Context & Pain Points
Operating a high-scale transactional fintech platform required strict PCI-DSS compliance, sub-50ms database operations, and tenant isolation strong enough to protect consumer banking profiles and payment records. Two of those pull against each other. The compliance answer to database access is to remove standing human credentials, but developers and DBAs still have to investigate production incidents, and an auditor wants every one of those sessions attributable. The latency answer is to keep the write path short, but the business also wanted reporting and search over the same transaction data, and analytics queries on a write primary are how a payment API starts missing its budget.
What We Had To Solve
- Giving developers and DBAs database access without handing out production credentials or opening a path around the audit trail.
- Achieving sub-50ms database write latencies for real-time transaction processing while analytics queries ran against the same data.
- Configuring encrypted credentials and key rotation to satisfy external auditing bodies.
- Keeping the delivery pipeline itself inside the compliance boundary, so what reaches production is a scanned, tested artifact rather than whatever a laptop built.
How We Built It
- Ran the four payment services as pods on an EKS worker auto-scale group behind a shared ingress proxy, with Cloudflare and a network load balancer in front and every node in a private subnet.
- Put DataSunrise in front of RDS MySQL as the only database path for humans, so every developer and DBA session is proxied, masked and logged; a bastion covers shell access.
- Split the read and write paths: MySQL and Postgres read replicas plus a Multi-AZ secondary for the transactional workload, Redshift and OpenSearch for reporting and search, so analytics never touch the write primary.
- Encrypted all transactional databases with KMS envelope keys on annual rotation, and shipped images through BitBucket and Codefresh (Codacy scan, unit tests, Docker build, push to ECR, Helm deploy to EKS).
- Wired GuardDuty and Security Hub into the account so threat detection findings land in one place, with Glue and S3 behind CloudFront for the analytics and asset paths.
- Defined the platform in Terraform, so the network tiers and IAM boundaries an auditor reviews are the ones in version control rather than a console snapshot.
Outcomes That Mattered
100% Auditing Success
Zero critical findings across PCI-DSS external security evaluations.
Transaction Scalability
Sustained thousands of concurrent transactions with sub-50ms API request responses.
Zero Direct DB Credentials
Every human database session goes through the DataSunrise proxy, so no engineer holds a production database password.
Full Envelope Encryption
Safeguarded 100% of consumer profiles and financial histories with KMS-backed encryption keys.
Scanned Release Path
Every deployed image passed a Codacy scan and unit tests in Codefresh before reaching ECR and EKS, so nothing ships outside the pipeline.
Outcome
Built a production EKS platform that passed PCI-DSS external audits with zero critical findings, served reads from MySQL replicas without touching the write primary, and encrypted every transactional store with KMS-backed keys. Four payment services run as pods behind a shared ingress proxy on a Karpenter-managed worker auto-scale group, with Cloudflare and a network load balancer in front and every node in a private subnet. Human database access goes only through DataSunrise, which proxies, masks and logs each session, and a bastion covers shell access. Reporting runs on Redshift and OpenSearch rather than the transactional store. GuardDuty, Security Hub, KMS and IAM cover the detection and key-management controls the audit asks about, and every image ships through BitBucket and Codefresh into ECR.