Case Studies→Payment Gateway→Part 2
Part 2•25 min read

Technical Architecture: Building a Secure, Scalable, and Resilient Payment Gateway on AWS

Deep dive into the cloud-native, event-driven architecture designed for high availability, resilience, low-latency, and PCI-DSS compliance supporting both card-based and UPI transactions.

10+ engineers
3-region deployment
Expert Level
PCI-DSS Compliant

Infrastructure Building Blocks

Edge & Security Layer

CloudFront

CloudFront

Edge delivery

TLS termination at edge, with integrated WAF for global performance.

WAF

AWS WAF

Web protection

Protects against OWASP Top 10 threats, IP blocks, geo rules.

Route 53

Route 53

DNS & routing

Single hosted zone with health checks and global routing.

Certificate Manager

SSL/mTLS

Certificates

TLS 1.2+ enforced, mTLS for PoS devices using X.509 certs.

Complete Architecture Diagram

This diagram shows the complete end-to-end payment processing architecture with all AWS services, data flows, and security controls across multiple regions.

Payment Processing Flow Architecture

Layer 1Edge & Security Layer

Route 53Route 53DNS + Health Checks
→
CloudFrontCloudFrontCDN + SSL/TLS
→
WAFAWS WAFSecurity Filtering

Layer 2API Gateway & Authentication

API GatewayAPI GatewayRequest Routing
→
CognitoCognitoAuthentication
→
LambdaLambdaAuthorizers

Layer 3Application Services (EKS Cluster)

EKSEKSOrchestration
TokenizationTokenizationPAN Protection
Risk EngineRisk EngineFraud Detection
Payment RouterPayment RouterChannel Routing

Layer 4Data & Event Streaming

AuroraAuroraPrimary DB
DynamoDBDynamoDBNoSQL Store
MSKMSKEvent Streaming
ElastiCacheElastiCacheRedis Cache

Layer 5External Integrations

Card NetworksVisa, MasterCard
UPI PSPsPayment Providers
NPCIUPI Network

Data Flow Direction

Customer RequestSecurity LayerAPI GatewayMicroservicesPayment NetworkResponse

Request Flow Process

1

Edge Processing

Route 53 DNS resolution → CloudFront CDN → WAF security filtering → SSL/TLS termination

2

API Gateway

Request validation → JWT/mTLS authentication → Rate limiting → Request transformation

3

Service Orchestration

EKS microservices → Tokenization → Risk analysis → Payment routing

4

Data Processing

Aurora transactions → DynamoDB lookups → Kafka events → Redis caching

Security Architecture

Data Protection

KMS encryption at rest → CloudHSM for PCI DSS → Secrets Manager for credentials

Network Security

VPC isolation → Private subnets → Security groups → NACLs → NAT gateways

Monitoring & Compliance

CloudTrail logging → GuardDuty threat detection → Config compliance → IAM policies

PCI DSS Compliance

Token vault isolation → Audit logging → Network segmentation → Regular assessments

Core Application Stack (Per Region)

API Gateway

API GatewayAmazon API Gateway (regional)
  • JWT token validation (OAuth2 via Cognito/Auth0)
  • mTLS validation for PoS certs
  • Request transformation and routing

Orchestrator

EKSAmazon EKS (multi-AZ)
  • Hosts stateless microservices
  • Uses App Mesh for service discovery
  • Amazon MSK (Kafka) for event choreography

Core Services Architecture

Tokenization Service

EKSStateless pod on Amazon EKS
KMSPAN encrypted with AWS KMS/CloudHSM
DynamoDBToken mappings in DynamoDB Global Table
MSKMSK topics: tokenization.requests/responses

Risk & Fraud Engine

MSKEvent-driven service consuming from Kafka
ElastiCacheRule-based checks using Redis ElastiCache
SageMakerML scoring via Amazon SageMaker endpoint
OpenSearchAnalytics sent to OpenSearch

Payment Processing Services

Payment Type Resolver

DynamoDBMerchant configs in DynamoDB

Stateless service determining channel (UPI/Card)

Emits: payment.route.upi or payment.route.card

Card Router

Receives payment.route.card

Routing table stored in DynamoDB/Redis

Encodes/sends ISO 8583 over HTTPS/TCP

Handles acquirer fallback + retries

UPI Orchestrator

Manages UPI flow: QR/VPA intent creation

PSP API integration

LambdaCallback via API Gateway + Lambda

Publishes: upi.status.updated

Event-Driven Architecture: Choreography Style

Gateway Orchestrator Components

The Gateway Orchestrator is the central brain of the payment gateway — responsible for managing the core payment workflows. In an event-driven, choreography-based architecture, it doesn't command subservices but emits and reacts to events, allowing loosely coupled services to collaborate.

Example Event Flow in Choreography Style

1
payment.initiated(from Edge API layer) → consumed by Orchestrator
2
Orchestrator emits token.requested
3
Tokenization service picks it up, processes, emits token.created
4
Orchestrator receives and emits risk.check.initiated
5
Risk service does its job, emits risk.cleared
6
Orchestrator emits route.to.acquirer→ Router handles it
7
Eventually, payment.authorizedis published

Key Principle:

Orchestrator only reacts to and emits events, it does not call services directly (pure choreography).

Data & State Management

Primary Data Layer

RDSAmazon Aurora PostgreSQL

Multi-AZ, read replicas, point-in-time recovery

DynamoDBDynamoDB Global Tables

Configurations, tokens, session state

ElastiCacheElastiCache Redis

Session cache, rate limiting, routing tables

Event Streaming & Analytics

MSKAmazon MSK (Kafka)

Event choreography, async processing

KinesisKinesis Data Streams

Real-time analytics, fraud detection

OpenSearchOpenSearch

Log aggregation, search, dashboards

Security & Compliance

Data Protection

KMSAWS KMS

Encryption at rest for all data stores

CloudHSMCloudHSM

Hardware security module for PCI DSS

Secrets ManagerSecrets Manager

Credentials rotation, secure access

Network Security

VPCVPC

Private subnets, NAT gateways, security groups

WAFWAF

DDoS protection, OWASP rules, rate limiting

GuardDutyGuardDuty

Threat detection, anomaly monitoring

Compliance

CloudTrailCloudTrail

API logging, audit trails, compliance

ConfigConfig

Configuration compliance, remediation

IAMIAM

Fine-grained access control, roles

Monitoring & Observability

Metrics & Monitoring

CloudWatchCloudWatch

Custom metrics, dashboards, alarms for SLOs

X-RayX-Ray

Distributed tracing, latency analysis

Systems ManagerSystems Manager

Parameter store, patch management

Alerting & Notifications

SNSSNS

Multi-channel notifications (email, SMS, Slack)

SQSSQS

Dead letter queues, retry mechanisms

CloudWatch AlarmsCloudWatch Alarms

Threshold-based alerts, composite alarms

Multi-Region Architecture

Global Deployment Strategy

Primary Region (US-East-1)

AuroraAurora Global Database (Writer)
EKSEKS Cluster (Active)
MSKMSK Cluster (Primary)
DynamoDBDynamoDB Global Tables

Secondary Region (EU-West-1)

AuroraAurora Global Database (Reader)
EKSEKS Cluster (Active)
MSKMSK Cluster (Replica)
DynamoDBDynamoDB Global Tables

DR Region (AP-South-1)

AuroraAurora Cross-Region Backup
EKSEKS Cluster (Warm Standby)
Route 53Route 53 Health Checks
S3S3 Cross-Region Backup

Cross-Region Data Flow

PrimarySecondaryDR

Disaster Recovery Strategy

Automated Failover Process

  • Route 53 health checks detect primary region failure
  • DNS automatically routes traffic to secondary region
  • Aurora Global Database promotes reader to writer
  • EKS pods auto-scale to handle increased load

Recovery Metrics

5min
RTO
1sec
RPO
99.99%
SLA
24/7
Monitoring
Part 1: Functional OverviewView All Case Studies