🌙
☀️
AWS Case Study
Loan Portal
FinTech
AWS ap-south-1
Securing and Scaling
the Loan Portal for
Hindon Mercantile
Hindon Mercantile Limited is a financial services workload deployed in AWS Region ap-south-1 within a dedicated VPC — built for secure, scalable, and compliance-ready loan processing.
HTTPS
Only Access Enforced
KMS
Encrypted Storage
Zero
Downtime Rotation
Hindon Loan Portal — Security Dashboard
Edge Delivery
CloudFront
↑ HTTPS + FLE
Encryption
CMK / KMS
↑ S3, EBS, RDS
Secret Rotation
Auto
↑ Secrets Manager
Audit Trail
Active
↑ CloudTrail
ALB
Private Subnets
↑ Secured
CI/CD
CodePipeline
↑ Bitbucket
100%
Compliance Ready
✓ Audited
About Hindon Mercantile Limited
Hindon Mercantile Limited is a financial services workload deployed in AWS Region ap-south-1 within a dedicated VPC. The architecture uses Amazon CloudFront as the primary edge delivery and security layer, an Application Load Balancer in front of EC2-based application servers in private subnets, Amazon S3 for static assets and access logs, AWS KMS for encryption key management, AWS Secrets Manager for secrets, and Amazon CloudWatch and AWS CloudTrail for monitoring and auditability. CI/CD is handled through AWS CodePipeline with Bitbucket as the source repository.
Challenges
Five critical security and operational challenges facing the loan portal
1400 × 900 px · WebP
The loan portal needed a secure internet-facing delivery layer for borrower traffic.
Sensitive borrower data required strong encryption in transit and at rest.
Access to application servers and internal AWS services had to be tightly controlled.
Secret rotation and certificate management needed to be handled without downtime.
The platform required auditable monitoring and compliance-ready logging.
Solutions Provided
A comprehensive AWS security and delivery architecture for the loan portal
Implemented Amazon CloudFront as the primary entry point with HTTPS-only traffic and ACM-managed certificates.
Protected sensitive POST fields using Field-Level Encryption with a customer-managed RSA public key.
Placed Application Load Balancer and EC2 application servers behind private networking controls.
Enabled SSE-KMS encryption for Amazon S3, Amazon EBS, and Amazon RDS using customer-managed CMKs.
Stored operational secrets — the X-Origin-Verify header secret, RSA private key, and RDS credentials — in AWS Secrets Manager with automatic rotation.
1400 × 900 px · WebP
Centralized monitoring with Amazon CloudWatch and audit logging with AWS CloudTrail.
Used AWS CodePipeline for deployment orchestration with Bitbucket as the source control system.
Result Outcome
Strong security posture, automated operations, and compliance-ready architecture
1400 × 900 px · WebP
The application achieved a strong security posture with encrypted traffic, encrypted storage, and restricted access paths.
Sensitive borrower data was protected at the edge and at rest.
Secret rotation and certificate handling were automated to reduce operational overhead.
Monitoring and audit trails improved visibility into system health, security events, and configuration changes.
The architecture was designed to support secure production delivery with minimal public exposure.
HTTPS
Only Access Enforced
Across all public-facing borrower traffic
CMK
Encryption at Rest
S3, EBS, and RDS protected with customer-managed keys
Zero
Downtime Secret Rotation
Automated via AWS Secrets Manager
Success Metrics
Five measurable security and compliance outcomes delivered
HTTPS-only access enforced across public traffic
CloudFront with ACM certificates ensures all borrower traffic is encrypted in transit — no plain-text HTTP permitted.
Sensitive form fields protected through edge encryption
Field-Level Encryption on CloudFront protects sensitive POST data before it reaches the origin, using a customer-managed RSA key.
Customer-managed encryption keys used for storage protection
SSE-KMS with CMKs applied to S3 buckets, EBS volumes, and RDS instances — full control over key lifecycle.
Secrets rotated automatically without service disruption
AWS Secrets Manager handles rotation of database credentials, header secrets, and RSA private keys with zero-downtime automation.
Full audit trail maintained through CloudTrail and CloudWatch logs
Every API call, configuration change, and security event is captured and retained for compliance review and incident response.
Automated CI/CD deployment pipeline with Bitbucket integration
AWS CodePipeline with Bitbucket as source ensures consistent, auditable deployments to the private-subnet application servers.
Transformation
Before vs After: Exposed Infrastructure to Enterprise-Grade Security
✕ Before
No secure internet-facing delivery layer for borrower traffic
Sensitive borrower data exposed — no field-level or storage encryption
Application servers accessible without private networking controls
Manual secret and certificate management — risk of downtime
No auditable monitoring or compliance-ready logging infrastructure
✓ After
CloudFront with HTTPS-only and ACM certificates as the primary entry point
Field-Level Encryption + SSE-KMS protecting borrower data end-to-end
ALB and EC2 servers in private subnets — minimal public exposure
Secrets Manager with automatic rotation — zero-downtime operations
CloudWatch + CloudTrail delivering full audit trail and compliance visibility
Technology Stack
AWS Services Deployed
Amazon CloudFront
Edge Delivery & Security
Application Load Balancer
Traffic Distribution
Amazon EC2
Private Subnet Compute
Amazon S3
Static Assets & Logs
AWS KMS
Encryption Key Management
AWS Secrets Manager
Secret & Cert Rotation
AWS CloudWatch
Monitoring & Alerting
AWS CloudTrail
Audit Logging
AWS CodePipeline
CI/CD Orchestration
Bitbucket
Source Control
AWS ACM
Certificate Management
Amazon VPC
Network Isolation
Conclusion
A secure and production-ready foundation for loan processing
1400 × 900 px · WebP
“
By implementing CloudFront, ALB, EC2 private subnets, KMS encryption, Secrets Manager rotation, and centralized monitoring, Hindon Mercantile Limited established a secure and production-ready architecture for its loan processing workload. The solution improved security, simplified operations, and created a compliance-friendly foundation for future growth.
1400 × 900 px · WebP
Accepting New Enterprise Clients
Ready to Secure Your
Financial Platform?
Book a complimentary cloud architecture review. Our AWS-certified engineers will assess your financial workloads and deliver a tailored security and compliance roadmap — no commitment required.
No commitment required
Response within 24hrs
AWS Advanced Partner