Success Story
Creizer modernizes its AWS infrastructure in 3 months: separate environments, no Access Keys and CI/CD for more than 120 Lambda functions
At a glance
Creizer is a Mexican fintech startup, backed by Y Combinator, that offers loans to sellers on Mercado Libre and Amazon. Its infrastructure lived in a single AWS account, with no environment separation, no CI/CD and Access Keys in about 120 Lambda functions. In 3 months, Craftech separated the environments, eliminated Access Keys with SSO and automated the deployment of the entire platform.
120+
Lambda functions with CI/CD
Creizer is a Mexican fintech startup, backed by Y Combinator, that offers loans to sellers on Mercado Libre and Amazon: repayments adjust to daily sales, with no fixed installments, and financing of up to $4 million. At the time of the project it had more than 500 customers.
Solution implemented
- Created a multi-account organization with development, production and identity accounts
- Implemented AWS IAM Identity Center with SSO on Google Workspace and eliminated Access Keys across the organization
- Added Amazon CloudWatch (metrics and dashboards), AWS CloudTrail (auditing) and AWS X-Ray (distributed tracing)
- Created an Amazon Cognito dashboard in CloudWatch with users by type and status and login activity
- Centralized the secrets of the ~120 Lambda functions in AWS Secrets Manager
- Implemented CI/CD for the frontends (build, deploy to S3 and CloudFront invalidation), the Lambda functions (.NET and Python) and the BFF on EC2
- Defined the infrastructure as code
Business Challenge
All of the infrastructure lived in a single AWS account, with no environment separation, no CI/CD and Access Keys in the environment variables of about 120 Lambda functions. Deploys of frontends, APIs and backend were manual. There was also no distributed observability, no centralized secrets management and no identity-based access control.
Solution
Craftech separated the development and production environments into independent AWS accounts, within a multi-account organization with an account dedicated to identity. It implemented AWS IAM Identity Center with SSO on Google Workspace to eliminate individual credentials and Access Keys across the organization. It automated the deployment of the entire platform with CI/CD: the frontends (build, deploy to S3 and CloudFront invalidation), more than 120 Lambda functions in .NET and Python, and the BFF on EC2. It added monitoring with Amazon CloudWatch, auditing with AWS CloudTrail and distributed tracing with AWS X-Ray, plus an Amazon Cognito dashboard in CloudWatch. The Lambda functions' secrets were centralized in AWS Secrets Manager, and the infrastructure was defined as code.
Outcomes
- Full CI/CD for more than 120 Lambda functions, multiple frontends and the BFF, with no manual deploys
- Separate environments starting from a single-account architecture
- Complete elimination of Access Keys, with access centralized through SSO
- End-to-end visibility in production: metrics, auditing and distributed tracing
Stack & technologies
