Behind every beautiful celebration is a better digital experience
PartyPallet Luxury creates memorable moments in Lagos, Nigeria: luxury event styling, balloon installations, bespoke gifting, proposals and creative education through its academy. Its website is its showroom. Morphlix took the Amazon Web Services (AWS) account behind it from hand-built and unmonitored to governed, defined in code and monitored with alerting, and launched an AI concierge that visitors can type or talk to.
- Cloud Governance
- Security
- Infrastructure as Code
- Monitoring
- Serverless
- Generative AI
- Industry
- Events & Hospitality
- Engagement
- Managed cloud governance and operations
Results
5 of 5
AWS detective services enabled
CloudTrail, AWS Config, Security Hub, GuardDuty and IAM Access Analyzer went from none to all five, with findings routed to the operations team.
141
resources managed in Terraform
At the audit, every resource in the account was defined as code, including those first created by hand, and a drift check found no differences.
100%
health-check availability
1,215 of 1,215 one-minute health checks were healthy in the first measured window (12–13 October 2026).
0%
production 5xx error rate
CloudFront's daily 5xx error rate stayed at zero over the 30 days to 12 October 2026.
The challenge
A live brand on an account nobody was watching
PartyPallet's website is where prospective customers discover its work and begin imagining their own celebrations. The site was fast and live, but the AWS account behind it had grown by hand, with no monitoring, security visibility or repeatable way to make changes. At the same time, there was a chance to make the customer journey more engaging: a more conversational way to learn about the services and start a booking enquiry. Morphlix took on both together, a stronger foundation behind the scenes and a more helpful experience at the front.
Built by hand
Every resource had been created in the console. Changes couldn't be reviewed, repeated or rolled back.
No audit trail or detection
There was no CloudTrail trail, configuration recording, compliance checking or threat detection. A misconfiguration or intrusion would have gone unnoticed.
Full admin rights on one key
The only identity was an IAM user with administrator access, a long-lived access key and no MFA.
No monitoring
There were no uptime checks, alarms, budgets or runbooks. Customers would have found an outage before the business did.
For a luxury brand that sells through its image, every one of these was a reputational risk.
The solution
Governance as code, verified against the live account
Infrastructure in Terraform
Morphlix imported the hand-built resources into Terraform and added a staging environment. Changes now go through a pull request with an automated plan, and is applied from a reviewed plan.
Preventive controls
Administration requires MFA through a dedicated role, and the IAM user can no longer make changes on its own. GitHub deploys use short-lived OIDC credentials scoped to one branch and one bucket. Account-wide Block Public Access covers S3, EBS snapshots and the VPC. Private S3 origins are reachable only through CloudFront, and AWS WAF filters incoming requests.
Detective controls
A multi-region CloudTrail trail with log file validation, AWS Config with 12 managed rules, Security Hub (AWS Foundational Security Best Practices), GuardDuty and IAM Access Analyzer. Controls that don't apply are disabled in code, each with a written reason and a review date.
Alerts that reach people
EventBridge sends Config, Security Hub and GuardDuty findings, health-check failures, error-rate alarms and budget alerts to the operations mailbox. Each alert carries a runbook link. Delivery was tested end to end.
Safe deployments
The site deploys through GitHub Actions to staging, then production, and each deploy ends with a smoke test of content, error pages and security headers. When the pipeline was unavailable at launch, the same steps and smoke test were run by hand.
The goal was simple: a platform that is easier to manage, easier to verify and ready for the business's next stage.
Architecture
Static, global and governed
Edge
Route 53 sends visitors to CloudFront through AWS WAF (AWS managed rules for IP reputation, common exploits and known bad inputs, plus a per-visitor rate limit on the API), with TLS 1.2 minimum, HSTS and a strict content security policy.
Origin
Private, versioned S3 buckets for production and staging, readable only by their own CloudFront distribution.
Concierge API
CloudFront routes /api/* to an AWS Lambda function URL that only CloudFront can call (origin access control, IAM auth). The function streams replies from Amazon Bedrock and sends enquiries through Amazon SNS. Its role can invoke one model and publish to one topic.
Governance layer
CloudTrail, Config, Security Hub, GuardDuty and Access Analyzer feed EventBridge and SNS. Logs from CloudTrail, CloudFront, S3 and VPC flow logs are kept in a dedicated, versioned log bucket with lifecycle rules.
The AI layer
Meet the PartyPallet Concierge
The concierge gives visitors another way to connect with the brand, whether they are exploring event styling, considering a bespoke gift or learning about the academy. It isn't there to replace the personal touch that makes PartyPallet special; it makes discovering that experience easier.
Amazon Nova 2.5 Sonic
Since 14 October 2026, visitors to partypalletluxury.com can ask the PartyPallet Concierge about services, the academy and how to book. It runs on Amazon Bedrock's Nova 2.5 Sonic speech model: visitors type or tap the mic to speak, read the reply as it streams in, and can switch on spoken replies.
Grounded answers
The assistant answers only from PartyPallet's published services. It is instructed not to quote prices or dates, and in testing it refused an attempt to talk it into giving a discount code.
Enquiries the customer confirms
When someone wants to book, the assistant opens a pre-filled enquiry form in the chat. The assistant doesn't send anything itself: the customer reviews the form and presses Send, and gets a reference number. Delivery of enquiry emails to the PartyPallet team is still being verified.
Governed like the rest of the platform
It runs on AWS Lambda behind CloudFront and WAF, with per-visitor rate limits, no customer content in logs, and error alarms. It's defined in the same Terraform.
Outcome
Progress you can measure
These figures set an initial operational baseline. The availability and error-rate measurements cover their stated periods; they are not a claim of uninterrupted performance across all time.
Technology stack
AWS services, managed as code
Edge and delivery
- Amazon CloudFront
- AWS WAF
- Amazon Route 53
- AWS Certificate Manager
- Amazon S3
Governance and security
- AWS CloudTrail
- AWS Config
- AWS Security Hub
- Amazon GuardDuty
- IAM Access Analyzer
- AWS IAM (MFA-gated role, GitHub OIDC)
Operations
- Amazon CloudWatch
- Amazon EventBridge
- Amazon SNS
- AWS Budgets and Cost Anomaly Detection
AI and compute
- Amazon Bedrock (Amazon Nova 2.5 Sonic)
- AWS Lambda
Tooling
- Terraform
- GitHub Actions
What's Next
Turning a stronger foundation into deeper customer connections
With the concierge live, the next phase is about learning from real customer interactions.
Measure the AI concierge
Track conversations, enquiries, response times and cost per conversation now that the concierge is live.
Thirty days of evidence
Track availability, compliance and cost over a full month to confirm the baseline holds.
Multi-account when payments arrive
Move to a production and non-production account structure under AWS Organizations when online bookings or payments are added.
The Bigger Picture
Technology should make the experience better
PartyPallet Luxury brings creativity and personal expression to life's special moments. Morphlix's role is to build the digital foundation that lets that experience grow: managed cloud operations and a live AI concierge, moving PartyPallet beyond simply having a website towards a more engaging, well-governed digital presence.
Beautiful experiences deserve a strong foundation. That's what Morphlix is building with PartyPallet Luxury.
More from the library.
All case studiesAI · Productivity
Seshira: AI-native project management
An engineering assistant on Amazon Bedrock AgentCore that plans sprints, turns PRDs into tasks and flags blockers, with about 80% less planning effort.
Education
Karatux: AI-native school operating system
One multi-tenant platform for K–12 school groups, with an AI teaching assistant on Amazon Bedrock AgentCore that cut lesson-prep time by about 60%.
Work with the studio
Ready to future-proof
your infrastructure?
Tell us what you are building and where the current stack is holding you back. We will come back with an architecture and a plan.