Credora · AWS deployment

One region, one VPC from the Exasol launcher, two EC2 hosts and three RDS databases. Ports and protocols on every path; numbers give the order.

All diagrams1 · Big picture2 · AWS deployment3 · Inside Exasol4 · Analysis flow

AWS Region · ap-south-1 (Mumbai) Public subnet · 172.30.1.0/24 sg-exasol (launcher) · 22 2581 8443 8563 ← admin IPs Private subnets · 172.30.2.0/24 (a) + 172.30.3.0/24 (b) sg-rds · 1521, 3306, 5432 ← VPC only · not publicly accessible Users · judges browser credora.loan credora.link Route 53 · 2 public hosted zones credora.loan: @ www docs video ppt credora.link: @ www cibil gst aa every A record → app host Elastic IP IAM role · app host GetSecretValue · S3 read/write bedrock:InvokeModel SSM managed instance Admin IPs (/32) deployer + allow-ip list SSH and Exasol ports Anthropic API Claude · HTTPS (AI_PROVIDER=anthropic) Secrets Manager runtime secret DB, API, Exasol users Amazon S3 ground truth (scorecard) models archive Amazon Bedrock Claude (optional, AI_PROVIDER=bedrock) Internet gateway App host · EC2 t3.large 172.30.1.20 · Elastic IP · Docker Compose caddy :80 → :443 TLS frontend React (static) backend FastAPI :8000 exasol-mcp-server stdio, in backend generator :8100 mockdb PostgreSQL 16 cibil (mock) :8101 gstn (mock) :8102 aa (mock) :8103 Caddy relays cibil./gst./aa. Exasol Personal 2026.1 EC2 r6i.xlarge · 172.30.1.11 :8563 SQL (TLS) · :8443 Admin UI :2581 BucketFS · :22 SSH PYTHON3 · JAVA built-in RUST custom SLC 0.23.1 (BucketFS) VS_CBS · VS_CIF · VS_LOS API, ML and AI UDFs · Lua scripts CONNECTION objects hold secrets installed by the official launcher RDS PostgreSQL 16 :5432 · los · crm application · past_loan offer · offer_event subnet group spans 2 AZs RDS Oracle SE2 :1521 · CBS ACCOUNT · TXN (~850k) RDS MySQL 8.4 :3306 · cif company · partner · rm GLOBAL AND INTERNET (outside the region) VPC 172.30.0.0/16 · created by the Exasol launcher sg-app · 80,443 ← world · 22 ← admin · 8100-8103 ← VPC docs. video. ppt. → static sites www. → 301 to the domain root runtime secret → .env.runtime 1 DNS 2 HTTPS :443 (:80 → https) :443 3 :8563 SQL TLS · role user 4 HTTPS :443 cibil./gst./aa. .credora.link out and back in via Elastic IP 5 :5432 ADBC (los) :1521 JDBC :3306 ADBC 6 :5432 crm mock data → all 3 DBs 7 7 8 :22 :2581 :8443 :8563 :22 SSH instance profile Legend Edge / web (Caddy, React) Service / container Database / Exasol AWS managed service Security / identity Internet / mock party Region VPC Public subnet Private subnets Security group Dashed: admin, secret, mock data

Two domains, one host

  • • credora.loan is the bank: app at the root, www redirect, docs., video., ppt.
  • • credora.link is the outside world: landing page plus cibil., gst., aa. relays
  • • Every record points at the app host's Elastic IP; Caddy gets the TLS certificates

Narrow doors

  • • Only 80 and 443 are open to the world, on the app host
  • • Exasol 22, 2581, 8443, 8563 and app-host SSH: admin IPs only
  • • RDS is private: 1521, 3306, 5432 from inside the VPC only

Portable by design

  • • OpenTofu (run in Docker) adds subnets, RDS, app host, S3, secret and DNS to the launcher's VPC
  • • No account IDs, IPs or domains in code: all from the env file or looked up at deploy time
  • • Secrets are generated per account into Secrets Manager and read with the instance role

Credora · Built for ExaThon India 2026 · Powered by Exasol Personal