Skip to content
๐ŸŒ™ โ˜€๏ธ
AWS Case Study
NBFC / FinTech Infrastructure Protection RBI-Regulated

Hindon Mercantile:
Non-Bypassable
Edge Protection

An RBI-regulated digital lending platform closes its origin bypass gap, deploys a custom WAF rule set tuned to the lending workflow, and automates credential rotation โ€” with zero downtime.

100%
Unverified Requests Rejected
0
Static Origin Credentials
0
Downtime on Rotation
Edge Protection Dashboard โ€” Hindon Mercantile
Origin Bypass Risk
Closed
โ†‘ CloudFront + WAF
Request Verification
100%
โ†‘ Lambda@Edge
Static Credentials
Eliminated
โ†“ Secrets Manager
DDoS Protection
Always-on
โ†‘ AWS Shield
WAF
Custom Lending Rules
โ†‘ Staged Deploy
KMS
Data Encrypted
โ†‘ RDS+EBS+S3
DDoS
Runbook Exercised
โ†‘ Rehearsed
01
AWS Infrastructure Protection Delivery
Securing an Internet-Facing Digital Lending Platform for an RBI-Regulated NBFC
About Hindon Mercantile Limited
Hindon Mercantile Limited is an India-based non-banking financial company (NBFC) providing digital lending and financial services. As an RBI-regulated institution operating a public-facing loan origination platform, the business must protect borrower data and maintain service availability under continuous regulatory scrutiny.
The Challenge

Critical security gaps in a public-facing RBI-regulated lending platform

Digital lending platform security challenge โ€” credential stuffing and application-layer attacks
๐ŸŒ
Public Attack Surface
Borrower applications, OTP verification, and customer logins were exposed directly to the internet โ€” attracting credential stuffing, scraping, and application-layer abuse at scale.
๐Ÿ”ง
Generic Protection
Managed rule sets alone could not distinguish abuse patterns specific to the lending workflow โ€” such as OTP enumeration and loan-application scraping โ€” from legitimate borrower traffic.
๐Ÿšช
Origin Bypass Risk
The application origin remained directly reachable if its address was discovered, allowing the edge protection layer to be circumvented entirely โ€” rendering WAF and Shield ineffective.
Solutions Provided

A layered edge-to-origin architecture closing every bypass path for a regulated lending platform

๐Ÿ›ก๏ธ
Layered Edge Protection
Implemented Amazon CloudFront with AWS WAF as the single protected ingress path, with AWS Shield providing always-on network-layer DDoS mitigation at the global edge.
๐Ÿ“‹
Custom Lending Rule Set
Authored WAF rules with endpoint-class rate limits on login, OTP, and loan-application APIs โ€” with geo-match rules aligned to the service footprint and tuned OWASP managed groups, promoted through a staged count-to-block cycle with false-positive review.
๐Ÿ”
Origin Verification
Deployed an AWS Lambda@Edge function injecting a secret header validated by an Application Load Balancer listener rule โ€” so any request not traversing the protected CloudFront path is rejected at the origin.
๐Ÿ”„
Automated Secret Rotation
Built an AWS Secrets Manager rotation function that replaces the origin-verification secret on schedule, honouring both current and previous values during the rotation window โ€” ensuring zero downtime during every rotation.
๐Ÿ”’
Network & Data Controls
Applied private subnet placement with default-deny security groups, network ACLs, AWS KMS encryption across RDS, EBS, and S3, and AWS CloudTrail auditing of all configuration changes.
AWS CloudFront WAF Shield โ€” layered edge protection for digital lending platform
Result Outcome

Non-bypassable edge protection, tuned defence, and automated rotation โ€” delivered with zero downtime

Infrastructure protection results โ€” non-bypassable DDoS mitigation and WAF deployment
๐Ÿšซ
Non-Bypassable Protection
The origin is unreachable except through the CloudFront and WAF path โ€” the bypass gap that previously existed is permanently closed.
๐ŸŽฏ
Tuned Defence
Lending-specific abuse โ€” including OTP enumeration, credential stuffing, and loan-application scraping โ€” is filtered at the edge without disrupting legitimate borrower traffic.
๐Ÿ”‘
No Static Credentials
Origin-verification secret rotation is fully automated through Secrets Manager with zero service interruption โ€” eliminating static credential risk from the entire environment.
๐Ÿ“–
Incident Readiness
A documented DDoS response runbook was delivered and rehearsed with the Hindon Mercantile team โ€” establishing a tested, repeatable response procedure for volumetric attacks.
๐Ÿšซ
100%
Unverified Requests Rejected
All requests without valid origin header rejected at the ALB
โšก
Zero
False-Positive Disruption
Staged count-to-block WAF promotion with zero impact at cutover
๐Ÿ”„
Zero
Downtime on Secret Rotation
Automated rotation honours current and previous values during window
๐Ÿ“–
1
DDoS Runbook Exercised
Documented and rehearsed with the customer team โ€” ready for use
Success Metrics

Measurable security improvements across the edge-to-origin stack

Unverified Requests at ALB
Passed
โ†’
100% Rejected
All requests without valid origin-verification header blocked at the load balancer
WAF Rule Deployment
โ†‘
Staged
Count-to-block promotion with false-positive review โ€” zero disruption at cutover
Secret Rotation Downtime
Manual
โ†’
Zero Downtime
Automated rotation with dual-value window โ€” no service interruption on every cycle
DDoS Response Readiness
None
โ†’
Exercised
Documented runbook delivered and rehearsed with the customer team
โœ• Before
The application origin remained directly reachable if discovered โ€” the edge protection layer could be bypassed entirely
Generic managed rule sets could not distinguish lending-specific abuse from legitimate borrower traffic
The public loan origination platform was exposed to credential stuffing, scraping, and application-layer attack
Origin protection relied on static configuration with no credential rotation mechanism
No documented or rehearsed response procedure existed for a volumetric DDoS attack
โœ“ After
Header-based origin verification ensures every request reaching the origin traversed the protected CloudFront and WAF path
A custom WAF rule set applies endpoint-class rate limits and geo-match rules tuned specifically to the lending workflow
AWS Shield provides always-on network-layer DDoS mitigation at the global CloudFront edge
The origin-verification secret rotates automatically through Secrets Manager with zero service interruption
A documented DDoS response runbook is in place and has been exercised with the Hindon Mercantile team
The engagement delivered a non-bypassable, lending-tuned edge protection architecture in which the origin is reachable only through the protected path, abuse is filtered without disrupting legitimate borrowers, and credential rotation is fully automated โ€” meeting the security and availability obligations of a regulated NBFC.
Technology Stack

AWS Services Deployed

โ˜๏ธ
Amazon CloudFront
Protected Ingress Path
๐Ÿ›ก๏ธ
AWS WAF
Custom Lending Rule Set
โšก
AWS Shield
Always-on DDoS Mitigation
ฮป
Lambda@Edge
Origin Header Injection
โš–๏ธ
Application Load Balancer
Origin Verification Rule
๐Ÿ”‘
AWS Secrets Manager
Automated Secret Rotation
๐Ÿ”’
AWS KMS
RDS / EBS / S3 Encryption
๐Ÿ“‹
AWS CloudTrail
Configuration Audit
๐ŸŒ
Amazon RDS
Encrypted Borrower Data
๐Ÿ—„๏ธ
Amazon S3
KMS-Encrypted Storage
๐Ÿ”ง
Security Groups / NACLs
Default-Deny Network
๐Ÿ—๏ธ
Private Subnets
Origin Network Isolation
Accepting New Enterprise Clients

Ready to Protect Your
Cloud Infrastructure?

Book a complimentary security architecture review. Our AWS-certified engineers will assess your edge-to-origin protection posture and deliver a tailored defence roadmap โ€” no commitment required.

No commitment required
Response within 24hrs
AWS Advanced Partner