A high-level view of the path an image takes, from clinic to clinical insight — before the AWS service detail below.
A clinical AI product has infrastructure requirements most general-purpose clouds don't fully cover out of the box. We picked Amazon Web Services as our only cloud provider from day one because it meets every one of them.
AWS gives us managed AI/ML hosting through SageMaker, globally replicated storage through S3, managed relational databases through RDS, network isolation through VPC, and the IAM controls clinical data governance actually requires — all under one account.
Nothing here is decorative — pull one of these services out and a specific part of the product stops working.
SageMaker hosts the model that classifies skin conditions and scores severity. It handles deployment, scaling, and low-latency inference as a managed real-time endpoint, so our small engineering team isn't running ML serving infrastructure by hand. The model itself was trained on clinical image datasets before being deployed.
S3 holds every patient image and generated PDF report, each one encrypted server-side with AES-256. Bucket policies and IAM role assignments gate who can reach them. Its eleven-nines durability and lifecycle rules also let us move older records to Glacier for less, without ever losing access to them.
RDS on PostgreSQL holds every structured record — patients, analysis results, clinical notes, user accounts, clinic configuration. It runs Multi-AZ for availability and takes automated daily backups with point-in-time recovery, so we're not the ones patching or failing over a database by hand.
The web app and REST API run on EC2 inside an Auto Scaling Group. When clinic traffic spikes — usually morning hours — more instances spin up automatically, so response times hold steady without paying for capacity we don't need overnight.
Lambda handles the event-driven work: preprocessing images before they hit SageMaker, generating PDFs once analysis finishes, and sending notifications. It's triggered by S3 uploads and API Gateway requests, and it only costs us anything when it actually runs.
IAM enforces least-privilege access everywhere — application roles, developer roles, and CI/CD pipelines each get their own scoped policy. The whole application sits inside a VPC, with the database and inference layer on private subnets that never touch the public internet; only the load balancer lives on a public one.
What happens, step by step, from the moment a clinician hits upload.
The browser sends a secure POST to the EC2 API server through an AWS Application Load Balancer. TLS terminates at the load balancer; CloudFront serves static assets globally.
The API server writes the raw image to a dedicated S3 bucket with server-side encryption (SSE-S3). RDS stores a pre-signed URL pointing at the object, and the upload event triggers a Lambda preprocessing function.
Lambda resizes and normalises the image, then hands it to a real-time Amazon SageMaker endpoint. The endpoint runs the trained CNN and returns structured JSON — condition classification, severity score, and region coordinates.
Lambda writes that structured output straight into the patient's record in RDS (PostgreSQL). Every database connection originates inside the VPC's private subnet — RDS is never reachable from the public internet.
The API server pulls the finished analysis from RDS and returns it to the browser. The clinician reviews it, adds notes, and can trigger a second Lambda call to generate the PDF, which lands in S3 with a download link handed back.
Before there's subscription revenue, SageMaker endpoints and RDS instances are already our single biggest line item.
The product's entire value depends on inference running on Amazon SageMaker. A managed endpoint that can handle real clinical inference needs to stay up through clinic hours — which costs real money before we've billed a single clinic.
AWS credits cover that pre-revenue cost directly. They let us run production-grade infrastructure, bring pilot clinics on at no cost to them, and keep iterating on the product without infrastructure spend deciding what we can and can't build.
As clinic subscriptions grow, the architecture scales the way it was built to — more EC2 capacity through Auto Scaling, new SageMaker endpoint variants as models improve, more S3 throughput as image volume climbs. Credits are what let us prove that scaling path during the pilot phase.
| AWS Service | Use Case | Est. Monthly |
|---|---|---|
| Amazon SageMaker | ml.m5.large inference endpoint × 2 | ~$180 |
| Amazon EC2 | t3.medium × 2, Auto Scaling Group | ~$60 |
| Amazon RDS | db.t3.medium, Multi-AZ PostgreSQL | ~$80 |
| Amazon S3 | Image storage + PDF reports | ~$25 |
| AWS Lambda | Image preprocessing + PDF gen | ~$10 |
| AWS CloudFront | Static asset delivery + SSL | ~$12 |
| AWS IAM / VPC / KMS | Security, key management, networking | ~$8 |
| Total Estimated | ~$375 / month |
Estimates based on AWS public pricing for ap-southeast-1 region. Actual costs depend on clinic traffic volume.
Every S3 object carries SSE-S3 (AES-256) encryption. RDS storage is encrypted with AWS KMS-managed keys. It's enforced at the bucket and instance level, not left to application code to get right.
All client traffic runs over HTTPS/TLS 1.2+. Inside the VPC, service-to-service calls use SSL-enforced connections to RDS and signed HTTPS requests to SageMaker endpoints.
RDS and the SageMaker endpoints sit in private subnets with no public internet path. Security Groups only let application-tier instances reach the data layer.
Every component runs under a scoped IAM role that grants exactly what its job needs — nothing runs on root credentials or a broad catch-all policy.
CloudTrail records every API call on the account. Application logs live in CloudWatch, and patient-record access events are logged in the application database itself.
RDS takes automated daily backups with 35-day retention and point-in-time recovery. S3 versioning is on for the images bucket, and Multi-AZ RDS fails over automatically if an instance goes down.
We're happy to walk through the stack with clinic partners, investors, or AWS programme reviewers — just ask.
Get in Touch