AWS network topology of a payments fintech

Views in this map

1. 1
   RegionsThree regions, each with a transit gateway: primary, disaster recovery and the EU.
2. 2
   Internet exposureInbound only through CloudFront; egress only through inspected NAT; vaults have none.
3. 3
   us-east-1Six spoke VPCs and an inspection VPC; every flow between them crosses its firewall.
4. 4
   Payments VPCThree subnet tiers behind one load balancer; card numbers leave only for the vault.

Regions ‹ › Internet exposure ▸ us-east-1 ▸ Payments VPC

Flows to play

• ▷
  A card paymentFrom a merchant’s checkout to a token from the vault. In the us-east-1 view.
• ▷
  A payout file goes to the bankThe daily payout file, out through the one inspected exit. In the us-east-1 view.
• ▷
  Inside the payments VPCOne payment through the tiers and their security groups. In the Payments VPC view.

The model behind it

63 records of 17 types. Every box on the map is one of them, so the filters and the record panel read the same data.

• VPCs 13
• Subnet tiers 9
• Accounts 7
• Workloads 5
• Gateways 4
• Edge services 4
• Regions 3
• 10 more types 18

Filters

Environment and Account: pick a value and everything else fades.