Scaling Secure Workloads with AWS Cloud Infrastructure for a Digital Lending and Financial Services Provider

About Client:

The client is a digital lending and financial services provider offering a platform for loans, investments, and financial wellness solutions. The platform functions as a marketplace connecting borrowers with multiple lending partners, serving both individual and enterprise customers. Their offerings span various loan products, investment options, and value-added services such as tax planning and wellness. Given the transaction-intensive and data-sensitive nature of the platform, the client requires a scalable, secure, and high-performance infrastructure to support large volumes of financial transactions and ensure seamless partner integrations.

The digital lending and financial services provider faced the challenge of building a secure, scalable, and compliant platform from the ground up without any legacy infrastructure, while adhering to aggressive go-live timelines. The platform needed to be production-ready from day one to support revenue operations, onboard multiple lending partners, and deliver seamless end-to-end digital loan journeys. In addition to these foundational requirements, the system had to address performance bottlenecks related to data access and object retrieval. Loading and accessing objects from storage was time-consuming, impacting user experience and system efficiency. The client also required a secure mechanism to avoid directly capturing or overloading the production database, while establishing a protected connection from an on-premises Ubuntu server to the new database environment. Initially, the approach considered involved creating a disaster recovery (DR) database and fetching data from hourly backups, which introduced additional complexity and latency. The platform also needed to be cost-efficient, avoiding over-provisioning of infrastructure while still meeting performance and a scalable reporting mechanism to support business MIS without impacting transactional workloads

At the same time, the platform needed to handle unpredictable spikes in loan application volumes, ensure strict compliance with RBI data residency guidelines and global standards such as ISO 27001 and SOC 2, and maintain high availability to protect customer experience and partner trust. Security and compliance expectations were particularly stringent, requiring all storage systems to eliminate public exposure and enforce strict access controls. These requirements were further intensified by the need to minimise operational complexity and enable rapid expansion into additional financial products without re-architecting the system, while also ensuring faster and more secure content delivery across the platform.

To address these challenges, a cloud-native, containerised microservices architecture was designed and deployed on AWS, built entirely within the ap-south-1 region to meet RBI data residency requirements. The solution leveraged managed services to balance scalability, security, compliance, and cost efficiency while enabling rapid go-live. Amazon EKS was used for container orchestration, allowing independent scaling and deployment of services to handle unpredictable spikes in loan application volumes, while Amazon RDS PostgreSQL (Multi-AZ) ensured a highly available, compliant, and production-ready transactional database.

To meet the requirement of avoiding production database overload while enabling secure external access, a right-sized Read Replica was created from the production database. Instead of provisioning a full-scale disaster recovery database for reporting and data access, this approach significantly reduced infrastructure costs. A dedicated EC2-based jump server (db-jumpbox) was implemented to establish a secure, controlled connection between the on-premises environment and the cloud database layer, ensuring that only authorised traffic could access the Read Replica. This design enabled secure hybrid connectivity while maintaining strict isolation of the production database.

To support business reporting needs without impacting transactional workloads, the client’s MIS reporting framework was implemented using Metabase, allowing seamless generation of insights directly from the Read Replica.

For storage and content delivery, Amazon S3 was used for secure and durable object storage. To address performance bottlenecks in object access, Amazon CloudFront was configured in front of S3, significantly improving content delivery speed. Security and compliance were further strengthened by enforcing account-level public access blocks across all S3 buckets and enabling private access through CloudFront, ensuring that no storage resources were publicly exposed.

A multi-tier VPC architecture ensured strict network segmentation between public, application, and database layers, with secure ingress managed through an Application Load Balancer. End-to-end encryption was implemented using AWS KMS, supported by logging and monitoring mechanisms to meet ISO 27001 and SOC 2 compliance requirements. High availability and operational resilience were achieved through Multi-AZ deployments, automated backups, and disaster recovery strategies, while observability and controlled CI/CD pipelines enabled reliable, zero-downtime releases.

This approach not only addressed scalability, security, compliance, and performance challenges but also delivered significant cost optimisation, improved reporting capabilities. It established a robust, flexible, and future-ready foundation to support the organisation’s expansion into additional financial products.

Key Actions:

Designed a Cloud-Native Microservices Architecture:

• Deployed containerised workloads on Amazon EKS using managed node groups to reduce operational overhead and enable horizontal scaling.

• Segregated services (backend, frontend, API gateway, identity, messaging) into independent deployments with dedicated container images stored in Amazon ECR.

• Implemented Kubernetes Ingress with the AWS Load Balancer Controller and IRSA for dynamic provisioning and secure IAM-based access at the pod level.

Implemented Secure and Segmented Network Architecture:

• Built a custom multi-AZ VPC (10.20.0.0/16) with strict separation of public (ALB), private application (EKS), and database subnets across three Availability Zones.

• Configured security groups to restrict traffic flows (e.g., EKS to RDS on port 5432, Redis on 6379) within the VPC CIDR, ensuring no direct public access to sensitive layers.

• Enabled private connectivity to S3 using a VPC Gateway Endpoint, preventing data from traversing the public internet and reducing NAT Gateway costs.

Enabled Observability, Monitoring, and Governance:

• Configured infrastructure and application monitoring using Amazon CloudWatch metrics, logs, and alarms across RDS, EKS, ALB, and Redis.

• Implemented CloudWatch Synthetics canaries for proactive health checks and AWS CloudTrail (organisation trail) with log file validation for audit logging.

• Integrated alerting workflows with incident management tools and established thresholds for critical metrics to ensure rapid issue detection and response.

Built a Secure and Controlled CI/CD Pipeline:

• Implemented CI/CD pipelines (backend, frontend, webview) using AWS CodePipeline integrated with Amazon ECR for image build and storage.

• Introduced manual approval gates with role-based access (SSO permission sets) to enforce deployment governance before production releases.

• Enabled rolling deployments to EKS to ensure zero-downtime releases, with rollback mechanisms to maintain platform stability.

Comprinno designed a secure, scalable, cloud-native microservices platform deployed on AWS within a multi-AZ Virtual Private Cloud in the Mumbai region. It follows a layered design approach consisting of ingress, application, and data layers, ensuring high availability, security, and compliance for a regulated financial services environment.

User traffic enters the system via Amazon CloudFront and is protected by AWS WAF, ensuring secure and filtered access. Requests are routed through an Application Load Balancer, where TLS termination is handled using AWS Certificate Manager, enforcing HTTPS communication. The core application layer runs on Amazon EKS, hosting containerised microservices distributed across multiple Availability Zones for fault tolerance. These services include backend applications, API layers, and supporting components, all deployed in private subnets and scaled dynamically using auto-scaling groups. Container images are stored securely in Amazon ECR and deployed via CI/CD pipelines.

The data layer consists of Amazon RDS PostgreSQL configured in a Multi-AZ setup for high availability, along with a read replica to handle read-heavy workloads. Application performance is enhanced using Amazon ElastiCache Redis for caching and session management. Static content and documents are stored in Amazon S3, accessed privately through a VPC endpoint to avoid public internet exposure. Security and compliance are enforced through AWS KMS for encryption, IAM for access control, and AWS CloudTrail and CloudWatch for monitoring and auditing. Backup and disaster recovery are handled using AWS Backup and cross-region strategies.

The CI/CD pipeline integrates GitHub with AWS services like CodeBuild, CodeDeploy, and CodePipeline to enable automated, controlled deployments with approval gates, ensuring zero-downtime releases.

Metrics for Success

The following KPIs highlight the measurable improvements achieved through the implementation of a secure, highly available, and cloud-native AWS architecture.

KPI 1: Platform Availability – Reduction in Unplanned Downtime Risk

• Baseline:

The production environment lacked Multi-AZ redundancy and automated failover. Failure of any critical component (database, application node, or cache layer) would result in complete platform downtime, with no defined recovery objectives.

• Improvement Target:

a. Implement a highly available architecture with automated failover across all critical components.

• b. Eliminating single points of failure and ensuring continuous platform availability.

• Actual Result:

The platform now operates with Multi-AZ RDS PostgreSQL, ElastiCache Redis replication across two AZs, and EKS worker nodes distributed across three AZs. Application Load Balancers distribute traffic across all AZs. Cross-region backup strategies include hourly replication of RDS and EBS backups to ap-south-2 with 35-day retention, and S3 Cross-Region Replication with a 15-minute RTC SLA. This architecture significantly reduces downtime risk and enables recovery from regional failures.

• Measurement Methodology:

Validated through AWS configurations including RDS Multi-AZ status, Auto Scaling Group health metrics, AWS Backup execution logs, cross-region replication status, and S3 RTC configuration.

KPI 2: Security Posture – Implementation of Continuous Monitoring and Audit Controls

• Baseline:

No centralized logging, threat detection, encryption strategy, or audit mechanisms were in place, resulting in significant compliance gaps for handling sensitive financial and KYC data.

• Improvement Target:

Establish a continuously monitored security framework with encryption, real-time threat detection, audit logging, and automated alerting aligned with compliance standards such as ISO 27001 and SOC 2.

• Actual Result:

A comprehensive security framework was implemented, including 14 AWS KMS CMKs for workload-level encryption, GuardDuty with six active data sources, organisation-level CloudTrail with log validation, and 25+ CloudWatch alarms integrated with PagerDuty via EventBridge. This provides continuous threat detection, auditability, and compliance readiness.

• Measurement Methodology:

Validated via GuardDuty detector status, CloudTrail logging configuration, KMS key inventory, CloudWatch alarm configurations, and compliance commitments.