Five Years Building a Fintech Platform on AWS with Infrastructure as Code

The problem

When Nuno started in May 2021 there had been no DevOps engineer before, and many AWS resources existed only in the console. Nobody could rebuild an environment from code, and every new region or environment meant repeating manual work. The team was growing fast, the product was expanding to more regions, and partners wanted proof that changes were controlled, backups were tested and access was limited. That proof is hard to give when the source of truth is a set of console screens.

What Nuno did

In May 2022 Nuno proposed an infrastructure-as-code standard to the company's architecture forum: immutable infrastructure, separate AWS accounts and environments, Terraform with Terragrunt, and every change through a merge request. The named risk was importing the legacy resources without breaking them, so they were brought into code before anything new was built on top. A month later the repository held 116 Terragrunt units across four AWS regions and four environments (development, staging, production and sandbox), with CI templates per region. The modules covered networking, databases, container services and registries, identity, customer encryption keys, queues and messaging, DynamoDB, AWS Config rules, API Gateway with Lambda, and data ingestion. Nuno also moved AWS access to single sign-on. Production ran behind a CDN and a web application firewall, with services in private subnets, an internal load balancer for service-to-service calls, outbound traffic only through NAT, and a Multi-AZ PostgreSQL database that only a few services could reach. From 2023 Nuno added Kubernetes next to ECS and moved CI runners onto the cluster, and by 2025 the platform ran on EKS with Karpenter node pools on Amazon Linux 2023, including a dedicated pool for CI runners.

Compliance and recovery

Nuno led the company's first SOC 2 and the renewals after it, 3 to 4 years in a row, and produced the infrastructure controls and their evidence: backup policy, database retention, network tiers, access, change management and secrets handling. Backups were driven by tags, so a resource got the right retention by declaring which plan it belonged to. Kubernetes secrets were first encrypted with SOPS and AWS KMS, and later moved to Sealed Secrets. Production deploys were limited to protected CI environments, and capacity changes went through infrastructure-as-code merge requests. Nuno rewrote the disaster recovery procedure around Terraform and tested redeploying the Kubernetes tooling and infrastructure from code.

Cost grew with the business

The AWS bill grew from a few thousand dollars a month in 2021 to over $60,000 a month as the business grew. A cost program led by Nuno brought it down to about $46,000 a month in 2023. After that the bill stayed near $60,000 a month while transaction volume kept growing. A later review of six months of the bill, in early 2025, still showed costs nobody had chosen on purpose: CloudWatch log ingestion that grew about four times in two months, older gp2 volumes that cost more each month than the gp3 volumes next to them, AWS Config recording in staging that rose about nineteen times, and an always-on SFTP endpoint at more than a thousand dollars a month. Infrastructure as code makes resources visible and repeatable, but it does not tell you what they cost. That needs its own regular review.

Cost per transaction

A total bill only tells leadership that spend went up. Nuno built a Grafana billing dashboard on CloudWatch billing data that divided month-to-date AWS spend by the number of transactions, so the VPs could see where they stood in one number. In October 2025 it showed about 1.03 million transactions for the month so far and about 5 cents of AWS spend per transaction.

Solutions