Scaling Telco Automation to Millions of Devices with Managed Red Hat Ansible Automation Platform (AAP) on AWS and Red Hat OpenShift Service on AWS (ROSA)

Published Date: June 30, 2026

If you are working in the telecommunications industry or operating networks with a massive number of edge nodes (such as home routers, modems, or broadband gateways) reaching millions of devices, rolling out configuration updates or upgrading firmware simultaneously without causing system congestion is always an extremely challenging problem.

Today, I would like to share a very interesting architecture, adapted and detailed from the AWS Architecture Blog, which solves this ultra-large-scale challenge by combining Managed Red Hat Ansible Automation Platform (AAP) on AWS and Red Hat OpenShift Service on AWS (ROSA).

The Core Concept: Decoupling Control Plane and Execution Plane

Traditional management systems often bundle the control plane (user interface, API) and the execution plane (running automation jobs) on the same server infrastructure. When you send updates to hundreds of thousands of devices at once, the sudden spike in CPU and memory usage can crash the entire management portal.

This modern architecture solves that by separating the two:

  • Control Plane: Managed AAP on AWS acts as the central hub. It only handles the user interface, APIs, and overall orchestration. It dynamically syncs the device inventory from external CMDBs or Cloud Providers and retrieves playbooks from a centralized source control system like GitHub.

Architecture overview of ROSA and AAP decoupling

  • Execution Plane: The heavy lifting of executing Ansible Playbooks is offloaded to Kubernetes pods (called Container Groups) running on the ROSA cluster.

When a peak workload occurs, the execution plane can scale out dynamically to connect with edge gateways via IPv4/IPv6, while the control plane user interface remains fully responsive.

High-Availability Infrastructure: Multi-Region & Stateless with Amazon S3

For disaster recovery, the control plane is deployed in an active-passive or active-active multi-region setup. The Ansible Playbooks, inventory details, and job execution logs are stored as stateless objects in Amazon S3, ensuring data durability and low-latency retrieval across regions.

Multi-region stateless deployment with S3