How Amadeus built a more personal travel experience

Public cloud migration is first step towards a data-centric architecture

Amadeus CTO Sylvain Roy explains how changing markets for travel sparked the evolution of the company's service-oriented architecture to a robust yet agile, cloud-native, event-driven architecture.

Amadeus is one of the largest companies you might never have heard of. The Spanish owned multinational company provides software solutions for global travel and tourism and the chances are that you have interacted with Amadeus software on multiple occasions when you’ve travelled. The company employs approximately 19,000 people across 190 countries.

Sylvain Roy is the Senior Vice-President of the Global Technology and Cloud platform (GTC) organization and Chief Technology Officer at Amadeus. He explains how the scale of the global travel ecosystem that Amadeus powers means that migration to a cloud-native architecture was inevitable as evolving consumer expectations and changes in the way we use the internet to research and book travel increased traffic levels exponentially.

“Fifteen years ago you would probably make about 100 shopping requests for one booking. Now we have meta search and travel aggregator sites, but all that traffic comes through us. So now the traffic behind one booking request is more in the thousands.

“We receive 100,000 transactions per second. It’s as much as Google search. Booking, check-in and boarding are small subsets, but the vast majority is shopping traffic. We had to scale.”

The migration to public cloud and cloud-native architecture is part of a far more complex story. In addition to building an event-driven architecture in public cloud (Microsoft Azure,) there was also the consideration of self-service capability for Amadeus customers – the airlines, hotels and travel companies.

“We have done much more than simply move infrastructure,” says Roy. “There is a great deal of redesign and reapplication. Amadeus has a very robust, service orientated architecture. We have thousands of microservices. On top of that we have built an event-driven architecture in the public cloud and developed a data mesh which enables data to flow freely between applications.

“Partners and systems integrators have been able to interface with Amadeus applications services for some time. Now they can do so with events which is super dynamic and a very powerful way to follow the traveller across the entire journey.”

What Roy’s team has done is architect a platform where system, services, events, data and technical assets like websites are opened to customers via a series of APIs. Customers can customise these applications to their precise requirements.

“We want them to be able to take our assets and build whatever they want with it,” says Roy.

“We provide access to the underlying modules of this product. This means starting with a product that is fully functional because the whole thing is super complex. We are talking about software that runs on thousands of machines with lots of integrated use cases and thousands of microservices.

“We give this to partners as a product and then because they have access to the underlying features, they can use every module of this platform the way they want. They can progressively customise it and arrive at a product aligned with their business strategy.”

Evolution is a complex business

Roy has a neat line in analogies when it comes to explaining why a service-oriented architecture as robust as the one Amadeus has built, needed to evolve.

“I compare service-oriented architecture to a phone call,” he says. “You have one application calling another which is great for a one-to-one interaction, but an event-driven architecture can trigger one-to-many interactions. It makes the flow of information more agile between applications and that means our customers and their customers are better served.”

A data mesh making data accessible for customer partners and products in a decentralised, agile way sounds like a dream come true for many organisations. But the ever-present menace of third-party cyberattacks means that the data-driven dream can take on a distinctly nightmarish quality. As Roy says:

“We are present across the entire traveller journey, but we are not alone. There are travel websites, airline websites and that’s just the shopping part. Airport operators, airlines, rentals, hotels and tour operators all have their own systems.

“Then there are local government regulations from around the world to take into consideration. Becoming a more data-centric organisation with events, data and services flowing across the entire system means we need the governance in place for that.”

This means a secure vault for credit card numbers.

“They don’t move around the mesh in the open,“ Roy says. “We have a vault for PII [personally identifiable information] data too so only applications that need it have access to it.”

Zero-Trust

Another of the moving parts of this transformation is a move to zero-trust security architecture. Roy refers to more traditional security architecture as a bastion model.

“In a bastion model, it is difficult to get in but once you’re in you’re in. With zero-trust which we are putting in place as part of our migration, every single application is a small bastion. There is no ‘inside’. There is no one large fortress but there are plenty of smaller ones.”

Amadeus is choosing not to rely on Microsoft when it comes to security, aware of its obligations in the shared responsibility model and perhaps, Microsoft’s less than stellar track record in that department,

“One of the reasons we put in place this zero-trust architecture is that every single application is secured on its own terms. We secure the interaction between systems and the encryption is managed with keys that are separate from the Microsoft layer.”

A traditional security model was never going to be up to the job of securing such a vast and complex infrastructure. It has to evolve as the system itself evolves.

“Opening the system is something we started over five years ago and it is a continual evolution. It is a programme without end.”