A locked-down AWS production platform for a credit union program

01

Context

The program's services had grown on hand-built servers. As it moved to its second-generation platform, the client wanted production in its own AWS account, built so that every change could be reviewed as code.

02

Constraints

Regulatory

Credit unions assess the security of vendors that hold member data. The platform needed controls an assessor can check directly in code: network isolation, encryption, restricted access and backups.

Data

Member and booking data lives in a private database that only the application host can reach.

Integration

Partners allow-list the platform's public IP address, so that address had to survive the rebuild.

03

What we built

A greenfield Terraform stack in the client's AWS account: a new VPC with public subnets for the load balancer and host and private subnets for the database, one HTTPS load balancer routing each subdomain to its service, and a private S3 bucket served through CloudFront with Origin Access Control.

Access is closed by default. There is no SSH: administrators connect through Systems Manager Session Manager. Security groups are layered so the host only accepts traffic from the load balancer and the database only from the host. The CI pipeline has its own identity that can push images to six named container repositories and deploy to that one host, nothing else.

• Terraform for the network, load balancer, host, database, container registry, CDN, IAM and monitoring
• MySQL 8.0 on RDS in private subnets: encrypted, deletion-protected, 7-day backups, Performance Insights and enhanced monitoring
• No SSH: admin access through Systems Manager Session Manager only, with IMDSv2 enforced
• Layered security groups: load balancer to host to database
• A least-privilege CI identity scoped to image pushes and deployments on one host
• A private S3 assets bucket behind CloudFront with Origin Access Control
• The existing public IP kept, so partner allow-lists continued to work

04

Architecture

Expand

Production network, access paths and supporting services as defined in Terraform. Account IDs are omitted.

Full size✕

05

Results

SSH ports open: admin access is through Session Manager only

0

services behind one HTTPS load balancer

6

of automated, encrypted database backups

7 days

to write the full production stack in Terraform

2 weeks

The client's production environment can be rebuilt from code, reviewed before every change, and audited without logging in to a server: who can reach what is visible in the Terraform.

Figures are as measured and approved by the client. We don't publish numbers we can't verify.