Open Banking on AWS: Networking and security
Publication date: September 7, 2021 (Diagram history)
With this architecture, you can connect on-premises core banking systems to AWS and expose Open Banking APIs securely. The solution uses AWS Direct Connect for connectivity, AWS Transit Gateway for network hub management, and Amazon API Gateway for API management with AWS WAF integration.
Open Banking networking and security diagram
The following steps describe the networking and security components for this architecture:
-
Send and receive all new and updated transactions between core banking systems and AWS by using streaming technologies such as Apache Kafka and message queue (MQ) mechanisms.
-
Connect the bank data center to AWS by using a combination of AWS Direct Connect and AWS Site-to-Site VPN. Use two diverse AWS Direct Connect connections for maximum resiliency.
-
Use AWS Transit Gateway as the central hub on AWS to manage interconnectivity between workloads running in different AWS accounts. Share the AWS Direct Connect and VPN connection with other workloads in the bank.
-
Provide secure outbound access from an outbound Amazon VPC through a proxy.
-
Authenticate accredited third parties and provide access tokens through mutual TLS (mTLS) for transport layer security.
-
Expose Open Banking APIs and Authorization APIs through Amazon API Gateway. Integrate AWS WAF with Amazon API Gateway for web protection.
-
Store public certificates of clients in Amazon Simple Storage Service as a trust store for validating requests. Validate the authenticity of third parties against a Trust Service Provider (TSP).
-
Connect Amazon API Gateway to the private subnets hosting microservices in other AWS accounts through a private integration Amazon VPC and AWS PrivateLink.
-
Provide traffic management and domain name resolution by using Amazon Route 53. Deliver static data through Amazon CloudFront with AWS Shield protection.
Further reading
For additional information, see the following resources:
Diagram history
To receive updates about this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Reference architecture diagram first published. | September 7, 2021 | |
Initial publication | Reference architecture diagram first published. | September 7, 2021 |
Reference architecture diagram first published. | September 7, 2021 |
RSS subscription requirement
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
