Bank on AWS

We use AWS as an example of Cloud here but it could very easily be Azure, Gcloud, Oracle etc

Actors

• Equinix Fabric (Fintech-operated): a Fintech provisioned private L3 “meet-me” fabric. It provides virtual routing (VRFs) and private circuits between banks (on prem or cloud). No Internet. Fintech defines BGP policies (who can talk to whom)
• Bank on AWS : Bank account in a region, bank’s VPC, Bank on EKS, EKS hosting Quorum/Tessera nodes
• Connection path - Equinix ⇒ AWS Direct Connect(DX) ⇒ DX Gateway ⇒ AWS Transit Gateway ⇒ AWS VPCs

Process:

• Fintech (Equinix Fabric): creates VRF bank-mesh, sets up policies, and provisions a DX Private VIF toward the bank’s AWS account. VRF is a logically isolated L3 domain.
• Each bank performs Network Address Translation (NAT) at its edge gateway (firewall or router) before advertising routes into the shared VRF.
• Bank (AWS Edge): orders Direct Connect (DX) at the nearest DX location; associates Private VIF → DXGW.
• Bank (AWS Region): creates TGW, associates DXGW ↔ TGW, and attaches VPCs (EKS).
• Bank (EKS VPC): deploys Quorum/Tessera on EKS, exposes internal NLBs (if needed), applies Security Groups to allow only partner CIDRs and only required ports.
• Cross-connect: Provider wires DX port ↔ Fabric port; BGP comes up; prefixes are exchanged.
• Outcome: Private, no-Internet L3 path is live; Quorum/Tessera can form p2p with other banks across the fabric using private IPs.

Let’s go deeper and understand what each of these components do: