QPOST AI — Cloud Infrastructure Design

The Azure cloud foundation the four Qatar Post AI solutions are deployed on

Version 2 — April 2025 · Prepared by Malomatia for Qatar Post

1. Introduction

The QPOST organization (QPOST) of Qatar is embarking on a transformative journey to modernize its systems through adopting Azure artificial intelligence solutions. The adoption of Azure AI technologies represents a strategic move towards embracing digital transformation, optimizing resource allocation, and delivering transparent, accurate, and timely services.

This design document outlines the Azure framework and environments, including a deployment strategy for Azure cloud services. It serves as a blueprint for the implementation of the AI-backed services solution, ensuring alignment with QPOST's objectives for technological advancement and digital excellence.

This document describes the cloud infrastructure the platform runs on. For how the four solutions are built as agents and workflows on top of it, see the Solution Architecture.

2. Project Overview

2.1 Scope of Work

2.2 Constraints and Assumptions

2.3 Abbreviations

3. Solution Architecture Overview

The AI services solution utilizes Azure native services such as Azure Kubernetes Service, AI Speech, Document Intelligence, Stream Analytics and Translator to serve as the engine for ingestion and processing. Large Language Models (LLMs) deployed via Azure Open AI provide advanced capabilities for natural language processing and embedding functionalities. This architecture is implemented across development, staging and production environments, ensuring scalability and adherence to the Microsoft Azure Well-Architected Framework.

3.1 Environments

The solution is implemented in three environments on the Azure cloud. Separate subscriptions are used for nonproduction and production environments, following Subscription democratization principles — staying within subscription limits, easy application of permissions at subscription and granular resource-group level, reduced blast radius, and simple application of cloud guardrails using Azure Policy.

3.2 Solution Logical View

The logical view provides context on where the components are deployed, a brief connectivity view, and the key systems the solution integrates with. The AI solutions are deployed in Sweden Central, globally VNET-peered to the QPOST HUB in Qatar Central (QC), which connects to the on-premises Core Postal Application over S2S VPN.

3.3 Reference Diagram (Resource Organization)

A high-level design of the complete solution end to end, from a resource deployment view. A shared QPOST Hub / Connectivity landing zone (network, network security and logging services) is VNET-peered to the QPOST AI Landing Zone for both Production and Non-Production, each grouped into Processing, Storage, Network and Platform.

3.4 Reference Diagram (Network Organization)

A high-level design from a networking deployment view: a single VNET per environment segmented into subnets (AI services, Storage, Platform, AKS), each protected by NSGs and User Defined Routes (UDR), with private endpoints for the PaaS services.

3.5 Traffic Flow

Traffic flow for external users, internal users and integration traffic. External user traffic enters through a Palo Alto firewall (Active/Passive) and Application Gateway (WAF, SSL offload) in the HUB before reaching the production VNET in Sweden; integration traffic reaches QPOST Souq, Core/ePOS (web.qatarpost.qa) and Synapse Analytics.

Detailed integration paths, firewall rules, and the communication matrix are covered separately in the QPOST AI Integration Design.

3.6 QPOST AI Chatbot Components

4. Deployment Requirements

4.1 Prerequisites

• Provide Azure subscriptions for all environments.
• Provide the Malomatia team members involved in the project with user accounts within Entra ID.
• Provide the listed Malomatia resources with Contributor or Owner permissions at Subscription level.
• Provide Service Principals for Production and Non-Production in Entra ID.
• Provide permissions on Log Analytics as required for configuring diagnostic settings.
• Provide IP addresses without conflict.
• Assistance with raising support tickets with Microsoft.
• Add Azure policy exemptions if required.
• Provide public DNS entries.
• Provide integration support with internal services (communications, authentication, configuration).
• Provide support for VNET peering and any firewall plus configurations.

4.2 Deployment Actions

Access required (both QPOST AI subscriptions):

5. Solution

This section describes the resource allocations including organization in detail. The solution is deployed in the Sweden region and network-peered (global) with the Qatar Central HUB / Connectivity Landing Zone.

5.1 Resource Groups

Development / Non-Production (QPOST-AI-NonProd-SW)

Production (QPOST-AI-Prod-SW)

5.2 Resource Tagging

Resource tagging follows the standard Microsoft Cloud Adoption Framework. Tag values will be finalized by QPOST.

5.3 Network

5.3.1 Virtual Network

A single virtual network per environment is sufficient to encompass all components.

5.3.2 Subnets

Development — vnet-qpostai-dev-sc-01

Staging — vnet-qpostai-stg-sc-01

Production — vnet-qpostai-prd-sc-01

5.3.3 VNET Peering

VNET peering connects each spoke VNET to the QPOST HUB QC VNET to maintain connectivity between AI Services and QPOST existing components in Azure and On-Premises.

5.4 Data & AI Components (Resources & SKUs)

As of January 2025, services have been commissioned at a lower SKU where possible; resources will be scaled up as required.

Development

Staging

Production

6. Cost Optimization

7. Security

8. Authentication

The solution's services require interaction between each other via Service Principals registered in Entra ID. For supported services, application Managed Identities are used.

9. Reliability

10. Operational Excellence

11. Related Documents

• Solution Architecture — how the four solutions are built on the Eloquent platform
• Website Assistant
• Branch Assistant
• Internal AI Assistant
• Customs Clearance AI