How Munich Re Automation Solutions Ltd built a digital insurance platform on AWS
AWS Architecture BlogHow Munich Re Automation Solutions Ltd built a digital insurance platform on AWSby Sid Singh, Darren O'Neill, and Claire Sheridan | on29 JUL 2022| inAmazon CloudWatch,Amazon GuardDuty,Amazon MQ,Amazon RDS,Amazon Route 53,Amazon VPC,Architecture,AWS CodeCommit|Permalink|ShareUnderwriting for life insurance can be quite manual and often time-intensive with lots of re-keying by advisers before underwriting decisions can be made and policies finally issued. In the digital age, people purchasing life insurance want self-service interactions with their prospective insurer. People want speed of transaction with time to cover reduced from days to minutes. While this has been achieved in the general insurance space with online car and home insurance journeys, this is not always the case in the life insurance space. This is whereMunich Re Automation Solutions Ltd (MRAS)offers its customers, a competitive edge to shrink the quote-to-fulfilment process using their ALLFINANZ solution.ALLFINANZ is a cloud-based life insurance and analytics solution to underwrite new life insurance business. It is designed to transform the end consumer’s journey, delivering everything they need to become a policyholder. The core digital services offered to all ALLFINANZ customers include Rulebook Hub, Risk Assessment Interview delivery, Decision Engine, deep analytics (including predictive modeling capabilities), and technical integration services—for example, API integration and SSO integration.Current state architectureThe ALLFINANZ application began as a traditional three-tier architecture deployed within a datacenter. As MRAS migrated their workload to the AWS cloud, they looked at their regulatory requirements and the technology stack, and decided on thesilo modelof the multi-tenant SaaS system. Each tenant is provided a dedicatedAmazon Virtual Private Cloud (VPC)that holds network and application components, fully isolated from other primary insurers.As an entry point into the ALLFINANZ environment, MRAS usesAmazon Route 53to route incoming traffic to the appropriate Amazon VPC. The routing relies on a model where subdomains are assigned to each tenant, for example the subdomainallfinanz.tenant1.munichre.comis the subdomain fortenant 1. The diagram below shows the ALLFINANZ architecture. Note: not all links between components are shown here for simplicity.Figure 1. Current high-level solution architecture for the ALLFINANZ solutionThe solution uses Route 53 as the DNS service, which provides two entry points to the SaaS solution for MRAS customers:The URL<tenant-id>.munichre.comallows user access to the ALLFINANZ Interview Screen (AIS). The AIS can exist as a standalone application, or can be integrated with a customer’s wider digital point-of -sale process.The URLapi.<tenant-id>.munichre.comis used for accessing the application’s Web services and REST APIs.Traffic from both entry points flows through the load balancers. While HTTP/S traffic from the application user access entry point flows through anApplication Load Balancer (ALB), TCP traffic from the REST API clients flows through aNetwork Load Balancer (NLB). Transport Layer Security (TLS) termination for user traffic happens at the ALB using certificates provided by theAWS Certificate Manager.  Secure communication over the public network is enforced through TLS validation of the server’s identity.Unlike application user access traffic, REST API clients use mutual TLS authentication to authenticate a customer’s server. Since NLB doesn’t support mutual TLS, MRAS opted for a solution to pass this traffic to a backend NGINX server for the TLS termination. Mutual TLS is enforced by using self-signed client and server certificates issued by a certificate authority that both the client and the server trust.Authenticated traffic from ALB and NGINX servers is routed to EC2 instances hosting the application logic. These EC2 instances are hosted in an auto-scaling group spanning two Availability Zones (AZs) to provide high availability and elasticity, therefore, allowing the application to scale to meet fluctuating demand.Application transactions are persisted in the backendAmazon Relational Database ServiceMySQL instances. This database layer is configured across multi-AZs, providing high availability and automatic failover.The application requires the capability to integrate evidence from data sources external to the ALLFINANZ service. This message sharing is enabled through theAmazon MQmanaged message broker service for Apache Active MQ.Amazon CloudWatchis used for end-to-end platform monitoring through logs collection and application and infrastructure metrics and alerts to support ongoing visibility of the health of the application.Software deployment and associated infrastructure provisioning is automated through infrastructure as code using a combination of Git,Amazon CodeCommit, Ansible, and Terraform.Amazon GuardDutycontinuously monitors the application for malicious activity and delivers detailed security findings for visibility and remediation. GuardDuty also allows MRAS to provide evidence of the application’s strong security posture to meet audit and regulatory requirements.High availability, resiliency, and securityMRAS deploys their solution across multiple AWS AZs to meet high-availability requirements and ensure operational resiliency. If one AZ has an ongoing event, the solution will remain operational, as there are instances receiving production traffic in another AZ. As described above, this is achieved using ALBs and NLBs to distribute requests to the application subnets across AZs.The ALLFINANZ solution uses private subnets to segregate core application components and the database storage platform.Security groupsprovide networking security measures at the elastic network interface level. MRAS restrict access from incoming connection requests to ranges of IP addresses by attaching security groups to the ALBs.Amazon Inspectormonitors workloads for software vulnerabilities and unintended network exposure.AWS WAFis integrated with the ALB to protect from SQL injection or cross-site scripting attacks on the application.Optimizing the existing workloadOne of the key benefits of this architecture is that now MRAS can standardize the infrastructure configuration and ensure consistent versioning of the workload across tenants. This makes onboarding new tenants as simple as provisioning another VPC with the same infrastructure footprint.MRAS are continuing to optimize their architecture iteratively, examining components to modernize to cloud-native components and evolving towards thepool modelof multi-tenant SaaS architecture wherever possible. For example, MRAS centralized their per-tenant NAT gateway deployment to acentralized outbound Internet routingdesign usingAWS Transit Gateway, saving approximately 30% on their overall NAT gateway spend.ConclusionThe AWS global infrastructure has allowed MRAS to serve more than 40 customers in five AWS regions around the world. This solution improves customers’ experience and workload maintainability by standardizing and automating the infrastructure and workload configuration within a SaaS model, compared with multiple versions for the on-premise deployments. SaaS customers are also freed up from the undifferentiated heavy lifting of infrastructure operations, allowing them to focus on their business of underwriting for life insurance.MRAS used theAWS Well-Architected Frameworkto assess their architecture and list key recommendations. AWS also offersWell-Architected SaaS LensandAWS SaaS Factory Program, with a collection of resources to empower and enable insurers at any stage of their SaaS on AWS journey.Sid SinghSid is a Solutions Architect with Amazon Web Services. He works with the global financial services customers and has more than 10 years of industry experience covering a wide range of technologies. Outside of work, he loves traveling, is an avid foodie, and also a Bavarian beer enthusiast.Darren O'NeillDarren O'Neill is Head of Cloud Operations at Munich Re Automation Solutions (MRAS) and is responsible for technical operations for the MRAS cloud. He helps deliver a growing portfolio of cloud services including artificial intelligence, big data and core services such as security, compute and storage. Darren leads an expanding team of cloud engineers focused on supporting and delivering customers' mission-critical workloads. Prior to MRAS, Darren has spent the last 7 years working in the financial services industry with a focus on building highly secure and reliable performance based cloud systems. Darren holds an MSc in Cloud Computing from the National College of Ireland.Claire SheridanClaire is a Solutions Architect with Amazon Web Services working with global financial services customers. She holds a PhD in Informatics and has more than 15 years industry experience in tech. She loves travelling and visiting art galleries.
Underwriting for life insurance can be quite manual and often time-intensive with lots of re-keying by advisers before underwriting decisions can be made and policies finally issued. In the digital age, people purchasing life insurance want self-service interactions with their prospective insurer. People want speed of transaction with time to cover reduced from days to […]
Sid Singh
Amazon CloudWatch Amazon GuardDuty Amazon MQ Amazon RDS Amazon Route 53 Amazon VPC Architecture AWS CodeCommit