Zero-Downtime CDN and Security Migration: Nahdi Medical Company

Introduction

Nahdi Medical Company, Saudi Arabia's leading pharmaceutical retailer and digital health platform, migrated the content delivery and security layer of Nahdi Online to AWS in collaboration with AWS Partner Sufle. The project consolidated CDN, caching and web application security onto Amazon CloudFront, AWS WAF, AWS Shield Advanced and AWS Firewall Manager without a single minute of planned downtime and without introducing false positives that could block legitimate customers mid-purchase.

Because a like-for-like translation between the two platforms was not possible, Sufle rebuilt the incumbent managed protections as custom AWS WAF rules, engineered a Lambda-based mechanism to deliver rate-limit behaviour AWS does not support natively, and designed a log analytics pipeline that gave the Nahdi team the 90+ days of dashboards they required at a fraction of the cost of a CloudWatch-only approach.

About the Customer

Nahdi Medical Company is a leading healthcare company and a pioneer in omnichannel healthcare in Saudi Arabia. As Saudi Arabia's largest retail pharmacy chain and an integrated Omnihealth platform, Nahdi offers a portfolio that spans prescription medication, vitamins, skincare, cosmetics and home medical equipment. Its integrated healthcare ecosystem seamlessly connects its extensive pharmacy network with digital healthcare solutions.

The platform serves guests across the Kingdom, from families and wellness shoppers to patients who depend on it for consistent health monitoring and medical support. That last group matters architecturally: for many users, Nahdi Online is not a convenience but the channel through which essential medication is ordered.

Challenge

As Nahdi's digital ecosystem continued to grow in scale and complexity, its requirements for CDN, caching and web security evolved accordingly. The existing third-party managed edge platform supported custom rules and domain- and path-specific cache configurations; however, Nahdi identified an opportunity to further enhance scalability, performance, security and operational efficiency to support its growing digital operations and evolving guest expectations.

With this in mind, Nahdi defined three key requirements for its transition to AWS:

• Zero-downtime migration. Millions of users across Saudi Arabia rely on the platform for checkout, prescription orders and healthcare services. Even a few hours of interruption mid-migration could impact the guest experience and, more importantly for a healthcare brand, undermine trust.

• A security layer at least as strong as the one it replaced, on a more efficient network layer. Anything less would leave a platform holding sensitive health and personal data exposed to credential stuffing, DDoS and data breach risk while a slower or costlier edge would erode both SEO performance and mobile conversion.

• Zero tolerance for false positives. Over-aggressive filtering that flags paying customers as bots produces blocked sessions, CAPTCHA loops and abandoned carts. For a pharmacy platform, a false positive is a customer who cannot order their medication.

Layered on top of these was an operational constraint: Nahdi's engineering team works to a demanding standard on observability, requiring appropriate log retention and robust monitoring dashboards to support system performance, reliability and security.

Why AWS

AWS was selected to resolve the platform's stability and cost problems with enterprise-grade infrastructure. Amazon CloudFront offered a highly resilient, globally distributed edge network that removed the recurring downtime affecting critical e-commerce operations, alongside a more favourable pricing structure for Nahdi's traffic profile.

Equally important was the depth of the surrounding ecosystem. Moving to AWS meant the CDN, the web application firewall, DDoS protection, log analytics and dashboarding could sit inside one governed environment rather than being split across providers and that gaps in native functionality could be closed with services such as AWS Lambda and Amazon Athena rather than worked around. Native integration with modern headless architectures and automated deployment pipelines supported the silent cutover, while the platform's elasticity positions Nahdi for high-traffic promotional and shopping peaks.

Why Sufle

Nahdi selected Sufle as implementation partner on the strength of its standing as an AWS Advanced Services Partner holding the AWS Service Delivery designation for Amazon CloudFront vendor-audited evidence of the specialised expertise a complex, high-traffic CDN migration demands. Sufle's record, including consecutive AWS Partner of the Year recognition, gave Nahdi confidence that a strict zero-downtime methodology could be executed as promised.

The engagement was structured around a proof of concept before full migration, allowing rule behaviour and cache semantics to be validated against real traffic patterns ahead of cutover. Sufle's collaborative approach, grounded in the AWS Well-Architected Framework, meant the resulting infrastructure was not only delivered without disruption but tuned for long-term security, cost efficiency and operational performance.

Solution

Rebuilding the security layer on AWS WAF

The incumbent platform's managed rulesets have no direct one-to-one equivalent in AWS, so Sufle did not attempt a mechanical translation. Instead, the team analysed the protections in force on the existing platform and authored custom AWS WAF rules to reproduce their behaviour as closely as possible, extending coverage with additional rules during the transition. AWS Shield Advanced was implemented specifically to strengthen protection against DDoS attacks, and AWS Certificate Manager issued the certificates used by both CloudFront and the Elastic Load Balancer.

With more than thirty CloudFront resources in scope, per-distribution WAF administration would have been unworkable. AWS Firewall Manager was introduced to apply and maintain rules in bulk across the estate, giving the security team a single control point rather than thirty.

Engineering time-configurable block and count actions

AWS WAF rate-limit rules do not natively support configurable durations for block and count actions — a capability Nahdi's existing configuration depended on. Sufle raised the gap with AWS as product feedback and, working closely with Nahdi's development team, built a solution rather than accepting a downgrade.

An AWS Lambda function, triggered on a one-minute schedule by Amazon EventBridge, queries the WAF logs through Amazon Athena and updates the relevant WAF rules based on what those logs show. The result is block and count behaviour with the durations Nahdi requires, expressed in AWS-native services. Querying through Athena rather than CloudWatch was a deliberate choice that kept the mechanism inexpensive to run at one-minute cadence.

A cost-efficient logging and dashboard pipeline

The dashboards available out of the box did not meet the Nahdi team's needs, and the custom dashboards they wanted were derived from log analysis which, at 90+ days of retention, generated very high CloudWatch costs. Sufle designed a dedicated analytics path:

WAF / CloudFront → Amazon Kinesis and Kinesis Data Firehose → AWS Glue → Amazon S3 → Amazon Athena → Amazon Managed Grafana

Kinesis and Firehose deliver the log streams, Glue converts them into the correct format, S3 stores the processed logs in Parquet along with query results, Athena executes SQL over them, and Amazon Managed Grafana renders custom dashboards built from Athena queries alongside CloudWatch metrics. Amazon CloudWatch remains in place for general metrics and log tracking; what moved off it was the high-volume analytical workload that made it expensive.

Migrating delivery and cache behaviour

Amazon CloudFront now delivers both the frontend applications, which continue to run on a third-party edge runtime, and the backend services behind the AWS Elastic Load Balancer, with the large majority of cache management and CDN usage migrated to CloudFront. CloudFront Functions handle custom request header modification and redirect rules the edge logic that made a silent cutover possible while path-level cache behaviour was reproduced and, in the process, rationalised from the ad-hoc console configuration that preceded it.

Results and Benefits

Quantifiable outcomes

• ~15% cost saving on logging and observability. The custom Athena and Managed Grafana pipeline delivered the 90+ day retention and custom dashboards the team required at materially lower cost than the equivalent CloudWatch-based approach.

• ~10% cost reduction from cache configuration. Reviewing and rebuilding cache behaviour during migration to CloudFront rather than porting the previous per-path settings as-is, reduced origin load and delivery cost.

• ~20% of bot traffic blocked following the WAF migration. The rebuilt and extended rule set catches traffic the previous configuration was letting through, achieved without the false positives Nahdi had set as a hard constraint.

• ~10% improvement in security team response time. Consolidating all security resources under AWS Firewall Manager gave the team one place to assess and act across thirty-plus resources.

• Zero downtime. The migration was completed without service interruption to the platform.

Qualitative benefits

Eliminating the downtime and error pages that had previously affected the platform gave Nahdi an always-on digital experience, reinforcing its standing as a dependable healthcare companion, a reputational asset that matters more in pharmacy than in general retail. Internally, the improved stability reduced reactive firefighting, freeing engineers from crisis management to focus on product work.

Consolidating content delivery into the AWS ecosystem also streamlined architectural governance. Security and compliance controls now sit under centralised management, and leadership has deeper operational visibility through unified dashboards, supporting faster and better-evidenced decisions. Perhaps most significantly, the project demonstrated that a migration constrained by "no downtime, no false positives, no loss of capability" could be delivered on all three counts at once, including for capabilities the target platform did not natively offer.