Cloud Computing Applications in Banking Real-World Examples

# Target tracking: keep average CPU around 60%
aws autoscaling put-scaling-policy \
  --auto-scaling-group-name netbanking-api-asg \
  --policy-name cpu-60-target \
  --policy-type TargetTrackingScaling \
  --target-tracking-configuration '{
    "PredefinedMetricSpecification": {
      "PredefinedMetricType": "ASGAverageCPUUtilization"
    },
    "TargetValue": 60.0
  }'

import boto3, json

def get_db_credentials(secret_id: str) -> dict:
    client = boto3.client("secretsmanager", region_name="ap-south-1")
    value = client.get_secret_value(SecretId=secret_id)
    return json.loads(value["SecretString"])

creds = get_db_credentials("prod/netbanking/db")
# use creds["username"], creds["password"] — never print them

CREATE EXTERNAL TABLE IF NOT EXISTS curated.transactions (
    txn_id      string,
    account_id  string,
    amount      decimal(14,2),
    channel     string
)
PARTITIONED BY (txn_date string)
STORED AS PARQUET
LOCATION 's3://example-bank-curated/transactions/';

MSCK REPAIR TABLE curated.transactions;

-- Daily digital transaction value by channel (one month)
SELECT txn_date,
       channel,
       COUNT(*)    AS txns,
       SUM(amount) AS total_value
FROM curated.transactions
WHERE txn_date BETWEEN '2026-10-01' AND '2026-10-31'
GROUP BY txn_date, channel
ORDER BY txn_date, channel;

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadCuratedTransactionsOnly",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::example-bank-curated",
        "arn:aws:s3:::example-bank-curated/transactions/*"
      ]
    }
  ]
}

aws s3api put-bucket-encryption \
  --bucket example-bank-curated \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "alias/bank-data-key"
      },
      "BucketKeyEnabled": true
    }]
  }'

Workload: ______________________
Data classification: Public / Internal / Confidential
Region(s) and data residency confirmed: Y / N
Encryption at rest and in transit: Y / N
Identity: who can access, through which roles
Network: public endpoints? WAF in front?
Logging: CloudTrail + application logs retained for ___
Backup and recovery targets (RPO / RTO):
Approvals: security, risk, application owner

[ ] No IAM users with long-lived keys for apps
[ ] MFA for all human access
[ ] S3 Block Public Access enabled at account level
[ ] Default encryption with KMS on data buckets
[ ] CloudTrail enabled in all regions, logs locked
[ ] AWS Config rules for public buckets and open ports
[ ] Secrets in a secrets manager, rotated

Banking cloud lab (use synthetic data only)
1. Create raw and curated S3 buckets with encryption
2. Upload synthetic transactions as Parquet by date
3. Query them with Athena
4. Write a read-only IAM policy for an analyst role
5. Enable CloudTrail and find your own API calls