Crew Finance, part two: one VPC, an isolated cardholder environment, and an 89% NAT bill cut
Five VPCs on the same address range became one shared network with an isolated PCI zone, while NAT costs dropped 89% and load balancer costs halved.
Industry: Financial technology
Company size: 1-10 employees
Services: Network architecture, PCI readiness, AWS cost optimization, disaster recovery
The Challenge
After SOC2 Type 1, Crew Finance kept us on. The next problems were structural. Five VPCs had been created over time, all on the same address range, so none of them could ever be peered. Production and staging shared an account. Each environment paid for its own NAT Gateways and load balancers, and the cardholder data environment needed cleaner isolation ahead of PCI work.
Our Approach
Everything is Terraform, so the migration was planned as code and applied in phases.
- Stood up a separate non-production AWS account and a single consolidated VPC, sharing subnets across accounts with AWS Resource Access Manager
- Isolated the cardholder data environment in its own subnets with network ACLs
- Replaced managed NAT Gateways with fck-nat instances
- Consolidated per-environment load balancers onto a shared set with FIPS TLS listeners
- Moved container builds to distroless, build-once images promoted between environments, and added RDS Proxy and IPv6
- Wrote and rehearsed a disaster recovery runbook that rebuilds the full environment from Terraform
The Results
- One network instead of five, with the orphaned VPCs removed within three weeks of the cutover starting
- Clean separation of production and non-production accounts, about 150 Terraform resources in the non-prod phase alone
- Audit-ready controls: immutable CloudTrail logs, isolated cardholder subnets, documented recovery
Key Takeaway
Cost and compliance usually pull in the same direction. Fewer networks, fewer load balancers, and no managed NAT meant a smaller bill and a smaller audit surface at the same time.
Related guide: Cutting an AWS bill without touching production: a checklist for small teams
Paying for infrastructure you accumulated rather than designed?
A short review usually finds savings that fund the cleanup.