How Orbitra Scaled Graph Data Ingestion Securely with Serverless and On-Demand AWS Fargate.

Logiciel Solutions, an AWS Partner, designed and deployed a secure, event-driven data platform for Orbitra on AWS. It pairs AWS Lambda for lightweight orchestration with on-demand Amazon ECS on AWS Fargate tasks for compute-heavy Neo4j graph ingestion.

Every compute and data resource runs in private subnets, with no public exposure of databases or workloads.

Orbitra processes graph workloads that exceed Lambda’s limits, pays for ingestion compute only while it runs, and keeps its data layer isolated from the internet.

Build with Us See the Impact

Any size

Graph ingestion, beyond Lambda limits

Servers to manage for ingestion

Inbound internet exposure

Pay-per-use

Compute only while ingesting

Client profile

Who we built it for.

Company

Orbitra

Industry

Cloud security and identity governance (IAM security analytics for Microsoft Azure and Entra ID)

Trigger event

Graph ingestion into Neo4j outgrew AWS Lambda: large datasets exceeded its 15-minute runtime and memory limits.

The challenge

What stood in the way.

Orbitra’s serverless backend handled most of its data pipeline well, but graph ingestion into Neo4j outgrew it. Loading a normalized dataset into the graph is compute- and memory-intensive, and large datasets exceeded AWS Lambda’s 15-minute runtime and memory limits.

Orbitra needed a way to run these heavy jobs without giving up the benefits of its serverless design.

Long, memory-heavy jobs

Run ingestion jobs that Lambda alone could not complete.

Pay only for compute in use

Ingestion runs on demand rather than continuously.

Private cross-VPC access

Reach a Neo4j database in a separate VPC over private networking, not the public internet.

Isolated from inbound traffic

Keep databases and compute private while still allowing calls to external APIs.

Least-privilege access

Between Lambda, ECS, Amazon RDS and Neo4j.

Why they chose Logiciel

A partner proven at scale.

Orbitra already ran on AWS Lambda and Amazon RDS, so extending on AWS kept one operational, IAM and networking model.

AWS Fargate removed the need to manage servers or clusters for an occasional, bursty workload.

Hands-on experience with serverless architectures, container workloads and AWS networking.

End-to-end ownership: architecture, infrastructure-as-code, IAM, VPC networking and production rollout.

The solution

How we built it.

Layer 01

On-demand graph ingestion

The aggregateConsumer Lambda detects a ready datasetIt calls ecs:RunTask to launch the loader on FargateFargate pulls the image from Amazon ECR and loads the data into Neo4jThe task exits and Fargate stops the container automatically

Layer 02

Secure, private networking

Lambda and ECS run in private subnetsVPC peering to the Neo4j VPC; its security group admits only the ECS taskRDS admits traffic only from the Lambda security groupOutbound-only internet through a NAT Gateway

Layer 03

Least-privilege orchestration

Lambda role holds only ecs:RunTask and iam:PassRoleExecution role scoped to ECR pulls and CloudWatch logsSeparate task role for runtime AWS accessDedicated task definition and security group

Layer 04

AWS services used

AWS Lambda: event-driven backendAmazon ECS on AWS Fargate: on-demand Neo4j loaderAmazon ECR: loader container imageAmazon VPC: private subnets, peering, security groupsNAT Gateway: controlled outbound accessAmazon RDS, AWS IAM, Amazon CloudWatch Logs

Results & impact

What shipping it actually changed.

No more runtime ceilings

Heavy Neo4j loads run on Fargate with the CPU, memory and time they need, outside Lambda’s 15-minute limit.

Pay only while ingesting

Fargate tasks start on demand and stop when the load finishes, so there is no idle cluster to pay for. There are no EC2 instances to patch or scale for the ingestion workload.

Private by design

Lambda, ECS tasks, RDS and Neo4j have no inbound internet exposure; Neo4j traffic stays on the AWS network over VPC peering.

Least privilege and full visibility

Security-group-to-security-group rules and scoped IAM roles limit each component to what it needs, and every ingestion run is logged to Amazon CloudWatch for troubleshooting and audit.

Strategic partnership

More than a project.

One model, extended

The new compute path reuses Orbitra’s existing AWS operational, IAM and networking model.

Built for what comes next

The architecture supports the initial release and a foundation for MSP multi-tenant management, advanced risk reporting, approval workflows and automated remediation.

Owned end to end

Logiciel handled architecture, infrastructure-as-code, IAM, VPC networking and production rollout.

Why it matters for tech leaders

A blueprint for scaling without chaos.

Serverless does not have to stop at Lambda’s limits: orchestrate in Lambda and hand heavy jobs to on-demand Fargate.

On-demand containers keep the pay-per-use model with no idle cluster.

Private subnets, VPC peering and scoped IAM keep sensitive identity data off the public internet.

Build to last

Scale Heavy Workloads Without Giving Up Serverless.

If a job has outgrown Lambda, let’s design the secure, pay-per-use path together.

Start Your Project