory, eliminating local AWS credentials for end users and centralizing access control through Permission Sets.
Redundant networking with automatic BGP failover
A Transit Gateway was deployed in sa-east-1 as a connectivity hub, with two BGP site-to-site VPNs over different carriers (TASA + Cirion) to eliminate the existing SPOF. A Direct Connect Gateway with Transit VIF over Cirion was configured as the primary route, with automatic failover to VPN in the event of a dedicated link failure. VPC peering across organizations was implemented towards SAP RISE and private DNS resolution via Route53 Resolver outbound to the on-premise TIC HUB.
Infrastructure as Code with Terraform
The entire implementation was versioned in modular Terraform (account-separated), with a Git repository, CI/CD pipelines, and complete technical documentation: architecture diagrams, operational runbooks, and a resource inventory. Upon completion of the project, a formal handoff and training session was conducted with the client’s technical team.
O&M Cloud Managed 8x5 + night guard
Once go-live was achieved, the same team that built the platform took over its monthly operation: active monitoring, incident management with defined SLAs (P1 ≤ 30 min during business hours, ≤ 60 min outside of business hours), IAM administration, backup management, FinOps analysis, and continuous evolution.
Results
Redundant connectivity in production:
Failover BGP between TASA and Cirion operates automatically, ensuring continuity without manual intervention.
Secure cloud platform governed from day 1:
immutable logs, forced encryption, mandatory MFA, and no active root access. The entire environment is auditable and traceable end-to-end.
SAP RISE cutover implementation without incidents:
The ERP go-live was performed over the connectivity designed by Nublit, with active support during the cutover. The migration was completed without operational disruptions.
Infrastructure 100% reproducible with IaC:
The entire environment is versioned in Terraform and documented.
Operation managed continuously with the accumulated knowledge team:
The same team that designed the platform operates it month after month, with monthly reporting of KPIs and documented SLA compliance.
