Customer Name:
QRPE Private Limited.
Case Study Title:
QRPEPG Modernizes Payment Gateway Platform with Amazon EKS and DevOps Automation.
Short Description:
QRPEPG partnered with Tekrosta Cloud to modernize its payment gateway using Amazon EKS and automated DevOps CI/CD with AWS CodePipeline and CodeBuild, enabling containerized application delivery, streamlined deployments, scalability, and production-ready operations across its AWS environment.
Problem Statement:
QRPEPG operates a fintech payment gateway platform comprising five customer-facing web applications and four backend microservices that process financial transactions for merchants, partners, and end-users. The existing Stage 1 environment was deployed on Amazon EC2 with Single-AZ RDS MySQL as a temporary, cost-optimized setup for application validation and audit purposes.
The environment had the following limitations:
- Limited high availability and single points of failure across application and database layers.
- No auto-scaling capability to handle transaction volume spikes.
- No container orchestration or self-healing capabilities for microservices.
- Manual deployments without automated CI/CD, resulting in slower and error-prone releases.
- Limited Layer 7 security without WAF and centralized threat detection.
- No automated database failover beyond the Single-AZ RDS deployment.
- Limited centralized monitoring, logging, alerting, and auditability.
- Need for a production-ready architecture supporting scalability, security, availability, and operational requirements.
Proposed Solution & Architecture:
Tekrosta designed a highly available, scalable, and secure three-tier AWS architecture for the QRPEPG payment gateway platform.
The solution included:
- Deployment of separate Amazon EKS clusters for Development/UAT and Production environments.
- Amazon EKS managed node groups with autoscaling, namespace segregation, IRSA, Amazon ECR integration, and cluster monitoring.
- Deployment of four containerized microservices: Users, Payments, Notifications, and Authentication.
- Amazon RDS MySQL in private database subnets with multi-AZ high availability.
- Hosting of five ReactJS web applications on Amazon S3 with Amazon CloudFront.
- Application Load Balancer integrated with Kubernetes Ingress for secure API access and traffic distribution.
- AWS WAF for Layer 7 protection including SQL injection, XSS, IP reputation filtering, rate limiting, and geographic restrictions where required.
- AWS Certificate Manager for HTTPS termination and certificate management.
- Implementation of automated CI/CD using AWS CodePipeline and AWS CodeBuild for both frontend and backend applications.
- Automated backend delivery including Docker image builds, Amazon ECR publishing, and Kubernetes manifest deployment to Amazon EKS.
- Automated frontend delivery including ReactJS builds and deployment of application artifacts to Amazon S3.
- Environment-specific CI/CD stages across Development, UAT, and Production with approval gates for Production deployments.
- AWS CloudWatch for metrics, logs, dashboards, monitoring, and alerting.
- AWS CloudTrail, AWS Config, and Amazon GuardDuty for auditing, governance, compliance monitoring, and threat detection.
- Two isolated VPCs for Shared Development/UAT and Dedicated Production environments.
- Three-tier network architecture comprising Public, Private Application, and Private Database subnets.
- Internet Gateway and NAT Gateway for controlled connectivity.
- Wazuh SIEM hosted on an EC2 instance in a private application subnet.
- Squid Proxy with Network Load Balancer for controlled outbound URL/domain filtering and Internet access control.
- AWS Private Link/ECR private endpoints for controlled private connectivity.
Outcomes of Project & Success Metrics
- Target platform availability of 99.95%+ through a Multi-AZ architecture using Amazon EKS, RDS MySQL, and Application Load Balancer.
- Self-healing application infrastructure through Kubernetes auto-restart and node replacement.
- Capability to handle up to 10x traffic spikes during promotional or seasonal payment surges.
- Real-time threat detection and mitigation through AWS WAF, Amazon GuardDuty, and Security Hub.
- Complete audit trail through AWS CloudTrail and AWS Config.
- Expected ~40–60% frontend hosting cost savings through Amazon S3 and Amazon CloudFront compared with traditional server-based hosting.
- Faster application releases through automated CI/CD pipelines.
- Independent deployment of microservices, allowing individual services such as Payments API to be updated independently.
- All five frontend portals accessible through HTTPS with valid SSL certificates.
- All four backend APIs validated through the Application Load Balancer.
- RDS MySQL connectivity validated from EKS workloads.
- End-to-end CI/CD pipeline validation from commit through production deployment.
- WAF validation against SQL injection and XSS test vectors.
- Real-time CloudWatch dashboards for EKS, RDS MySQL, and ALB.
- Validation of GuardDuty, Security Hub, CloudTrail, and AWS Config in Production.
Lessons Learned
- Production payment platforms require high availability and automated failover to eliminate single points of failure.
- Amazon EKS provides a scalable and self-healing platform for containerized, independently managed microservices.
- CI/CD automation should be embedded into the application delivery lifecycle to enable repeatable, consistent, and low-touch deployments.
- Security and governance services such as AWS WAF, CloudTrail, AWS Config, GuardDuty, and centralized monitoring should be integrated into the production architecture.
- Separating Development/UAT and Production environments through isolated VPCs and dedicated EKS clusters improves environment isolation and operational control.
- Centralized monitoring, logging, and auditability are essential for maintaining visibility into application health, security posture, and compliance requirements.