Kolkata, India · Open to remote roles

AWS Certified · Solutions Architect – Professional

SumanKumarBera

Senior AWS Cloud & DevOps Engineer

I turn complex business challenges into secure, resilient, and cost-efficient AWS solutions — architecting scalable, production-ready platforms engineered for reliability and real-world impact.

Years

Credentials

40+

Services

60+

Projects

View my work Download resume Get in touch

GitHub LinkedIn Credly

How I work

Engineering approach

Own it end-to-end

Architecture, infrastructure as code, CI/CD, security, and production operations stay in one system, with no handoff that drops context.

Build for reuse

Terraform modules and pipeline templates that survive the original project — reducing configuration drift and the cost of the next deployment.

Integrate security early

OIDC keyless auth, least-privilege IAM, KMS encryption, and compliance controls built into the platform, not added after.

Automate the repeatable

Test gates, commit-SHA images, circuit-breaker rollbacks, and scale-to-zero scheduling — because manual processes degrade under pressure.

Observe before you need to

OpenTelemetry traces, structured logs, CloudWatch alarms, and cost dashboards — instrumented from the start, not added when something breaks.

Reduce cost thoughtfully

Fargate Spot, EventBridge scale-to-zero, and per-project Bedrock attribution, cutting spend where reliability stays intact.

Suman Kumar Bera — Senior AWS Cloud & DevOps Engineer

About

What I do, and what came before

I design the platform, build the pipelines, and stay with the system after it is in production.

Before cloud, at Godrej & Boyce, I worked on defence-grade Linux and networking for autonomous military systems.

AWS Certified Solutions Architect – Professional

Experience

Where I've worked

Mar 2024
Present

aQb Solutions

Kolkata, India

Senior AWS Engineer

Lead cloud and DevOps for a UK automotive-finance and vehicle-leasing client: AWS architecture, infrastructure as code, CI/CD, security, and production operations.

Leadership & Enablement

Own engineering standards for infrastructure as code, CI/CD, and production support across the client development team.
Coach developers to handle routine DevOps tasks on their own, so delivery does not depend on one person.
Add AWS SDK calls to application code and ship them through peer-reviewed pull requests.

Platform & Delivery

Operate a 7-service self-serve microservices platform on ECS Fargate across staging, release, and production — with Claude AI code review as a mandatory PR gate on every service.
Built zero-downtime ECS pipelines: test gates, commit-SHA images, circuit-breaker rollback detection, and post-deploy ALB health checks.
Moved all repositories to OIDC with branch-scoped least-privilege deploy roles — eliminating long-lived AWS credentials from CI/CD.
Consolidated ETL infrastructure into one reusable Terraform module across 5 environments, with Multi-AZ RDS and deletion protection in production.

Scaling & Cost

Architected an elastic Fargate demo platform — 6 app instances from one parameterised Terraform config using setproduct, mixing FARGATE and FARGATE_SPOT with CPU target-tracking and EventBridge Scheduler scale-to-zero.
Designed per-project Bedrock cost attribution: dedicated IAM identities, CUR 2.0 + Athena/Glue pipeline, daily CloudWatch cost dashboard, and 4-tier AWS Budgets alerts.
Provisioned the AWS platform infrastructure (ECS Fargate, DynamoDB, S3, Secrets Manager, SSM Parameter Store) for a 10-portal vehicle-finance funder pricing service replacing a legacy RPA process.

AI Engineering

Provisioned Bedrock access to Anthropic Claude models in Terraform with EU inference profiles, per-project secrets, and keyless CI/CD access via STS external ID.
Architected and delivered an MCP-based AWS investigation agent — 8 audited read-only tools, immutable audit log, automatic secret redaction, 20+ formal delivery phases, 1,689 passing tests.
Deployed an AI compliance call-review service to production on ECS Fargate with full OpenTelemetry tracing and structured logging.

Jan 2023
Mar 2024

Zivanta Analytics

Kolkata, India

Senior AWS Cloud & DevOps Engineer

Migrated multiple production e-commerce platforms to Amazon ECS on Fargate, designing VPC, ALB, IAM, S3, EBS, EFS, SQS, SNS, SES, and Systems Manager infrastructure for availability and scale.
Built GitHub Actions pipelines for Docker-based ECS deployments with automated backups, disaster-recovery procedures, and migration playbooks.

Feb 2020
Jan 2022

Godrej & Boyce

Mumbai, India

Engineer

Worked on defence-grade IT, specialising in Linux and networking for secure, autonomous military systems.
Received an appreciation letter from the Indian Army MSL Regiment for excellence in engineering support.
Named Top Performer 2020–2021 in the PES-Service Department evaluation.

Projects

Selected engineering work

Each card is labelled production, implemented, or still a design. Case studies expand the two largest pieces of work.

AWS Infrastructure Investigation Agent

1,689 tests

Read-only MCP tools for EC2, IAM, ECS, CloudTrail, S3, and SSM. A terminal-state gate stops further evidence collection once a conclusion is recorded, and every response is redacted before it reaches the model.

Python 3.12 MCP Server ECS Fargate GitHub Actions SQLite audit log

Automotive Finance Self-Serve Platform

Production

TypeScript services and a React frontend for vehicle-leasing applications, with RDS PostgreSQL. Each service deploys on its own.

TypeScript ECS Fargate RDS PostgreSQL OIDC CI/CD Claude AI review

Elastic Multi-Tenant Demo Platform

Implemented

A Lambda reverse-proxy keeps task addresses off the internet. A self-deleting EventBridge schedule stops idle environments after an SSM-backed timeout.

Terraform ECS Fargate Spot API Gateway EventBridge Lambda

Bedrock FinOps — Per-Project AI Cost Attribution

Production

Daily CUR 2.0 Parquet exports, queried in Athena, publish a CloudWatch DailyBedrockCostUSD metric per project. Budgets alert at 50%, 80%, 100% actual, and 100% forecast.

Amazon Bedrock CUR 2.0 Athena / Glue CloudWatch Terraform

KMS-Encrypted Alerting Pipeline

Implemented

Alarms publish through a customer-managed KMS key with annual rotation, then SNS, then a Lambda that notifies Slack and email. aws:SourceAccount conditions cover the SNS, SSM, and CloudWatch Logs principals.

KMS CMK CloudWatch SNS Lambda Terraform

AI Compliance Call-Review Service

Production

FastAPI on ECS Fargate processes audio concurrently and calls Amazon Bedrock. Traces and structured logs go to OpenObserve. CORS origins come from Terraform-injected environment variables.

FastAPI OpenTelemetry Amazon Bedrock OpenObserve ECS Fargate

Multi-Environment Terraform ETL Module

Implemented

Production uses db.t3.large. Staging starts at 09:40 IST, runs the ETL at 10:00, and stops at 10:45.

Terraform Modules RDS Multi-AZ ECS 5 Environments

Funder Pricing Service — AWS Platform

Production

A DynamoDB GSI outbox dispatches HMAC-signed events and retries with exponential backoff.

ECS Fargate DynamoDB Secrets Manager SSM OIDC CI/CD

Enterprise Security Scanner

Architecture design · Pre-MVP

An architecture and an early Go 1.26 skeleton, not a delivered product. Planned as 76 sections covering SAST, SCA, SBOM, DAST, containers, Prowler, and CI gates, mapped to PCI DSS, NIST, OWASP ASVS, and CIS. The MCP tool layer accepts Claude, Ollama, or any OpenAI-compatible endpoint.

Go 1.26 SAST / DAST / SBOM Prowler MCP Tool Layer PCI DSS / NIST / OWASP ASVS

System design

Cloud architecture explorer

A representative ECS Fargate layout. Select a component for its role, dependencies, and security notes.

Core path AWS services Security controls Observability

Select a component.

Engineering demo

GitHub-to-production deployment

An ECS Fargate rollout from a GitHub commit through OIDC, Terraform, Docker, ECR, and the service update.

Simulation only. No live AWS changes.

Pipeline stages 0 / 13

deployment-pipeline.yml

$ Waiting for deployment to start…
$ Press "Run deployment" to begin the simulation.

✓ Deployment complete

Status

Healthy

Tasks running

2 / 2

Image tag

sha-a1b2c3d

Duration

—

Rollout

Rolling

Environment

Production

View architecture →

Cloud security

Security controls & trust boundaries

How defence-in-depth controls sit on the request path, including where a suspicious request is stopped.

Select a control.

AI infrastructure

AI agent workflow

How a request moves through the MCP investigation agent. Select a step to see the check it performs.

Demonstrator only. No live AWS queries are executed.

Technical expertise

Technical capabilities

Names in bold are services I have implemented or operated in production. The others are architectural familiarity from the Solutions Architect – Professional certification and related training.

Compute & Containers

Amazon ECS · AWS Fargate · AWS Lambda · Amazon EC2 · Amazon EC2 Auto Scaling · Amazon EKS · Amazon Lightsail

Storage

Amazon S3 · Amazon EBS · Amazon EFS · Amazon S3 Glacier storage classes · AWS Backup

Databases

Amazon RDS (PostgreSQL Multi-AZ) · Amazon DynamoDB · Amazon Aurora · Amazon ElastiCache · Amazon DocumentDB · Amazon MemoryDB

Networking & Content Delivery

Amazon VPC · Elastic Load Balancing · Amazon Route 53 · Amazon CloudFront · Amazon API Gateway · AWS Client VPN

Security, Identity & Compliance

AWS IAM · AWS KMS · AWS Secrets Manager · AWS CloudTrail · AWS IAM Identity Center · AWS WAF · Amazon GuardDuty

AI & Machine Learning

Amazon Bedrock (Claude models, EU inference profiles, per-project IAM identities) · Amazon SageMaker

Management, Governance & FinOps

AWS Systems Manager · Amazon CloudWatch · AWS Budgets · AWS Cost & Usage Report · AWS Config · AWS Well-Architected Tool

Analytics & Application Integration

Amazon Athena · AWS Glue · Amazon EventBridge · Amazon SNS · Amazon SQS · Amazon OpenSearch Service

Developer Tools & Migration

AWS CodePipeline · AWS CodeBuild · AWS CodeDeploy · AWS CodeCommit · AWS Database Migration Service

Container & Serverless Architecture

Amazon ECS · AWS Fargate · AWS Lambda · Amazon API Gateway

Production microservices on ECS Fargate, including a Lambda reverse-proxy that keeps task addresses private, and a mix of Fargate and Fargate Spot with CPU target tracking.

Security & Identity Engineering

AWS IAM · AWS KMS · AWS Secrets Manager · AWS CloudTrail

Deploy roles are scoped to one repository and branch. Customer-managed KMS keys rotate annually. Task roles allow only the API calls that the service makes.

AI Infrastructure & Bedrock

Amazon Bedrock · MCP Servers · EU Inference Profiles

Claude model access is provisioned in Terraform on EU inference profiles, with a separate IAM identity and secret per project.

FinOps & Cost Governance

CUR 2.0 · Amazon Athena · AWS Glue · Amazon CloudWatch · AWS Budgets

Idle Fargate tasks scale to zero, Spot capacity covers suitable workloads, and budget alerts fire at four thresholds.

IaC & CI/CD

Terraform (reusable modules, multi-environment tfvars, for_each cross-product templating), GitHub Actions (OIDC branch-scoped), Jenkins, Bitbucket Pipelines, Docker, Docker Compose, Git

Observability

OpenTelemetry (tracing, structured logging, FastAPI auto-instrumentation), OpenObserve, CloudWatch (alarms, dashboards), New Relic, Zabbix

Compliance

PCI DSS, ISO 27001, OIDC federation, DevSecOps pipeline integration, Model Context Protocol

Languages

Python 3.12 (FastAPI, Flask, boto3, pytest), TypeScript / Node.js, Go, Ruby on Rails, PHP / Laravel, Bash, HCL

Credentials

Certifications & learning

AWS Certified Solutions Architect – Professional, plus selected hands-on labs and industry training.