In this article we are going to see how HSBC designed serverless at scale architecture. I haven’t worked in the banking domain yet so I was intrigued on how Banks design and secure their application. So I looked into AWS blogs and found a very interesting talk from This is My Architecture, AWS series. It’s a very high level view of the architecture but it does provide some cool design decisions that we all can learn from. I’ve already discussed a few other architectures from the series, you can look up here

serverless-at-scale

Following are the key decision decisions that are worth mentioning:

  • Small CIDR and large CIDR blocks are in two different VPCs.

  • Suppose we have 1000 IP addresses and are using just one VPC, then when we scale we would run out of the IPs quickly.

  • Smaller CIDR range is applied to a set of proxies.

  • Suppose we are using /16 IP address ranging which is almost 65000 IP addresses. So any of the service that wants to connect to the bank talks to the private VPC endpoints, these endpoints talk to the proxies and proxies can acquire direct connect to the Bank. This way they can communicate back to the bank with separate segregation which means services transiting safely in and out of the bank.

    Moreover, if we run out of 65000 IP addresses, we can create another VPC and connect to the proxies. This way we can scale out.

  • The other proxies on the right are controlled by separate security team. The security team whitelist all the domains that proxies can talk to. For example: sending push notifications. In addition, we can implement this pattern to whitelist AWS services that we want to connect to the proxies which means we’re still private and not connected to the internet.

Reference : This is My Architecture, AWS