AWS or Azure for a Low-Maintenance HIPAA-Compatible Laravel App?
Asked by
MellowPine47
I'm a solo Laravel developer moving a production application away from a Forge-managed VPS because I need infrastructure where a HIPAA Business Associate Agreement can be signed. My main goal is minimizing server and DevOps work rather than maximizing flexibility or future scale.
The application uses Laravel with Inertia/React, MySQL, the Laravel scheduler, one queue worker, Stripe, GitHub Actions deployments, and external services for email, storage, and video. Database-backed queues are sufficient at the current scale.
On Azure, I'm considering App Service, Azure Database for MySQL, a continuous WebJob for `queue:work`, and a scheduled WebJob for `schedule:run`. On AWS, I'm considering Elastic Beanstalk with RDS MySQL, but I'm unsure what the simplest reliable equivalent would be for the queue worker and scheduler without introducing a lot of additional infrastructure.
For developers who have operated Laravel on both platforms, which would you choose for a solo developer who values low maintenance while still needing HIPAA/BAA-compatible infrastructure? If you prefer AWS, what exact setup would you use for `queue:work` and `schedule:run` to keep things reliable and hands-off?
I'm not looking for a highly elaborate architecture—just a managed setup that is secure, dependable, and doesn't require constant babysitting.
Answers
For a more container-oriented AWS design, ECS on Fargate can run the web service and a separate long-running worker, with SQS for queues and RDS or Aurora for MySQL. It’s dependable and can run for years with relatively little operational work, but it introduces more AWS components than the simplest Beanstalk approach. I’d only choose it if you’re already comfortable with containers or expect the workload to grow.
Reply to this answer
Either platform can run Laravel, but HIPAA compliance is about much more than choosing a cloud provider. Start by confirming that every service in the architecture is HIPAA eligible and covered by the appropriate BAA. You’ll also need encryption, restricted access, backups, audit trails, secure deployments, and a process for explaining administrative access to systems containing protected health information.
For a small team, I’d favor the platform whose managed job model you already understand. Azure WebJobs map fairly neatly to a Laravel worker and scheduler, so Azure may involve less custom plumbing in this particular design. Keep an eye on application logs, sessions, uploads, queue payloads, and temporary files as well—none of them should accidentally contain PHI in an unapproved location.
Reply to this answer
If you choose AWS, I’d keep the setup deliberately small: Elastic Beanstalk for the web application, RDS MySQL with private networking, and a separate worker process or worker environment running `php artisan queue:work` with sensible timeouts and retry limits. Run `schedule:run` from one managed cron trigger every minute rather than starting a scheduler on every web instance. The worker should have its own least-privilege permissions, and a failed or poisoned job should not be able to loop indefinitely.
At this scale, you don’t necessarily need Kubernetes or a large container platform. The important parts are making the database and worker private, managing secrets correctly, restricting administrative access, and ensuring the chosen services are covered by the required agreement.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowPine47: That makes sense. If you were operating this alone and wanted the least ongoing maintenance, would you personally lean toward Azure rather than AWS?