The AWS Cloud Foundations and Security Architecture for Afin Bank
Afin Bank is a UK digital bank building a modern banking platform for savings and mortgage products.
Client
Afin Bank
Industry
UK digital bank
Environment
Amazon Web Services
Challenge
Greenfield banking platform
Timeline
8 months to production-ready
The Client
Afin Bank
Afin Bank is a UK bank authorized by the Prudential Regulation Authority (PRA) and regulated by both the PRA and the Financial Conduct Authority (FCA). In that context, infrastructure and security decisions carry direct regulatory weight, and operational resilience, third-party risk, auditability, and clear accountability have to be designed into the platform from the start.
Plectrum contributed to the delivery of Afin Bank’s greenfield AWS platform as part of a broader program involving Vacuumlabs, Afin’s internal team and additional delivery partners. Within that wider effort, Plectrum delivered AWS Landing Zone and took responsibility for the security architecture and implementation across the environment.
The Challenge
This Was a Complete Greenfield Build for a Banking Application
Greenfield Build
This was a complete greenfield build for a banking application, not a SaaS-based setup assembled from off-the-shelf components.
Complex Networking
The platform spanned 15+ AWS accounts across four environments (three non-production, one production), with complex networking built on AWS Transit Gateway.
Security Posture
At the same time, the bank needed a stronger security posture and clearer visibility across its AWS estate, so it could detect risks earlier and respond with more confidence.
Practical SIEM Capabilities
That included practical SIEM capabilities, but without a fully defined internal operating model for what SIEM should look like in practice.
The Delivery
In Numbers
0+
AWS accounts
4
Environments
0
Applications
~ 95%
Infrastructure Delivered as Terraform Cloud IaC
In Technology
Amazon Web Services
Terraform
AWS ECS Fargate
AWS Transit Gateway
AWS Security Hub
AWS GuardDuty
In Detail
Multi-account AWS Organization
A multi-account AWS Organization across four environments, giving the bank clear separation between production and non-production workloads.
AWS-native SIEM Solution
Plectrum designed and implemented the security architecture across the AWS environment, using native AWS services to create a practical security operating model without waiting for a separate third-party SIEM rollout.
Security Remediation and Prioritization
Compliance expectations provided by the client were also reviewed repeatedly and used as an input into ongoing security decision-making, helping the team judge which actions mattered most at a given point in time.
Accounts and Environments
- A multi-account AWS Organization across four environments
- Centralized workforce access and operational visibility through AWS IAM Identity Center and Amazon CloudWatch
Network
- A controlled network boundary built on AWS Transit Gateway, governing internet-facing and third-party connectivity
- Architecture designed to improve isolation, security, and traffic inspection by ensuring that inbound and outbound traffic passed through a controlled environment before reaching internal workloads.
Application Platform
- A containerized microservices runtime on Amazon ECS Fargate, without servers to manage
- Managed data and event streaming services, including Amazon Aurora and Amazon MSK, supporting the banking application landscape
Threat Detection and SIEM
- Centralized security posture management and threat detection across the AWS Organization, built on AWS-native services such as AWS Security Hub and Amazon GuardDuty
- Audit logging and real-time alerting on security-sensitive activity across the estate
- Security dashboards giving the team a clear view of threat activity and security events
Identity and Protection
- Protection of public-facing entry points with AWS WAF
- Least-privilege access for people, services, and automation, without reliance on long-lived credentials
- Security checks embedded in the CI/CD pipeline, alongside runtime and platform-level controls
Remediation and Handover
- Reviewing infrastructure pentest findings, prioritizing them based on severity and practical impact, and driving remediation of the most critical issues first
- Detailed architecture and implementation documentation, followed by multiple handover sessions to transfer knowledge to the internal team
The Outcome
An Enterprise-grade Foundations
Afin Bank received a greenfield AWS platform with strong multi-account structure, controlled networking, centralized traffic handling, and production-grade infrastructure delivered through Terraform Cloud. At the same time, the platform gained a stronger and more coherent security model.
Speed
Useful SIEM coverage immediately, using native AWS services without waiting for a separate third-party SIEM rollout.
Audit
95% of infrastructure delivered as Terraform Cloud IaC, integrated with GitHub for controlled, auditable change delivery.
Focus
Infrastructure pentest findings prioritized by severity and practical impact, with the most critical issues remediated first.
Trust
A greenfield platform designed in line with the AWS Well-Architected Framework, built for a bank regulated by the PRA and FCA.
The Client Reference
“Building a regulated digital bank demands a solid infrastructure approach and an uncompromised security architecture. Plectrum came into a complex, multi-party greenfield build and immediately brought senior technical leadership to our AWS platform. Plectrum acted as a true engineering partner rather than just an execution team. They simplified complex decisions and helped prioritize security remediations to keep us aligned with PRA and FCA regulatory expectations, but also industry frameworks. Their clear documentation and hands-on handover left our internal team with an auditable, highly maintainable platform we can confidently scale in the years to come. In a nutshell, they delivered an enterprise-grade foundation with 95% of our platform delivered via Terraform Cloud across 15+ AWS accounts, an ECS Fargate microservices runtime, controlled Transit Gateway networking, and an AWS-native SIEM model using Security Hub and GuardDuty for actionable, real-time threat visibility. As CTO, having a partner like Plectrum who brings both high-level security vision and deep execution capability was invaluable to setting Afin Bank up for success.”
