Skip to main content

Company Network Architecture Diagram

Infrastructure Overview​

Your company operates a fully remote, cloud-native architecture built on AWS with multiple environments and sophisticated security protocols.

Network Architecture Diagram​

graph TB
    %% Remote Team Access
    subgraph "Remote Team Access"
        RT1[Remote Developer 1]
        RT2[Remote Developer 2]
        RTN[Remote Team N...]
    end

    %% Internet Gateway & DNS
    subgraph "DNS & CDN Layer"
        R53[Route 53 DNS]
        CF[CloudFront CDN]
        CERT[AWS Certificate Manager]
    end

    %% Load Balancers & API Gateway
    subgraph "Load Balancing & API Gateway"
        ALB[Application Load Balancer<br/>HTTP/HTTPS]
        APIGW[API Gateway v2<br/>Lambda Proxy]
        NLBINT[Internal Network LB]
    end

    %% Core Infrastructure (Replicated across all environments)
    subgraph "AWS Infrastructure - eu-west-2"
        subgraph "VPC (Multi-AZ)"
            subgraph "Public Subnets (3 AZs)"
                NAT1[NAT Gateway AZ-1]
                NAT2[NAT Gateway AZ-2]
                NAT3[NAT Gateway AZ-3]
            end
            
            subgraph "Private Subnets (3 AZs)"
                subgraph "Application Services"
                    WEBAPP1[Dashboard Service<br/>Merchant Portal]
                    WEBAPP2[Checkout Service<br/>Payment Processing]
                    WEBAPP3[Demo Store Service<br/>Customer Interface]
                    WEBAPP4[SDK Service<br/>JavaScript Distribution]
                    WEBAPP5[Documentation Service<br/>API Docs & Guides]
                    API1[Core API Service<br/>Business Logic]
                    API2[Microservices<br/>Event Processing]
                    AUTH[Authentication Service<br/>Identity & Access]
                end
            end
            
            subgraph "Isolated Subnets (3 AZs)"
                subgraph "Database Tier"
                    DDB[DynamoDB<br/>Multi-Region]
                    POSTGRES[PostgreSQL RDS<br/>Multi-AZ]
                    MONGO[MongoDB Atlas]
                end
                
                subgraph "Message Queue"
                    MSK[Managed Kafka<br/>Multi-AZ]
                    SQS1[Jobs Queue]
                    SQS2[Merchant Webhook Queue]
                    SQS3[Dead Letter Queues]
                end
                
                subgraph "Storage"
                    S3MAIN[S3 Buckets<br/>KMS Encrypted]
                    S3STATIC[Static Assets Bucket]
                    S3SDK[SDK Files Bucket]
                end
            end
        end
    end

    %% External Integrations
    subgraph "External Service Integrations"
        subgraph "Payment Processors"
            STRIPE[Stripe API<br/>TLS 1.3]
            SQUARE[Square API<br/>TLS 1.3]
            SHUTTLE[Shuttle API<br/>TLS 1.3]
            BRIDGERPAY[BridgerPay API<br/>TLS 1.3]
            ASIAPAY[AsiaPay API<br/>TLS 1.3]
            PCIPROXY[PCI Proxy<br/>TLS 1.3]
        end
        
        subgraph "Communication Services"
            TWILIO[Twilio SMS/Voice<br/>TLS 1.3]
            SLACK[Slack Webhooks<br/>TLS 1.3]
            EMAIL[AWS SES<br/>DMARC/SPF/DKIM]
        end
        
        subgraph "Analytics & Monitoring"
            POSTHOG[PostHog Analytics<br/>TLS 1.3]
            HUBSPOT[HubSpot CRM<br/>TLS 1.3]
            MAILCHIMP[Mailchimp Marketing<br/>TLS 1.3]
        end
        
        subgraph "Authentication Providers"
            GOOGLE[Google OAuth<br/>TLS 1.3 + PKCE]
            MICROSOFT[Microsoft Azure AD<br/>TLS 1.3 + PKCE]
        end
        
        subgraph "Development Tools"
            README[ReadMe API Docs<br/>TLS 1.3]
            OPENEXCHANGE[Open Exchange Rates<br/>TLS 1.3]
        end
    end

    %% Security Components
    subgraph "Security & Compliance"
        subgraph "AWS Security Services"
            KMS[AWS KMS<br/>AES-256]
            SECRETS[AWS Secrets Manager<br/>Encrypted]
            IAM[AWS IAM Roles & Policies]
            SG[Security Groups<br/>Firewall Rules]
        end
        
        subgraph "Monitoring & Compliance"
            CW[CloudWatch Logs & Metrics]
            CT[CloudTrail Audit Logs]
            CONFIG[AWS Config Compliance]
            GUARD[GuardDuty Threat Detection]
        end
    end

    %% Mobile & Desktop Clients
    subgraph "Client Applications"
        MOBILE[Mobile App<br/>React Native]
        DESKTOP[Desktop App<br/>Electron]
        BROWSER[Web Browsers<br/>Modern Browsers]
    end

    %% Connections with Security Protocols
    RT1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Certificate Pinning| CF
    RT2 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Certificate Pinning| CF
    RTN --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Certificate Pinning| CF
    
    CF --> |DNS over HTTPS DoH<br/>DNSSEC| R53
    CF --> |HTTP/2<br/>TLS 1.3<br/>HSTS Header| ALB
    
    ALB --> |HTTP/1.1<br/>Internal TLS 1.2<br/>AES-256-CBC| WEBAPP1
    ALB --> |HTTP/1.1<br/>Internal TLS 1.2<br/>AES-256-CBC| WEBAPP2
    ALB --> |HTTP/1.1<br/>Internal TLS 1.2<br/>AES-256-CBC| WEBAPP3
    
    APIGW --> |AWS SigV4<br/>Internal TLS 1.2<br/>AES-256-GCM| API1
    APIGW --> |AWS SigV4<br/>Internal TLS 1.2<br/>AES-256-GCM| AUTH
    
    API1 --> |DynamoDB Protocol<br/>AES-256 KMS Encryption<br/>IAM SigV4| DDB
    API1 --> |PostgreSQL Protocol<br/>SSL/TLS 1.2<br/>AES-256 RDS Encryption| POSTGRES
    API1 --> |Kafka Protocol<br/>SASL/SCRAM-SHA-512<br/>TLS 1.2| MSK
    API2 --> |Kafka Protocol<br/>SASL/SCRAM-SHA-512<br/>TLS 1.2| MSK
    API2 --> |DynamoDB Protocol<br/>AES-256 KMS Encryption<br/>IAM SigV4| DDB
    
    AUTH --> |DynamoDB Protocol<br/>AES-256 KMS Encryption<br/>IAM SigV4| DDB
    AUTH --> |SQS Protocol<br/>AES-256 KMS Encryption<br/>IAM SigV4| SQS1
    AUTH --> |AWS Secrets Manager API<br/>AES-256 KMS Encryption<br/>IAM SigV4| SECRETS
    
    %% External Service Connections with Full Security Stack
    API1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Webhook Signature HMAC-SHA256| STRIPE
    API1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>OAuth 2.0 Bearer Token| SQUARE
    API1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>API Key + Signature| SHUTTLE
    API1 --> |HTTPS/TLS 1.3<br/>ChaCha20-Poly1305<br/>API Key Authentication| TWILIO
    
    WEBAPP1 --> |HTTPS/TLS 1.3<br/>OAuth 2.0 + PKCE<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>JWT RS256 Tokens| GOOGLE
    WEBAPP1 --> |HTTPS/TLS 1.3<br/>OAuth 2.0 + PKCE<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>JWT RS256 Tokens| MICROSOFT
    
    API1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Webhook HMAC-SHA256| BRIDGERPAY
    API1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Digital Signature Verification| ASIAPAY
    API1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Basic Auth + TLS Client Cert| PCIPROXY
    
    API1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Bearer Token Auth| POSTHOG
    API1 --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Private App Token| HUBSPOT
    
    %% Client Application Connections
    MOBILE --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Certificate Pinning<br/>App Attestation| CF
    DESKTOP --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>Certificate Pinning<br/>Code Signing Verification| CF
    BROWSER --> |HTTPS/TLS 1.3<br/>ECDHE-RSA-AES256-GCM-SHA384<br/>HSTS + CSP Headers| CF
    
    %% Internal Security Service Connections
    ALB --> |AWS Security Groups<br/>Stateful Firewall Rules<br/>Port-based Filtering| SG
    API1 --> |AWS IAM<br/>AssumeRole STS<br/>Temporary Credentials| IAM
    AUTH --> |AWS IAM<br/>AssumeRole STS<br/>Temporary Credentials| IAM
    S3MAIN --> |AWS KMS<br/>AES-256 Envelope Encryption<br/>CMK Rotation| KMS
    DDB --> |AWS KMS<br/>AES-256 Envelope Encryption<br/>CMK Rotation| KMS
    
    %% Email Security
    API1 --> |SMTP/TLS 1.2<br/>DKIM RSA-2048<br/>SPF Record Validation<br/>DMARC p=reject| EMAIL

Security Protocols & Encryption​

Transport Layer Security​

  • TLS 1.3 for all external API communications with forward secrecy
  • Cipher Suites: ECDHE-RSA-AES256-GCM-SHA384, ChaCha20-Poly1305
  • HTTPS enforced across all web applications with HSTS headers
  • Certificate Management via AWS Certificate Manager with auto-renewal
  • Certificate Pinning for mobile and desktop applications

Data Encryption​

  • At Rest: AES-256 envelope encryption using AWS KMS with customer-managed keys
  • In Transit: TLS 1.3 for external, TLS 1.2+ for internal AWS services
  • Database Encryption:
    • DynamoDB with KMS encryption and key rotation
    • PostgreSQL RDS with AES-256 encryption
    • Kafka with SASL/SCRAM-SHA-512 authentication

Authentication & Authorization​

  • OAuth 2.0 with PKCE for external identity providers (Google, Microsoft)
  • JWT Tokens with RS256 signing (RSA-2048 keys) for API authentication
  • AWS IAM Roles with least-privilege access and temporary credentials
  • Multi-Factor Authentication enforced for AWS console access
  • API Authentication: Bearer tokens, HMAC-SHA256 signatures, digital signatures

Network Security​

  • VPC Security Groups acting as stateful firewalls with port-based filtering
  • NACLs for subnet-level network filtering
  • Private Subnets for all application and database tiers
  • NAT Gateways for secure outbound internet access
  • AWS WAF for application-layer protection

Message Security​

  • Webhook Security: HMAC-SHA256 signature verification
  • Email Security: DKIM RSA-2048, SPF records, DMARC p=reject
  • Queue Encryption: SQS messages encrypted with KMS
  • Event Streaming: Kafka with TLS 1.2 and SASL authentication

Application Architecture​

Frontend Applications​

  • Dashboard: Next.js application for merchant management
  • Checkout: Payment processing interface
  • Demo Store: Customer-facing demo application
  • Mobile App: React Native cross-platform application
  • Desktop App: Electron-based desktop client

Backend Services​

  • API Gateway: Serverless API routing and authentication
  • Core API Service: Business logic and data processing
  • Authentication Service: Identity management and access control
  • Microservices: Event processing and specialized functions
  • Blue/Green Deployments: Zero-downtime deployments with automated rollback

Data Layer​

  • DynamoDB: NoSQL database for user sessions, auth, and payments
  • PostgreSQL RDS: Relational data with Multi-AZ deployment
  • MongoDB: Document store for specific use cases
  • Apache Kafka (MSK): Event streaming and message processing

Integration Layer​

  • Payment Processors: Stripe, Square, Shuttle, BridgerPay, AsiaPay
  • Communication: Twilio (SMS/Voice), AWS SES (Email), Slack
  • Analytics: PostHog, HubSpot
  • Authentication: Google OAuth, Microsoft Azure AD

Deployment Environments​

This entire architecture is replicated across multiple isolated environments:

Production​

  • Region: eu-west-2 (London)
  • Multi-AZ: 3 Availability Zones
  • NAT Strategy: One per AZ for high availability
  • Retention: Resources retained on stack deletion
  • Domain: *.handsin.com

Staging​

  • Region: eu-west-2 (London)
  • Multi-AZ: 3 Availability Zones
  • Purpose: Pre-production testing and validation
  • Domain: *.staging.handsin.com

Development​

  • Region: eu-west-2 (London)
  • Single NAT: Cost-optimized configuration
  • Purpose: Development and integration testing
  • Domain: *.development.handsin.com

Sandbox​

  • Region: eu-west-2 (London)
  • Purpose: Sandbox testing environment
  • Domain: *.sandbox.handsin.com

Local Development​

  • Docker Compose: Local service orchestration
  • Port Mapping: Standardized ports across services
  • Hot Reload: Development productivity features
  • Domain: localhost with different ports

Monitoring & Observability​

Application Monitoring​

  • CloudWatch: Metrics, logs, and alarms
  • PostHog: User analytics and feature flags

Infrastructure Monitoring​

  • CloudWatch: Infrastructure metrics and logs
  • AWS Config: Compliance and configuration monitoring
  • GuardDuty: Threat detection and security monitoring

Deployment Monitoring​

  • CodeDeploy: Blue/green deployment monitoring
  • CloudWatch Alarms: Automated rollback triggers
  • SNS Notifications: Deployment status alerts

Remote Team Considerations​

Access Patterns​

  • Zero-Trust Architecture: All access through authenticated endpoints
  • VPN-Free: Direct internet access through CloudFront and ALB
  • Multi-Region: Disaster recovery and performance optimization

Development Workflow​

  • GitOps: Infrastructure as Code with SST
  • CI/CD: Automated testing and deployment pipelines
  • Environment Parity: Consistent environments across stages

Security for Remote Work​

  • IAM Roles: Granular permissions per team member
  • MFA Required: Multi-factor authentication enforced
  • Audit Logging: All access logged via CloudTrail
  • Secret Management: Centralized secrets via AWS Secrets Manager

This architecture provides a robust, secure, and scalable foundation for your fully remote team while maintaining high availability, security, and compliance standards.