01 The Challenge
The client runs a multi-tenant healthcare interoperability platform built on
AWS — a system that ingests, normalizes, and serves clinical data across the full set of
FHIR R4 resource types, integrating AWS HealthLake, DynamoDB, and a fleet of
TypeScript back-end services. The business goal was to re-platform onto Google
Cloud without losing the regulatory posture (HIPAA), the multi-tenant isolation, or
the FHIR/HL7 interoperability the platform is built on.
Two things made this hard. First, the codebase was large and dense: a FHIR service client, a
FHIR service API, and a core application — each supporting every FHIR resource
type — that no single engineer could hand-port on a reasonable timeline. Second,
the move wasn’t a lift-and-shift; it required real architectural decisions on the GCP side:
the eventing backbone, the identity/OAuth2 model, the multi-tenant topology, and the
infrastructure-as-code to stand it all up reproducibly.
02 The Approach
Rather than port the code by hand, Leopard Data co-built an AI migration agent
— written in TypeScript — that runs the conversion as a multi-pass pipeline:
generate documentation of the existing AWS source, feed that documentation back into the model
as context, then produce the ported GCP implementation. The agent runs a standardized,
repeatable analysis across 350+ code bases — producing consistent,
deterministic conversion output at a scale no manual review could match. We brought up
Claude on AWS Bedrock to run the analysis and porting in-environment, used a
second model for cross-checking, and stood up custom MCP servers to give the
agent structured, repeatable tools for the conversion work.
On the architecture side we mapped the AWS services to their GCP counterparts —
HealthLake to the Google Healthcare API, DynamoDB to Firestore, Lambda to
Cloud Run / Cloud Functions — and resolved the harder cross-cutting questions:
- Eventing backbone. Analyzed the non-functional requirements for a common eventing platform (Kafka vs. Pub/Sub vs. EventArc) and built a centralized Pub/Sub + EventArc implementation in the dev environment.
- Vendor-portability. Built a Pub/Sub abstraction layer in Python and TypeScript — with full unit-test coverage — so the platform can move between Pub/Sub and Kafka without rewrites.
- Identity. Evaluated GCP’s OAuth2 capabilities against the incumbent Ping One identity provider for API authentication, and documented the trade-offs for the team.
- Multi-tenancy. Worked through alternative multi-tenant topology options to preserve tenant isolation on GCP for a regulated healthcare workload.
- Infrastructure as Code. Stood up a representative test application — API Gateway, two services calling each other, service accounts — provisioned with Terragrunt and OpenTofu in the dev environment.
