Save 37% off PRO during our Black Friday Sale! »

Building a Cloud Native Bank

67f4a8f2a209a38d7242829947b26ba3?s=47 mattheath
October 03, 2018

Building a Cloud Native Bank

A brief look at how Monzo, a UK based digital bank, have leveraged the features of Amazon's public cloud to build a secure, cloud native, banking platform — using modern open source technologies and common software development practices.

Presented at the AWS User Group UK meetup

67f4a8f2a209a38d7242829947b26ba3?s=128

mattheath

October 03, 2018
Tweet

Transcript

  1. Building a Cloud-Native Bank Matt Heath, Monzo

  2. ! ⛅ #

  3. Hi, I’m Matt

  4. @mattheath

  5. None
  6. None
  7. Nov 2015 Oct 2018 CUSTOMER
 GROWTH

  8. $ 1,031,133

  9. £4 billion spent %

  10. None
  11. None
  12. None
  13. None
  14. None
  15. None
  16. None
  17. None
  18. #

  19. &

  20. None
  21. '

  22. LICENCE WITH RESTRICTIONS WE ARE HERE A UK banking licence

    is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS 50K MAX DEPOSIT WE ARE HERE A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC E APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS WE ARE HERE AUG
 2017 JAN
 2016 Feb
 2015 APR
 2017 A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LICENCE WITH RESTRICTIONS WE ARE HERE
  23. Henrik Kniberg

  24. None
  25. ?

  26. Henrik Kniberg

  27. James Leah Matt

  28. James Leah Matt *

  29. James Leah Matt +

  30. ,

  31. None
  32. None
  33. - - -

  34. - - - X X X

  35. -

  36. % - %

  37. .

  38. - ☕☕

  39. ☕☕ - %

  40. EXTENSIBLE SCALABLE RELIABLE SECURE
 CHEAP

  41. ?

  42. Application

  43. Application

  44. APPLICATION Application

  45. None
  46. None
  47. None
  48. LICENCE WITH RESTRICTIONS WE ARE HERE A UK banking licence

    is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS 50K MAX DEPOSIT WE ARE HERE A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC E APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS WE ARE HERE AUG
 2017 JAN
 2016 Feb
 2015 APR
 2017 A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LICENCE WITH RESTRICTIONS WE ARE HERE
  49. A UK banking licence is authorised by the PRA and

    regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS 50K MAX DEPOSIT WE ARE HERE A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY JUN JUL MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC E APPLICATION APPLICATION MOBILISATION LAUNCH LICENCE WITH RESTRICTIONS WE ARE HERE AUG
 2017 JAN
 2016 Feb
 2015 APR
 2017 PREPAID
 CARD
 LAUNCH LICENCE WITH RESTRICTIONS WE ARE HERE A UK banking licence is authorised by the PRA and regulated by the PRA and FCA1, allowing deposit- taking and balance sheet lending. Once granted, it allows firms to passport across Europe, accessing This is followed by a “mobilisation” phase during which final capital is raised and IT systems are completed, before launching to the public. We received a UK banking licence in August 2016! FEB 2015 JAN 2016 JAN 2017 MAR FEB FEB APR MAR MAR APR MAY APR JUN MAY JUL JUN AUG JUL SEP AUG NOV SEP DEC NOV DEC PRE APPLICATION APPLICATION MOBILISATION LICENCE WITH RESTRICTIONS WE ARE HERE
  50. None
  51. None
  52. None
  53. None
  54. ?

  55. EC2
 Instance

  56. instance instance

  57. instance instance instance instance instance instance

  58. instance instance instance instance instance instance { { { eu-west-1a

    eu-west-1b eu-west-1c
  59. instance instance instance instance instance instance Kubernetes

  60. instance instance instance instance instance kubelet

  61. kubelet kubelet kubelet kubelet kubelet kubelet

  62. kubelet kubelet kubelet kubelet kubelet kubelet Kubernetes Master

  63. kubelet kubelet kubelet kubelet kubelet kubelet Kubernetes Master etcd

  64. kubelet kubelet kubelet kubelet kubelet kubelet Kubernetes Master etcd

  65. etcd

  66. etcd etcd etcd

  67. etcd etcd etcd etcd etcd etcd etcd etcd etcd

  68. etcd etcd etcd etcd etcd etcd etcd etcd etcd quorum

    = 5 or more nodes alive (n/2+1)
  69. etcd etcd etcd etcd etcd etcd etcd etcd etcd quorum

    maintained
  70. etcd etcd etcd etcd etcd etcd etcd etcd etcd quorum

    maintained '
  71. etcd etcd etcd etcd etcd unhealthy machines terminated 0

  72. etcd etcd etcd etcd etcd etcd etcd etcd etcd new

    machines automatically reattach EBS, cluster recovers 1
  73. etcd ASG 4 etcd ASG 7 etcd ASG 1 etcd

    ASG 5 etcd ASG 8 etcd ASG 2 etcd ASG 3 etcd ASG 6 etcd ASG 0 each etcd node is an autoscaling group of 1, with a fixed identity
  74. etcd etcd etcd etcd etcd etcd etcd etcd etcd quorum

    lost 2
  75. etcd etcd etcd etcd unhealthy machines terminated 0

  76. etcd etcd etcd etcd etcd ASG 7 etcd ASG 1

    etcd ASG 8 etcd ASG 2 etcd ASG 6 autoscaling groups start new instances
  77. etcd etcd etcd etcd etcd etcd etcd etcd etcd unhealthy

    machines replaced automatically, EBS reattached, cluster recovers 3
  78. Blog

  79. kubernetes

  80. kubernetes pod pod pod pod pod pod pod pod pod

    pod
  81. pod container service

  82. pod scratch container go service

  83. kubernetes service service service service service service service service service

    service
  84. kubernetes service service service service service service service service service

    service
  85. kubernetes service service service service service service service service service

    service
  86. kubernetes service service service service service service service service service

    service
  87. kubernetes service service service service service service service service service

    service service service service
  88. kubernetes service service service service service service service service service

    service
  89. kubernetes service Prometheus service service Kafka linkerd Kafka service service

    Elasticsearch calico API service
  90. 4

  91. 1

  92. Request Limit

  93. CPU Throttling

  94. None
  95. API

  96. API

  97. API Gateway API Service API Service API Service API Service

    API Service API Service API Service API Service
  98. None
  99. None
  100. None
  101. API Gateway Accounts Cards Pots Feed Payments …

  102. API Gateway Accounts Cards Pots Feed Payments … New
 Exciting


    API!! 5
  103. Cards Pots Payments … API Gateway Accounts New
 Exciting
 API!!

    0 0 0 0 0 Feed
  104. Cards Pots Payments … API Gateway Accounts New
 Exciting
 API!!

    0 0 0 0 0 6 Feed
  105. API Gateway Accounts Cards Pots Payments … New
 Exciting
 API!!

    5 6 Feed
  106. Service Service

  107. Service Service Service Service

  108. Service Service Service Service Kubernetes
 Service

  109. Service Discovery Load Balancing Timeouts and Expirations Retries Rate Limiting

    Connection Pooling Circuit Breaking Failure Detection Metrics and Tracing Interrupts Context Propagation
  110. Service Discovery Load Balancing Timeouts and Expirations Retries Rate Limiting

    Connection Pooling Circuit Breaking Failure Detection Metrics and Tracing Interrupts Context Propagation
  111. Service Service Service Service ?

  112. Service Service Service Service linkerd

  113. Service linkerd

  114. Service linkerd service
 discovery

  115. Service Service Service Service linkerd service
 discovery

  116. Service Service Service Service linkerd

  117. Service Service Service Service linkerd

  118. Service Service Service Service linkerd

  119. Service Service Service Service linkerd

  120. kind: DaemonSet metadata: name: linkerd spec: template: spec: containers: -

    name: linkerd image: ecr:linkerd_vXXX - "/etc/linkerd/linkerd.yaml" volumeMounts: - name: linkerd-config mountPath: /etc/linkerd readOnly: true ports: - name: http containerPort: 443 hostPort: 4140 env: - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP resources: limits: cpu: 4 memory: 2Gi monzo.com/cpu-period: 2500 requests: cpu: 1 memory: 1Gi services send requests to local
 linkerd daemonset linkerd daemonset pods & services
 on other machines
  121. None
  122. None
  123. None
  124. Event Driven
 Architecture

  125. Service A Service B Load Balancer Edge Gateway API Service

  126. API Service Service A Service B Load Balancer Edge Gateway

  127. API Service Service A Service B Load Balancer Edge Gateway

    Service D Service E
  128. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E
  129. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E 6
  130. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E 6 7
  131. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E 6 7 7 7 7
  132. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E 6 7 7 7 7 Service D
  133. API Service Service A Service B Load Balancer Edge Gateway

    Service C Service D Service E 6 Service D
  134. 8

  135. API Service API Service Load Balancer Monzo API Gateway API

    Service
  136. API Service API Service Load Balancer Monzo API Gateway API

    Service
  137. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service
  138. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF
  139. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API
  140. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API
  141. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API
  142. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API Reject traffic at ALB Update rules
 via API
  143. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF AWS API Reject traffic at ALB Update rules
 via API
  144. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service AWS Shield AWS WAF 8
  145. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service 8
  146. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service 8 service
  147. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service 8 service &
  148. None
  149. None
  150. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service 8 service VPC Segregation
 Network ACLs Sec Groups
  151. API Service API Service Application Load Balancer (ALB) Monzo API

    Gateway API Service 8 service 8
  152. instance instance instance instance instance instance instance instance instance 9

  153. instance instance instance instance instance instance instance instance instance 9

    IAM Auditing CloudTrail 8
  154. None
  155. :

  156. None
  157. Ship it and iterate
 Make changes small
 Make changes often

    Technical debt as a tool
  158. API Gateway Accounts Cards Pots Feed Payments … New
 Exciting


    API!! 5
  159. None
  160. Production load tests & Shadow Traffic

  161. EXTENSIBLE SCALABLE RELIABLE SECURE
 CHEAP

  162. Empower teams

  163. monzo.com/careers