Reducing Complexity and Costs Using Amazon CloudFront with Trainline

Launched in 1997 and headquartered in London, Trainline is a one-stop shop for European train and coach travel. In 2024, the company celebrates the twenty-fifth anniversary of its first website. Trainline launched its mobile app in 2009, has offices in London, Paris, Edinburgh, Milan, and Barcelona, and has more than 1,000 employees from over 60 countries.

Prior to the migration, Trainline worked with third-party vendors, each managing different services, such as hosting infrastructure, issuing certificates, or logging and hosting the company’s CDN. The setup was challenging to manage and required manual upkeep from the Cloud Operations teams. For instance, the CDN service provider handled all logging, and if Trainline wanted additional monitoring rules, it had to wait for the provider to make those changes. The company also wanted increased visibility into all its traffic and direct alerts to any suspicious activity. To make updates to certificates, Trainline had to submit a request to another provider and wait for it to be fulfilled. Troubleshooting the complex setup required specialist knowledge of each third-party tool, which involved a steep learning curve for new engineers. The company acknowledged this complexity as a challenge that it wanted to solve.

Trainline was already working on adopting a cloud-centered approach using several AWS solutions, and in 2021, it decided to investigate alternative CDN providers. The company spent the first 6 weeks planning, researching other CDNs, assessing and mapping configurations, and testing Amazon CloudFront with a proof of concept. “We were looking ahead to fit this within our overarching strategy of implementing infrastructure as code as well as streamlining our key functionalities into a single system,” says Andrew Dike, senior engineer at Trainline. “AWS was a natural choice.”

Trainline migrated to Amazon CloudFront in stages, beginning with lower-traffic or less critical endpoints and then moving on to domains with higher traffic. During the first stage, Trainline implemented Lambda@Edge, which runs code closer to users and charges the company only when the code is running. Later, when Amazon CloudFront Functions were released, Trainline migrated some of the functionality using Lambda@Edge to Amazon CloudFront Functions, which helped the company reduce its CDN spending.

By the end of 2022, Trainline had migrated 99 percent of its infrastructure to AWS. “The migration to Amazon CloudFront was surprisingly seamless, given the complexity and traffic volumes involved,” says Merlin Taylor, senior engineer at Trainline.

Migrating to Amazon CloudFront means that multiple Trainline team members know the CDN well and can make changes or solve problems. “The distribution of knowledge across the team is definitely a big benefit,” says Dike. “We don’t have a potential single point of failure.” The 100 percent automation achieved with this migration also means that even new team members can be confident in their roles. “We can easily perform peer reviews on all changes, and the high level of automation means that rollbacks can be done quickly if required,” says Keerthivasan Kannan, CDN subject matter expert at Trainline.

Application security and availability were primary concerns during the CDN migration. By using AWS WAF, which protects web applications from common exploits, Trainline maintains control over its security. It protects all its domains with a standardized AWS WAF setup and can onboard a new domain in half a day, as opposed to several days previously. “Using AWS WAF, we have the freedom to add any custom rules into monitoring mode so that we can observe their impact on production traffic before activating them,” says Kannan. Trainline also uses AWS Shield Advanced, which provides additional detection and mitigation against large and sophisticated distributed denial-of-service attacks, near real-time visibility into attacks, and integration with AWS WAF. The team can also quickly issue new certificates for new domains using AWS Certificate Manager (ACM), which provisions and manages SSL/TLS certificates with AWS services and connected resources.