Description: How I built a secure, containerized Parametric Value at Risk microservice with Python, Terraform, Aqua Trivy, and Azure Container Apps.
As a Cloud, DevOps, and DevSecOps engineer who is also pursuing a Master’s in Financial Engineering, I wanted to build a project that bridges the gap between quantitative risk modeling and production-grade cloud infrastructure.
That project is QuantGuard (github.com/Azeta-Insights/quant-guard-api), a containerized financial risk microservice that calculates Parametric Value at Risk (VaR) for investment portfolios.
In this article, I’ll walk through how I engineered QuantGuard with three core pillars in mind: Quantitative Financial Engineering, Zero-Trust DevSecOps Hardening, and Cloud FinOps Cost Governance on Microsoft Azure.
1. The Quantitative Core (FastAPI & NumPy)
At its heart, QuantGuard exposes a clean REST API built with FastAPI and NumPy. It calculates Parametric Value at Risk (VaR), a standard metric used in financial institutions to estimate the potential loss of an investment portfolio over a given time horizon at a specific confidence interval.
The formula is structured as:
VaR = Portfolio Value × Daily Volatility (σ) × Square Root of Time (√T) × Z-Score (Z_α)
Using Python, the core calculation endpoint looks like this:
import numpy as np
from fastapi import FastAPI
app = FastAPI(title="QuantGuard API", version="1.0.0")
@app.get("/calculate-var")
def calculate_var(portfolio_value: float, volatility: float, confidence_level: float = 0.95, days: int = 1):
# Z-score approximation for confidence level
z_score = 1.645 if confidence_level == 0.95 else 2.326
var_value = portfolio_value * volatility * np.sqrt(days) * z_score
return {
"portfolio_value": portfolio_value,
"confidence_level": confidence_level,
"time_horizon_days": days,
"parametric_var": round(var_value, 2)
}
2. DevSecOps Container Hardening
Financial and enterprise APIs cannot run with default insecure configurations. To ensure robust container security, I engineered a hardened Dockerfile:
Non-Root Execution: The application runs under a dedicated, unprivileged user (quantuser) instead of root, preventing container escape vulnerabilities.
Shift-Left Vulnerability Scanning: Every push triggers Aqua Security Trivy inside GitHub Actions to scan both container layer dependencies (vuln-type: library) and Infrastructure-as-Code files.
Documented CVE Triage: Using .trivyignore, any unpatchable upstream base-image advisories are explicitly documented and triaged, ensuring clean and reliable security gates.
3. Cloud FinOps Governance & Terraform on Azure
Instead of over-provisioning cloud compute, QuantGuard’s infrastructure is defined via Terraform targeting Microsoft Azure Container Apps with strict FinOps principles:
Scale-to-Zero Compute: Configured with min_replicas = 0, meaning when the API is idle, compute scale drops entirely to zero, eliminating 100% of idle cloud waste ($0.00/hr).
Mandatory Cost-Allocation Tagging: Enforces automated resource tracking tags (CostCenter = FinEng-Quant-001, Environment = Production, ManagedBy = FinOps) across every provisioned Azure resource.
4. Automated CI/CD Pipeline
The entire workflow is automated via GitHub Actions (.github/workflows/ci-devsecops.yml):
Build: Compiles the hardened Docker container.
Secure: Runs Aqua Trivy to block HIGH and CRITICAL vulnerabilities.
Deploy: Pushes verified container images straight to Azure Container Registry (ACR) and updates the live Azure Container App automatically on every main branch push.
Conclusion & What's Next
Building QuantGuard allowed me to combine financial engineering rigor with modern cloud-native security practices. You can check out the full source code, architecture, and live documentation links over on GitHub at Azeta-Insights/quant-guard-api.
Have questions about setting up Trivy security gates or Azure Container Apps scale-to-zero configurations? Let me know in the comments below! 🚀
Top comments (0)