Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building a Cloud Native Bank

mattheath
October 03, 2018

Building a Cloud Native Bank

A brief look at how Monzo, a UK based digital bank, have leveraged the features of Amazon's public cloud to build a secure, cloud native, banking platform — using modern open source technologies and common software development practices.

Presented at the AWS User Group UK meetup

mattheath

October 03, 2018
Tweet

More Decks by mattheath

Other Decks in Programming

Transcript

  1. #

  2. &

  3. '

  4. LICENCE WITH RESTRICTIONS WE ARE HERE A UK banking licence

    is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS 50K MAX DEPOSIT WE ARE HERE A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC E APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS WE ARE HERE AUG
 2017 JAN
 2016 Feb
 2015 APR
 2017 A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LICENCE WITH RESTRICTIONS WE ARE HERE
  5. ?

  6. ,

  7. -

  8. .

  9. ?

  10. LICENCE WITH RESTRICTIONS WE ARE HERE A UK banking licence

    is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS 50K MAX DEPOSIT WE ARE HERE A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC E APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS WE ARE HERE AUG
 2017 JAN
 2016 Feb
 2015 APR
 2017 A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LICENCE WITH RESTRICTIONS WE ARE HERE
  11. A UK banking licence is authorised by the PRA and

    regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS 50K MAX DEPOSIT WE ARE HERE A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC E APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS WE ARE HERE AUG
 2017 JAN
 2016 Feb
 2015 APR
 2017 PREPAID
 CARD
 LAUNCH LICENCE WITH RESTRICTIONS WE ARE HERE A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LICENCE WITH RESTRICTIONS WE ARE HERE
  12. ?

  13. etcd etcd etcd etcd etcd etcd etcd etcd etcd quorum

    = 5 or more nodes alive (n/2+1)
  14. etcd etcd etcd etcd etcd etcd etcd etcd etcd new

    machines automatically reattach EBS, cluster recovers 1
  15. etcd ASG 4 etcd ASG 7 etcd ASG 1 etcd

    ASG 5 etcd ASG 8 etcd ASG 2 etcd ASG 3 etcd ASG 6 etcd ASG 0 each etcd node is an autoscaling group of 1, with a fixed identity
  16. etcd etcd etcd etcd etcd ASG 7 etcd ASG 1

    etcd ASG 8 etcd ASG 2 etcd ASG 6 autoscaling groups start new instances
  17. etcd etcd etcd etcd etcd etcd etcd etcd etcd unhealthy

    machines replaced automatically, EBS reattached, cluster recovers 3
  18. 4

  19. 1

  20. API

  21. API

  22. API Gateway API Service API Service API Service API Service

    API Service API Service API Service API Service
  23. Service Discovery Load Balancing Timeouts and Expirations Retries Rate Limiting

    Connection Pooling Circuit Breaking Failure Detection Metrics and Tracing Interrupts Context Propagation
  24. Service Discovery Load Balancing Timeouts and Expirations Retries Rate Limiting

    Connection Pooling Circuit Breaking Failure Detection Metrics and Tracing Interrupts Context Propagation
  25. kind: DaemonSet metadata: name: linkerd spec: template: spec: containers: -

    name: linkerd image: ecr:linkerd_vXXX - "/etc/linkerd/linkerd.yaml" volumeMounts: - name: linkerd-config mountPath: /etc/linkerd readOnly: true ports: - name: http containerPort: 443 hostPort: 4140 env: - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP resources: limits: cpu: 4 memory: 2Gi monzo.com/cpu-period: 2500 requests: cpu: 1 memory: 1Gi services send requests to local
 linkerd daemonset linkerd daemonset pods & services
 on other machines
  26. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E 6 7 7 7 7
  27. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E 6 7 7 7 7 Service D
  28. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E 6 Service D
  29. 8

  30. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API
  31. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API
  32. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API
  33. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API Reject traffic at ALB Update rules
 via API
  34. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API Reject traffic at ALB Update rules
 via API
  35. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service 8 service VPC Segregation
 Network ACLs Sec Groups
  36. :