Introduction:
Customer is a next-generation private sector bank operating 465+ branches across India, regulated by the Reserve Bank of India, with a strong governance framework and a modern digital banking ecosystem. The bank leverages contemporary technology and robust infrastructure, offering state-of-the-art internet banking solutions for both personal and business customers.
Client:
Leading Private Sector Bank
Industry:
BFSI
Offering:
- AWS Infrastructure setup.
- Control Tower setup.
- Firewall Setup.
AWS Services:
- EC2, ASG.
- RDS, ElastiCache.
- S3, EFS.
- CloudWatch Alerts, Backup.
- VPC, Site-to-Site VPN with TGW between Onprem and AWS.
- FortiGate Firewall.
Business Need:
The bank sought to modernize its application hosting strategy by migrating a critical application from its on-premises data center to AWS across Development, UAT, and Production environments.
Beyond migration, the leadership team aimed to:
- Establish a secure, standardized multi-account AWS environment
- Implement AWS Control Tower over the existing AWS Organization
- Embed governance, compliance, and monitoring aligned with AWS Well-Architected best practices
- Strengthen hybrid connectivity between on-premises and cloud
- Ensure enterprise-grade security across network, application, and data layers
They needed a partner who could architect not just infrastructure — but a future-ready, audit-compliant cloud foundation.
The Solution: 10 Strategic Implementations
The Solution: 10 Strategic Implementations
- Secure Multi-Account AWS Foundation (Mumbai Region)
Deployed a production-grade environment in AWS Mumbai Region with structured Dev, UAT, Prod, Network, and Audit accounts.
Implemented VPCs with public/private subnets, IGW, NAT Gateway, and optimized route tables aligned to architecture best practices.
- Centralized Security Governance & Threat Management
Enabled CloudTrail and AWS Config with centralized log storage in S3.
Configured GuardDuty, Security Hub, and Inspector with the Audit/Security account as delegated administrator across all child accounts ensuring continuous threat detection and compliance visibility.
- Advanced Network Connectivity & Hybrid Integration
Implemented Transit Gateway (TGW) architecture shared across accounts using AWS Resource Access Manager.
Established Site-to-Site VPN connectivity between AWS and on-prem via TGW with proper routing configurations.
- Enterprise-Grade Firewall & Traffic Inspection
Deployed Gateway Load Balancer (GWLB) with FortiGate Firewall instances (GENEVE port 6081).
Configured GWLB endpoints to inspect and control inbound/outbound traffic across environments.
- Web Application & Edge Security
Designed and deployed AWS WAF with WebACL, custom rule groups, and IP sets.
Centralized WAF logging into S3 for Dev, UAT, and Prod accounts to ensure visibility and audit readiness.
- Secure Application Delivery Layer
Provisioned:
- External & Internal Application Load Balancers (ALB)
- Target groups & security groups
- SSL/TLS certificates via AWS Certificate Manager
Deployed EC2 web servers with IAM roles and encrypted EBS volumes using AWS KMS.
- Container & Image Management
Created Amazon ECR repositories and pushed Docker images securely using AWS CLI — enabling containerized workload management and scalable deployments.
- High-Performance Data & Messaging Layer
Provisioned:
- Amazon RDS (with subnet & parameter groups)
- Amazon ElastiCache (user groups & subnet groups)
- Amazon MSK cluster
- Amazon EFS storage
- Secure S3 buckets
Enabled encryption and backup for EC2 and RDS.
- Monitoring, Logging & Alerting Framework
Configured:
- CloudWatch Alarms & Log Groups
- SNS Topics with subscriptions for proactive alerts
Created a dedicated IAM user (read-only S3 access) for integration with on-prem SIEM tools.
- Enterprise Backup & Resilience Strategy
Enabled AWS Backup for EC2 and RDS resources to ensure automated recovery readiness and business continuity.
Reaping Rewards:
The solutions delivered measurable operational and strategic benefits to customer:
- 20% cost optimization achieved through EC2 Auto Scaling and a centralized single Site-to-Site VPN via Transit Gateway — eliminating redundant VPN deployments.
- 30% reduction in operational effort enabled by CloudFormation automation, one-click security enablement via delegated Audit account, and fast account provisioning with Control Tower.
- 100% traffic inspection coverage with FortiGate Firewall and AWS WAF; all workloads deployed in private subnets with no public server exposure.
- Zero-trust access model enforced using IAM roles, least-privilege policies, MFA, and KMS encryption for end-to-end data protection.
