When a partner submission system is already up and running, the main challenge becomes consistently turning findings into production changes and proving their impact with metrics. In this talk, I’ll walk through our practical cycle: finding → fix → impact validation → scaling the pattern across multiple teams. We focused on metrics that turn SRE into a manageable system. We measure the speed, stability, and cost of changes so that decisions are driven by data rather than intuition — with security now embedded as part of this pattern. We’ll break down how to avoid “local” fixes, make changes reproducible, and sustain progress continuously rather than as a one-time effort.

Within the Security Hardening initiative, we introduced an Access as Code approach for managing AWS permissions. Each repository is assigned a dedicated IAM role with permissions aligned to the principle of least privilege. Role management is centralized in a single repository, where each service is defined using a single YAML file. All changes go through pull requests and approvals, while Terraform and Atlantis automatically create or update IAM roles. As a result, we achieved scalable, auditable, and secure access management without direct access to AWS for engineering teams.

During the lecture, Mykyta will share the story of Solidgate's journey in building a high-performing and reliable fintech company, striving for 99.999% uptime on AWS’s SaaS platform. He'll uncover numerous caveats in doing things right without full system access, addressing product requirements, and staying up to date.