๐
โ๏ธ
AWS Case Study
NBFC / FinTech
Infrastructure Protection
RBI-Regulated
Hindon Mercantile:
Non-Bypassable
Edge Protection
An RBI-regulated digital lending platform closes its origin bypass gap, deploys a custom WAF rule set tuned to the lending workflow, and automates credential rotation โ with zero downtime.
100%
Unverified Requests Rejected
0
Static Origin Credentials
0
Downtime on Rotation
Edge Protection Dashboard โ Hindon Mercantile
Origin Bypass Risk
Closed
โ CloudFront + WAF
Request Verification
100%
โ Lambda@Edge
Static Credentials
Eliminated
โ Secrets Manager
DDoS Protection
Always-on
โ AWS Shield
WAF
Custom Lending Rules
โ Staged Deploy
KMS
Data Encrypted
โ RDS+EBS+S3
DDoS
Runbook Exercised
โ Rehearsed
01
AWS Infrastructure Protection Delivery
Securing an Internet-Facing Digital Lending Platform for an RBI-Regulated NBFC
About Hindon Mercantile Limited
Hindon Mercantile Limited is an India-based non-banking financial company (NBFC) providing digital lending and financial services. As an RBI-regulated institution operating a public-facing loan origination platform, the business must protect borrower data and maintain service availability under continuous regulatory scrutiny.
The Challenge
Critical security gaps in a public-facing RBI-regulated lending platform
Public Attack Surface
Borrower applications, OTP verification, and customer logins were exposed directly to the internet โ attracting credential stuffing, scraping, and application-layer abuse at scale.
Generic Protection
Managed rule sets alone could not distinguish abuse patterns specific to the lending workflow โ such as OTP enumeration and loan-application scraping โ from legitimate borrower traffic.
Origin Bypass Risk
The application origin remained directly reachable if its address was discovered, allowing the edge protection layer to be circumvented entirely โ rendering WAF and Shield ineffective.
Solutions Provided
A layered edge-to-origin architecture closing every bypass path for a regulated lending platform
Layered Edge Protection
Implemented Amazon CloudFront with AWS WAF as the single protected ingress path, with AWS Shield providing always-on network-layer DDoS mitigation at the global edge.
Custom Lending Rule Set
Authored WAF rules with endpoint-class rate limits on login, OTP, and loan-application APIs โ with geo-match rules aligned to the service footprint and tuned OWASP managed groups, promoted through a staged count-to-block cycle with false-positive review.
Origin Verification
Deployed an AWS Lambda@Edge function injecting a secret header validated by an Application Load Balancer listener rule โ so any request not traversing the protected CloudFront path is rejected at the origin.
Automated Secret Rotation
Built an AWS Secrets Manager rotation function that replaces the origin-verification secret on schedule, honouring both current and previous values during the rotation window โ ensuring zero downtime during every rotation.
Network & Data Controls
Applied private subnet placement with default-deny security groups, network ACLs, AWS KMS encryption across RDS, EBS, and S3, and AWS CloudTrail auditing of all configuration changes.
Result Outcome
Non-bypassable edge protection, tuned defence, and automated rotation โ delivered with zero downtime
Non-Bypassable Protection
The origin is unreachable except through the CloudFront and WAF path โ the bypass gap that previously existed is permanently closed.
Tuned Defence
Lending-specific abuse โ including OTP enumeration, credential stuffing, and loan-application scraping โ is filtered at the edge without disrupting legitimate borrower traffic.
No Static Credentials
Origin-verification secret rotation is fully automated through Secrets Manager with zero service interruption โ eliminating static credential risk from the entire environment.
Incident Readiness
A documented DDoS response runbook was delivered and rehearsed with the Hindon Mercantile team โ establishing a tested, repeatable response procedure for volumetric attacks.
100%
Unverified Requests Rejected
All requests without valid origin header rejected at the ALB
Zero
False-Positive Disruption
Staged count-to-block WAF promotion with zero impact at cutover
Zero
Downtime on Secret Rotation
Automated rotation honours current and previous values during window
1
DDoS Runbook Exercised
Documented and rehearsed with the customer team โ ready for use
Success Metrics
Measurable security improvements across the edge-to-origin stack
Unverified Requests at ALB
Passed
โ
100% Rejected
All requests without valid origin-verification header blocked at the load balancer
WAF Rule Deployment
โ
Staged
Count-to-block promotion with false-positive review โ zero disruption at cutover
Secret Rotation Downtime
Manual
โ
Zero Downtime
Automated rotation with dual-value window โ no service interruption on every cycle
DDoS Response Readiness
None
โ
Exercised
Documented runbook delivered and rehearsed with the customer team
Before
The application origin remained directly reachable if discovered โ the edge protection layer could be bypassed entirely
Generic managed rule sets could not distinguish lending-specific abuse from legitimate borrower traffic
The public loan origination platform was exposed to credential stuffing, scraping, and application-layer attack
Origin protection relied on static configuration with no credential rotation mechanism
No documented or rehearsed response procedure existed for a volumetric DDoS attack
After
Header-based origin verification ensures every request reaching the origin traversed the protected CloudFront and WAF path
A custom WAF rule set applies endpoint-class rate limits and geo-match rules tuned specifically to the lending workflow
AWS Shield provides always-on network-layer DDoS mitigation at the global CloudFront edge
The origin-verification secret rotates automatically through Secrets Manager with zero service interruption
A documented DDoS response runbook is in place and has been exercised with the Hindon Mercantile team
“
The engagement delivered a non-bypassable, lending-tuned edge protection architecture in which the origin is reachable only through the protected path, abuse is filtered without disrupting legitimate borrowers, and credential rotation is fully automated โ meeting the security and availability obligations of a regulated NBFC.
Technology Stack
AWS Services Deployed
Amazon CloudFront
Protected Ingress Path
AWS WAF
Custom Lending Rule Set
AWS Shield
Always-on DDoS Mitigation
Lambda@Edge
Origin Header Injection
Application Load Balancer
Origin Verification Rule
AWS Secrets Manager
Automated Secret Rotation
AWS KMS
RDS / EBS / S3 Encryption
AWS CloudTrail
Configuration Audit
Amazon RDS
Encrypted Borrower Data
Amazon S3
KMS-Encrypted Storage
Security Groups / NACLs
Default-Deny Network
Private Subnets
Origin Network Isolation
Accepting New Enterprise Clients
Ready to Protect Your
Cloud Infrastructure?
Book a complimentary security architecture review. Our AWS-certified engineers will assess your edge-to-origin protection posture and deliver a tailored defence roadmap โ no commitment required.
No commitment required
Response within 24hrs
AWS Advanced Partner