The scope was already written, and it was wrong. Ingesting ECG recordings from clinic sites into a cloud processing pipeline is a solved problem with an obvious answer — AWS Storage Gateway, the managed service that bridges an SMB file share to S3 — and the obvious answer was in the requirements before anyone looked hard at the data path. What the architecture analysis found was a structural isolation gap that no configuration could close, in a system that would carry protected health information for HeartSciences across multiple healthcare organizations in US and UK production.
Finding it was cheap. AI agents systematically walked every candidate architecture against per-tenant isolation, clinic-side configuration burden, and steady-state cost, which compressed what would otherwise have been weeks of security architecture research into a structured comparison. Acting on it was the expensive part, because the honest conclusion was that the managed service could not do the job and the cloud backend ML LABS was the only engineering on would need a custom ingestion layer instead. That conversation is easier to have before the build than after the audit.
Where The Client Identity Collapses
The problem is structural, not configurational, and that distinction is the whole article. AWS Storage Gateway sits between the SMB protocol and S3. A clinic connects, the gateway authenticates the SMB session, and the gateway then issues S3 API calls on the clinic's behalf — under the gateway's own IAM role. The clinic's identity does not survive the hop. It ends at the proxy, and everything downstream sees one caller.
Three consequences fall directly out of that, and none of them can be configured away:
- Every organization shares one SMB authentication surface — and the documented modes for an SMB file share (AWS) are Active Directory, an allow-list of domain users, or guest access.
- S3 condition keys resolve to the gateway's source IP, not the clinic's, so IAM policy cannot distinguish two clinics from each other.
- IAM roles apply per share with no per-organization storage isolation behind them.
For a platform carrying PHI across multiple healthcare organizations, that is a data-isolation violation waiting for a bad afternoon. The concrete failure is mundane: a misconfigured share name on one clinic's connection reads or writes files belonging to another, because both connections present the same effective identity to S3. The blast radius is not bounded by IAM, network ACL, or bucket policy, since none of those layers can tell the two callers apart. HIPAA Security Rule implementation guidance (NIST, 2024) treats tenant isolation as a technical safeguard rather than a deployment detail, and the price of getting it wrong is documented: the average healthcare breach cost in 2024 was $9.77 million (HIPAA Journal, 2024), with healthcare leading every other industry for the fourteenth consecutive year.
graph TD
A1["Clinic Connection"] --> B1{"AWS Storage<br/>Gateway"}
B1 --> C1["Shared IAM Role"]
C1 --> D1["Single S3 Backend<br/>No Isolation"]
A2["Clinic Connection"] --> B2{"Custom SMB<br/>Server"}
B2 --> C2["IP Validation +<br/>Per-Org Credentials"]
C2 --> D2["Per-Org S3 Bucket<br/>Full Isolation"]
style A1 fill:#1a1a2e,stroke:#e94560,color:#fff
style B1 fill:#1a1a2e,stroke:#e94560,color:#fff
style C1 fill:#1a1a2e,stroke:#e94560,color:#fff
style D1 fill:#1a1a2e,stroke:#e94560,color:#fff
style A2 fill:#1a1a2e,stroke:#16c79a,color:#fff
style B2 fill:#1a1a2e,stroke:#16c79a,color:#fff
style C2 fill:#1a1a2e,stroke:#16c79a,color:#fff
style D2 fill:#1a1a2e,stroke:#16c79a,color:#fffEvery AWS-native alternative was evaluated before anything custom was written, and each one failed the same test in a different place. Per-share IAM roles are not supported by the gateway. S3 Access Points cannot help, because the source IP they see is the gateway's. Active Directory works but requires every clinic to domain-join, which pushes the burden onto the least-equipped party in the chain. A separate gateway per organization does isolate — and Storage Gateway carries a per-gateway monthly charge (AWS), so that design multiplies a fixed fee by the number of organizations, forever. AWS Transfer Family solves isolation and demands a protocol change from the clinics. Every managed path either failed isolation or moved the work to the sites least able to absorb it.
What Replaced The Managed Service
ML LABS built a custom SMB server: a self-managed Samba instance on EC2 that enforces per-organization access control at the protocol level, before authentication begins.
Each organization gets a dedicated share with IP-based access control through hosts allow and hosts deny. When a connection arrives, Samba checks the source address against the share's allowed list, and a mismatch is refused before any credential exchange occurs. Pushing the deny decision below authentication is what shrinks the attack surface: credential stuffing, SMB relay attempts, and NTLM downgrade probes all terminate at the TCP layer instead of reaching the auth state machine where most historical SMB vulnerabilities have lived.
A managed service that collapses all tenants into a single IAM role is not multi-tenant security. It is shared infrastructure where one misconfigured share name breaks isolation.
Sync is event-driven rather than batched. The server uses inotify — the Linux kernel's filesystem event notification — to detect a new file the instant it is written, and the upload to that organization's S3 bucket begins within seconds of write completion, rather than waiting for a batch window of variable length. That is not a benchmark, it is a mechanism: an event fires or it does not. It matters clinically rather than cosmetically, because the interpretation result comes back into a room where someone is still with the patient, and a delayed result is a report rather than a decision aid.
The rest is the unglamorous half that makes it operable. The server runs in both US and UK regions under identical configuration management, so UK clinic data never transits US infrastructure — a data-residency requirement that is not negotiable in either jurisdiction. Every connection attempt, sync event, and access denial is logged to CloudWatch, with alarms on failed connections, sync delays, disk thresholds, and any configuration change that arrives from outside the deployment pipeline. Boundary protection and audit logging are the two control families a regulator will ask about first (NIST, 2024), and they are cheaper to build in than to retrofit. This layer is the first hop of the clinic-to-cloud path: what it refuses at the TCP layer never becomes a record the rest of the pipeline has to reason about.
The cost story follows from the architecture rather than from a discount. Scaling means one custom instance with failover rather than one managed gateway per organization, so onboarding a clinic is a configuration entry instead of new infrastructure — and the fixed cost stays flat while the tenant count grows, which is the opposite of what the per-gateway model does.
Read The Data Path First
The boundary condition for any managed multi-tenant ingestion service is whether client identity survives the hop into the provider's control plane. It is a question with a definite answer, and the answer is in the data path rather than on the product page. For a service that proxies a stateful protocol — SMB, NFS, FTPS — into an object store, the proxy is the caller the object store sees, and the client's identity ends there unless the service was explicitly built to carry it further. The documentation says so plainly enough, while never putting the word "isolation" anywhere near the sentence.
The trap is that the gap only becomes visible in the security review, when an auditor asks how cross-tenant access is prevented and the answer turns out to be "the service handles it." At that point there are three moves and no good ones: accept a documented isolation gap, run a managed instance per tenant and watch the cost model break, or build a thin protocol-level enforcement layer that preserves identity end to end. The cheap version of this decision happens at design time, on a whiteboard, for the price of an afternoon.
First Steps
- Trace the identity chain end to end. Follow one clinic's request through every proxy, gateway, and service boundary, and write down what identity each hop sees. If you cannot do this from the documentation, that is itself the finding.
- Find the collapse point. Name the first layer that merges two clients into one identity. Isolation breaks there, and every control downstream of it is decoration.
- Test the managed service against your real isolation requirement, not the marketing one. If it cannot distinguish two tenants at the storage layer, no amount of clinic-side configuration will make it.
Isolate Tenants At The Protocol
Replace managed ingestion services that cannot preserve tenant identity with protocol-level enforcement that refuses unauthorized connections before authentication begins: IP-based access control, per-organization credentials, per-organization storage destinations. Cross-tenant access stops being something you monitor for and becomes something the architecture cannot express. The security model shifts from "trust the managed service to isolate tenants" to "isolation is enforced where it cannot be bypassed" — and the operational surface collapses with it, because adding a tenant is a configuration change and the audit story is a single point of inspection instead of a fan-out across managed-service abstractions.
Ingestion that has to be secure before it is fast is one contained workflow with a hard correctness bar, which is what a production workflow build is scoped for: targets written into the SOW before work starts, and the first 30 days of Operate included, run by the person who built it. If you are ingesting regulated data through a managed service today, the useful question is not whether it is configured correctly. It is whether the service can tell your tenants apart at all — and that question has an answer you can go and check this afternoon.
References
- Marron, J. Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide. NIST Special Publication 800-66 Revision 2, 2024.
- HIPAA Journal. Cost of a Healthcare Data Breach Falls to $9.77M in 2024. HIPAA Journal, 2024.
- Amazon Web Services. Creating a File Share. AWS Storage Gateway Documentation.
- Amazon Web Services. AWS Storage Gateway Pricing. AWS.
- National Institute of Standards and Technology. Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5). NIST, 2024.
