Executive Summary & Audit Context

TradeCore Africa is a containerized, lean cloud-native transactional platform deployed on AWS. This document specifies the implementation, networking topology, security controls, and cost governance engineered for a 14-day pre-audit operational window preceding an institutional banking review.
The primary architectural driver is delivering a production-grade, secure, and observable environment under a startup budget mandate. By strategically leveraging AWS Free Tier allocations and eliminating idle provisioned services—specifically managed NAT Gateways—the architecture operates at an adjusted net cost of $8.32/month (~$3.10–$3.50 for the 14-day evaluation window) under a rigid $25.00 AWS Budget cap

Technical Stack & Service Specifications

• Frontend Client: React Single-Page Application (SPA) hosted and built via AWS Amplify.
• Backend Runtime: Node.js REST API packaged in a lightweight Docker container image (<500 MB).
• Authentication: Amazon Cognito User Pools and Application Clients handling JWT issuance, user registration, and session authorization.
• Container Orchestration: Amazon ECS using AWS Fargate serverless compute.
• Container Registry: Amazon ECR (Private Repository).
• Relational Database: Amazon RDS for PostgreSQL 17 (db.t3.micro).
• Traffic Ingress: Application Load Balancer (ALB) terminating TLS/SSL certificates provisioned via AWS Certificate Manager (ACM).
• Secret Management: AWS Secrets Manager storing 5 operational environment secrets with client caching.
• Observability & Alerts: Amazon CloudWatch (Logs, Metrics, Alarms) integrated with Amazon SNS pushing directly to Slack.
• Cost Governance: AWS Budgets (with 50% and 90% spend alerts) and AWS Cost Explorer.

Architectural Decision Records

Deployment of ECS Tasks in Public Subnets to Eliminate NAT Gateway Baseline Costs

• Status: Accepted
• Date: 2026-08-03
• Deciders: TradeCore Engineering Team
• Technical Scope: VPC Networking, ECS Fargate, FinOps Governance