How Fastweb+Vodafone Automates Change Impact Analysis for Transport Networks with AWS

Telecommunications operators manage vast and complex transport networks that interconnect thousands of nodes, links, and services. When planned maintenance or infrastructure changes occur, engineers must assess which services and customers will be affected—a process known as Change Impact Analysis (CIA). Traditionally, engineers perform this assessment manually, aggregating information from multiple Network Inventory Systems (NIS), correlating topology data, and calculating service disruption—a process that is time-consuming, error-prone, and highly dependent on individual expertise.

In this post, we explore how Celfocus, an Amazon Web Services (AWS) Partner specializing in digital transformation for the telecommunications industry, built an automated Change Impact Analysis solution in collaboration with Fastweb+Vodafone, one of Italy’s leading telecommunications operators.

As part of its Autonomous Networks transformation, Fastweb+Vodafone worked jointly with Celfocus and AWS to deliver a production-grade solution that builds a Digital Twin of the network topology and automates deterministic Change Impact Analysis at scale. Fastweb+Vodafone brought the operational vision, network domain expertise, and deep knowledge of its inventory data, while Celfocus contributed its Digital Twin framework, which combines telecom-specific topology modeling, network and service relationship construction, and reusable graph algorithms. The solution runs on AWS, with Amazon Neptune as the graph persistence and traversal technology.

The Challenge

When planned works occur on transport networks, service affectation must be assessed so that operators can inform affected customers and coordinate maintenance windows. Today, engineers perform manual impact assessment to calculate service and customer affectation, which requires time-consuming manual tasks to aggregate all impact information:

• The process is entirely manual and prone to human errors
• Assessment quality depends heavily on the knowledge and experience of the person executing it
• Tasks are manual and complex, reducing engineering productivity
• Network data is spread across multiple sources with no unified view
• There is no reusable model of the network topology that can be queried programmatically

For Fastweb+Vodafone, managing a large-scale Italian transport network spanning Internet Protocol (IP) and Transmission layers, even a single planned maintenance event can require hours of manual correlation. The CIA capability enriches Fastweb+Vodafone’s Change Management planning lifecycle by systematically determining who is impacted, which services are affected, and where the impact manifests—with outputs focused on service- and customer-centric impact intelligence suitable for operational prioritization and decision-making.

Key benefits of automation include:

• Faster, more consistent impact assessment by automating manual correlation across inventory tools.
• Unified Data by integrating relevant data from multiple sources into a single graph database, accelerating tool reduction and unification.
• Service Integration by enabling the mapping between services and the network, providing insights about affected network nodes, sites, connections, and critical services/customers.

Solution Overview

Together, Fastweb+Vodafone and Celfocus designed a solution that transforms network inventory and service data into an operational Digital Twin of Fastweb+Vodafone’s network. Rather than simply storing topology as a graph, the solution defines how network entities and service dependencies are modeled, correlated, maintained, and traversed: Fastweb+Vodafone’s network engineering team set the operational requirements and validated the model against the production network, while the Celfocus Digital Twin framework provides the reusable modeling, graph-building, and analysis capabilities. Amazon Neptune provides the graph persistence and query layer, and graph algorithms operating over this model calculate deterministic service and customer impact. This separation between the reusable Digital Twin foundation and use-case-specific graph algorithms supports the “build once, deploy many” approach that Fastweb+Vodafone set for its Autonomous Networks program: the same network representation can progressively support Change Impact Analysis and additional network operations use cases without rebuilding the underlying topology foundation.

The Digital Twin

A key component of the solution is the Digital Twin of Fastweb+Vodafone’s network, which maps the complete network topology in Amazon Neptune using the labeled property graph (LPG) model, queried with openCypher. The Digital Twin captures the full hierarchy of each Network Equipment—broken down by Sites, Shelves, Slots, Cards, SubCards, and Ports—with every element modeled as a node (identified by a stable node ID) and its attributes expressed as node properties. Network interconnections (Trails) and the Services (Paths) running on the topology are expressed as typed relationships (edges) that connect these nodes, so the physical hierarchy and the service layer are captured as vertices and edges carrying properties.

Figure 1 – Conceptual representation of Device and Topology

The solution operates across two network layers:

• IP Network Layer: IP elements are represented as endpoints of the Transmission Network.
• Transmission Network Layer: The transport infrastructure with all equipment hierarchies and interconnections.

A connection between two IP Elements is represented as a service path on the Transmission Layer, regardless of whether it uses transmission equipment in between or just a direct cable.

The graph ontology underpinning the Digital Twin was not a generic template: it was specifically co-designed with Fastweb+Vodafone’s network engineering team to accurately reflect the operator’s multi-vendor, dual-brand infrastructure following the integration of Fastweb and Vodafone Italia. This joint ontology work included mapping Fastweb+Vodafone-specific equipment hierarchies, aligning naming conventions across legacy and new network domains, and defining the service-to-topology relationship model in a way that is consistent with Fastweb+Vodafone’s internal Network Inventory System schemas. The result is a Digital Twin that is not a generic industry model but a faithful, operator-specific representation of the production network.

This operator-specific model is instantiated using the Celfocus Digital Twin framework. The framework provides reusable capabilities for transforming heterogeneous telecom inventory data into graph entities and relationships, managing topology and service dependencies, and exposing these relationships to graph-based analysis. This allows the implementation to retain Fastweb+Vodafone-specific semantics while reusing the modeling, graph-building, and analysis patterns developed by Celfocus for telecom network operations.

Four-Phase Approach

The solution is structured in four distinct phases:

1. Information Retrieval: Fetch the agreed information from the source systems—principally the Network Inventory System (NIS), the primary data source storing all element definitions, connections, and services, complemented by feeds from Data Center Interconnect (DCI), the Geographic Information System (GIS), and the Lawful Interception (LI) database. This retrieval and the initial landing in the bronze layer run on-premises: the agreed feeds are staged in the on-premises Data Staging environment, where Apache Spark jobs preprocess the raw inventory data before it is streamed to AWS for downstream processing.
2. Data Ingestion and Preprocessing: a real-time graph update capability has been co-designed with the Fastweb+Vodafone engineering team. This is the incremental write path: topology changes detected in the Network Inventory System trigger direct, incremental updates to Neptune via openCypher MERGE/SET write queries without waiting for the next batch cycle, so that the Digital Twin reflects the current state of the network at the time a change request is submitted. On this incremental path the openCypher writes are keyed on stable NIS identifiers and are written idempotently—using MERGE to match an existing node by its stable identifier and SET to overwrite its properties, so a changed value replaces the old one in place rather than creating a duplicate. This path complements the batch bulk-load path (Phase 3): the periodic bulk load re-establishes the authoritative baseline from the NIS. Because the Neptune bulk loader is insert-only—it does not delete nodes or relationships that have disappeared from the NIS, and a reloaded property value does not by itself remove superseded nodes or stale relationships—the baseline is rebuilt with a drop-and-reload: the target graph is cleared (dropped) and then reloaded in full from the NIS export, so removed elements and stale values do not survive and the graph is reconciled exactly to the NIS baseline.
3. Digital Twin Build and Lifecycle: The network model and relationship-building logic, defined jointly with Fastweb+Vodafone and implemented through the Celfocus Digital Twin framework, transform the prepared data into the topology and service graph required for network analysis. A containerized Graph Builder application deployed on Amazon Elastic Kubernetes Service (EKS) normalizes and correlates entities, reconstructs equipment hierarchies and connectivity relationships, and generates the graph representation consumed by Amazon Neptune. It also generates Neptune bulk load files that are ingested through the Neptune bulk loader from Amazon S3 for high-throughput ingestion. This batch path produces the authoritative baseline of the Digital Twin, which the incremental path (Phase 2) then keeps current between cycles. To keep this baseline faithful to the source, each bulk load starts from a graph emptied with the Neptune fast reset API instead of being appended to the existing data, so elements removed from the NIS and superseded values are not carried over.
4. Service Impact Analysis: An event-driven CIA Engine, also on EKS, is triggered by the arrival of a change request file (Excel .xlsx) in an Amazon S3 bucket. It performs automated graph traversal to determine impacted services, customers, and network elements.

Figure 2 – Four-Phase Data Flow: From Network Inventory to Automated Impact Analysis.

“Managing change across a network of our scale — spanning IP and Transmission layers with tens of thousands of interconnected elements — has historically required extensive manual effort and deep tribal knowledge. With the Digital Twin approach built by Fastweb+Vodafone in collaboration with Celfocus on AWS, we have transformed what used to take engineers hours of manual correlation into an automated, deterministic process that delivers consistent results in minutes. This is a foundational step in our Autonomous Networks journey: by codifying our network topology in a graph model, we’re not only accelerating change impact assessment today, but building the intelligent infrastructure that will enable predictive operations tomorrow.” Mario Volonterio – Head of Digital Networks & AI, Fastweb+Vodafone

Technical Architecture on AWS

The architecture leverages purpose-built AWS services to deliver a scalable, secure, and highly available foundation. The Digital Twin component is deployed across separate DEV and PROD environments, each in its own dedicated AWS account to provide strong isolation between environments, with the following core services:

Core Services

• Amazon EKS – Hosts the containerized Graph Builder and CIA Engine applications. EKS provides the computational layer with auto-scaling, workload isolation, and high availability.
• Amazon Neptune – A fully managed graph database service used as the persistence and query layer for the Network Digital Twin. Neptune provides scalable graph storage and native traversal capabilities across complex network relationships. The Celfocus Digital Twin and CIA components use these capabilities to execute telecom-specific dependency-resolution and service-impact algorithms across the network model.
• Amazon MSK (Managed Streaming for Apache Kafka) – Provides the managed streaming and ingestion backbone on AWS that receives the preprocessed network inventory feeds (DCI, GIS, NIS) streamed from the on-premises Data Staging & Spark environment and makes them available to the downstream components. From MSK, the data flows to the Graph Builder on Amazon EKS to establish the batch bulk-load baseline, while topology changes propagated through the same streaming layer drive the incremental, real-time updates to the Digital Twin. MSK brokers are deployed across both Availability Zones for high availability.
• Amazon S3 – Serves multiple roles: stores Neptune bulk upload files from the Graph Builder, receives CIA input change request files (.xlsx), stores output impact analysis results, and holds batch data dumps originating from the on-premises Apache Spark ingestion flow.
• Amazon Aurora PostgreSQL – A managed relational database that stores structured CIA input parameters and output results for each analysis run, enabling operational consumption, audit trails, and historical analysis.
• Amazon SageMaker AI – Hosts Jupyter notebooks for interactive validation in the DEV environment only—allowing engineers to query Neptune, validate files on S3, inspect Aurora data, and explore the graph model during development. These notebooks are not provisioned in PROD, keeping the least-privilege posture intact.

Security and Supporting Services

The solution is designed following AWS Well-Architected Framework best practices, with a comprehensive security posture:

• AWS Identity and Access Management (IAM) – Enforces the Principle of Least Privilege across all services using dedicated Service Roles and Policies. The system processes customer endpoint identifiers, which under the General Data Protection Regulation (GDPR) may constitute personal data; access is therefore restricted and governed by the controls described in this section.
• AWS Key Management Service (KMS) – Provides encryption at rest using a customer managed AWS KMS key applied consistently across all services.
• Encryption in Transit – All communications are encrypted using TLS 1.2 or higher. TLS is enforced at the database endpoints—Neptune requires SSL/TLS connections, and Aurora enforces encrypted connections via rds.force_ssl.
• Amazon CloudWatch – Provides centralized logging, monitoring, custom application metrics, automated alerting for critical conditions, and operational dashboards. Optionally integrates with Grafana for enhanced visualization via a Virtual Private Cloud (VPC) endpoint.

Within each environment’s account, all services are deployed inside a single Virtual Private Cloud (VPC), while maintaining proper segregation through subnets, Network Access Control Lists (ACLs), Route Tables, and Security Groups. DEV and PROD do not share a VPC or account.

Figure 3 – Solution Architecture: Digital Twin for Change Impact Analysis on AWS.

Network Design and High Availability

The solution is deployed in a designated AWS Region to comply with Fastweb+Vodafone’s data residency and latency requirements. The network architecture uses two Availability Zones (AZs) for high availability, with each subnet tier split into two subnets—one for each AZ. Connectivity between Fastweb+Vodafone’s on-premises datacenter and the VPC is provided over AWS Direct Connect, giving the Datacenter-Reachable (Layer 1) subnets private, dedicated access without traversing the public internet. In PROD there is no internet egress: no NAT Gateway or Internet Gateway is deployed, and the public-subnet tier (Layer 3) is reserved for future use. Outbound access to AWS services such as Amazon S3 is kept on the AWS private network through a gateway VPC endpoint referenced from the route tables.

Critical components operate in a multi-AZ configuration—Neptune runs as a multi-AZ cluster with a reader instance, Aurora is deployed Multi-AZ, and the EKS managed node groups are spread across both Availability Zones—designed to avoid a single point of failure within the Region. The architecture supports openCypher traversal over a property graph that represents tens of thousands of network elements—materialized as vertices (nodes) and the edges relating them—while maintaining consistent performance.

Figure 4 – Network Architecture: Multi-AZ VPC Design.

How the CIA Engine Works

The Change Impact Analysis Engine operates on top of the Network Topology Digital Twin persisted in Amazon Neptune. It is event-driven: a new input Microsoft Excel (.xlsx) file arriving in a defined Amazon S3 bucket represents a change request. Excel was chosen for both input and output to integrate seamlessly with Fastweb+Vodafone’s existing Change Management process, which is spreadsheet-based today; exposing the capability through an API is on the roadmap for tighter system-to-system integration.

Upon detection of a new input file, the CIA Engine executes a structured workflow:

1. Validation: The file structure is validated—including mandatory sheets, required columns, and data types—checking conformance to the expected change request schema.
2. Parsing: Input fields describing the planned change intent are extracted. Parameters define the scope including target network elements (sites, equipment, components, ports), associated services, and contextual attributes.
3. Change Type Classification: The input specifies the change type (maintenance, reconfiguration, shutdown, migration) which influences the traversal logic and classification of impacted entities.
4. Graph-Based Impact Computation: The CIA Engine applies impact-analysis algorithms, built on the Celfocus framework and aligned with Fastweb+Vodafone’s Change Management requirements, to the Digital Twin. Change targets are resolved against the relevant network entities and the engine evaluates their physical, logical, and service dependencies according to the topology model and change context. Neptune graph queries are used as the execution mechanism for traversing the required relationships, while the CIA logic determines traversal scope, dependency propagation, impacted entities, and blast-radius calculation. Beyond identifying which entities are impacted, the engine also applies severity scoring: each impacted service and entity is assigned a severity level derived from the type and criticality of the affected elements, the services and customer categories involved, and the extent of the blast radius, so that results can be prioritized for operational decision-making.
5. Output Generation: Results are consolidated into a structured Excel output file with multiple sheets covering impacted network elements, affected circuits and topology paths, impacted services, and aggregated indicators (subscriber counts, customer endpoints).

The CIA capability determines, in a consistent and automated way:

• Who is impacted – including customer types (Consumer, Executive, Wholesale)
• What services are affected – such as Voice, Data, Video, Enterprise, and Emergency Services
• Blast radius – across services and topology dependencies

All inputs and outputs are also registered in Amazon Aurora PostgreSQL for audit trails and operational consumption.

Deployment and Operational Excellence

The team built this solution with operational excellence at its core, adopting modern DevOps practices designed for reliability, repeatability, and rapid iteration.

Infrastructure as Code

Terraform is used as the primary Infrastructure as Code (IaC) tool to perform the whole deployment of the solution’s infrastructure across DEV and PROD environments. This enables automated, uniform, and repetitive deployment, reducing human error and discrepancies between environments.

CI/CD Pipeline

A fully automated Continuous Integration and Continuous Deployment (CI/CD) pipeline handles all steps involved in validating, planning, and deploying infrastructure changes. This increases deployment velocity and enables the team to be more responsive to business needs.

Backup, Recovery, and Data Retention

Data protection relies on automated backups, point-in-time recovery for database services, and documented recovery procedures. The solution implements Fastweb+Vodafone’s data classification tiers (Public, Private, Confidential, Restricted) with standardized tagging for security and compliance validation.

Testing Strategy

Testing follows a V-Model approach—named for the V shape formed by pairing each development stage with its corresponding test stage—aligned with established software testing standards (IEEE 829, since superseded by ISO/IEC/IEEE 29119-3). It combines automated and manual techniques—automation is prioritized for regression, data validation, and repeatable integration scenarios, while manual testing covers exploratory scenarios and early functional verification.

Conclusion

The collaboration between Celfocus, AWS and Fastweb+Vodafone demonstrates how cloud-native, automation-driven technologies on AWS can transform traditionally manual, error-prone operational processes into automated, reliable, and scalable solutions. By combining Fastweb+Vodafone’s network expertise and Autonomous Networks vision with the Celfocus Digital Twin framework and graph-based network analysis capabilities, the joint team delivered a production-grade solution on AWS, with Amazon Neptune providing the scalable graph foundation and Amazon EKS hosting the Digital Twin and Change Impact Analysis workloads, that:

• Automates service impact assessment through deterministic impact aggregation and severity scoring
• Removes dependency on individual engineer knowledge by codifying network relationships in a graph model
• Provides a unified view of network topology consolidated from multiple inventory systems into a single graph
• Determines who is impacted (customer types), what services are affected, and computes the blast radius
• Establishes a modular, extensible foundation designed for future network operations use cases
• Designed following AWS Well-Architected Framework best practices for security, reliability, and operational excellence

This solution positions Fastweb+Vodafone to set the foundation for broader Autonomous Network adoption, delivering value through smarter, faster, and more efficient service assurance. The “build once, deploy many” philosophy helps the foundation can accommodate new network domains and automation workflows as Fastweb+Vodafone’s transformation continues.

For telecommunications operators looking to modernize their network operations, the combination of graph database technology, containerized microservices, event-driven architectures, and managed cloud services on AWS provides a powerful foundation for Digital Twin solutions that deliver immediate operational value while enabling future innovation.

To learn more about how Celfocus delivers network automation solutions on AWS, visit the Celfocus page in the AWS Partner Solutions Finder. For more information about building graph-based Digital Twin solutions, see the Amazon Neptune documentation.

Celfocus – AWS Partner Spotlight

Celfocus is a technology company that blends product engineering with AI-driven innovation to serve the telecommunications industry globally. As an AWS Partner, Celfocus helps operators accelerate their digital transformation journeys by delivering cloud-native solutions that combine deep telecom domain expertise with modern engineering practices. From autonomous network operations to customer experience foundations, Celfocus enables telcos to innovate faster and operate more efficiently on AWS.