Build a digital assets exchange on AWS: A reference architecture

This article presents a reference architecture for building a centralized digital assets exchange (CEX) on AWS, aggregating architectural decisions from multiple production deployments.

• Multi-account AWS organization structure with separate OUs for control, production, staging, and CI/CD using AWS Control Tower and SCPs
• Matching engine hot path runs single-AZ in cluster placement group with replicated Raft cluster for high availability within zone
• Multi-AZ recovery layer with durable state replication for zone failure recovery with explicit RTO and RPO targets
• Core trading on Amazon EKS microservices; dedicated EC2 instances for matching engine to eliminate orchestration overhead
• Client gateway and matching engine connected via brokerless messaging (ZeroMQ, Aeron) achieving 32–84 microseconds p99 latency
• Purpose-built data stores: Aurora PostgreSQL for transactions, DynamoDB for key-value, ElastiCache for order books, MSK for event backbone, kdb Insights for analytics
• AWS Nitro Enclaves for cryptographic operations with KMS attestation; Fireblocks MPC wallets for multi-party key management
• Market maker connectivity options: shared placement groups, PrivateLink, VPC peering, Transit Gateway, or Direct Connect based on latency and deployment needs
• Security via GuardDuty, Security Hub CSPM, CloudTrail audit logging; observability through CloudWatch dashboards and custom trading metrics

The architecture prioritizes matching-engine latency through deliberate single-AZ design with explicit recovery targets, treating latency-availability trade-offs as core design decisions rather than defaults.