Welcome to "This Is My Architecture."
I'm Benjamin, from AWS. Today I'm talking to Moshe from Fiverr.
- Hi, Moshe. - Hi, Benjamin.
- Thanks for joining me. - Thank you for having me here.
Moshe, before we dig in, tell me a little bit about what Fiverr does.
Sure. Fiverr's mission is to change all the world works together.
Fiverr platform connects between businesses of all sizes
with freelancers offering digital services.
So, as a user, I can go on your platform and sort of pay for an ad-hoc gig
- from some freelancer. - Yep.
Very nice. Which of Fiverr's systems are we talking about today?
We're talking about our payment system.
OK, so from my experience, payments means you want to be PCI DSS compliant.
- Is that true in your guy's case? - Yep.
OK. How did you go about designing a PCI compliant system?
Well, we engaged with compliance consultants
that gave us this template architecture,
which contains load balancers, application service,
antivirus, bastion, servers, databases, HSM
and a lot of procedures to manage them.
Right, so, before you even work on any kind of technology,
the first thing you do is you consult with a qualified compliance assessor,
and they gave you sort of a blueprint for where you want to start from.
- Is that how this happened? - Yeah.
OK. So now that you have this blueprint,
how do you go about designing sort of your payment system?
Sure. So we're running on Amazon.
So first of all, the load balancers, we can remove them.
- We can use ALB. - Right.
- So that's simple enough, fully managed. - Yeah, so we put here the ALB,
fully managed, very strong rules.
So it's very good for us in this case.
Now the app service, I assume, this is what's actually processing the payments.
- Yeah. - OK.
So the app services, in this case, are instances which we need to manage
to provision, to configure, um...
- It's too much work. - OK.
In our main environment, we use Kubernetes but, again,
it's instances that we need to do something with them.
So in this case we decided to remove the instances and go with Fargate.
OK.
Now you already mentioned sort of like your main environment,
does that mean that this is running in a separate VPC,
- in a separate account, maybe? - Yeah, it's running in a separate account,
separate VPC, of course,
to decouple and to limit the scope of the assessment.
- Right. I've heard that from other sort of PCI-regulated customers.
So what about the antivirus and the bastion host?
So antivirus and bastions are for managing instances.
So if we don't have instances, we don't need the antivirus and the bastion.
Perfect.
Now, with the database and the HSM
we decided to go with a third party tokenization service.
So we removed the database.
So, if I understand correctly, this is where you would've stored
the credit card information. Now it's being shipped to a third party,
but does that mean that you no longer need to be PCI compliant?
No, we still need to be PCI compliant.
Right, because you're processing payments. You're just not storing credit card information.
- But that doesn't change anything. - Yeah, that doesn't change anything.
- So... - What about the security mechanism?
So they suggested that you have an HSM, do you still need one in this case?
- No. In this case, we don't need one. - OK. So what about the sort of
security controls that you put in place on the AWS side?
Sure. So, first of all, how to configure the Fargate containers.
We need to pass them some configuration, API Endpoints, API Tokens and stuff like that.
We decided to go with...
- SSM? - SSM backed by KMS.
OK.
So, SSM paramenter store backed by KMS is sort of storing all of the configuration
and credentials and sensitive information, the Fargate containers are running?
- Yeah. - OK. What else do we have here?
So, to get more visibility on the system to see what's changed,
what flows we have, we added GuardDuty
- and enhanced Cloudtrail - OK.
- configurations. - So these services are not only PCI compliant
from our end, meaning you can easily use them in a PCI environment,
but they also help with your compliance, right?
Because they're security mechanisms that are acknowledged.
What is the level of PCI compliance that you were aiming for?
We were aiming and been certified for a PCI DSS level 1.
OK. So same as us. I really like this sort of idea of how to build an architecture because,
on the one hand, you sort of simplified things a lot and now you need
significantly less maintenance. I assume you have less maintenance people
- that are required in order to maintain this. - Yeah.
On the other hand, it also helps within your actual compliance,
because you've stripped away all of these pieces that you don't need
using services that we have already published and at a state of compliance,
so you can just reference that in your compliance journey.
And so, that just makes everything simpler.
So I really like this idea of simplifying an architecture,
not just for all the benefits that we know, but for compliance needs.
This is very cool. Thank you for sharing it with us.
- Thank you. - And thank you for watching "This Is My Architecture."