Secure Enterprise
Architectureauthmicroservicesdata
Defense in depth: WAF edge, private tiers, KMS, continuous posture
Open & fork this on Zstem →Architecture
- Public Edge: The only internet-facing surface
- Private App Tier: No public IPs; egress via NAT
- Data Tier: Encrypted storage and secrets
- Audit & Posture: Detect, record and prioritize
- Users: Workforce and customers over TLS
- Identity Center: Workforce SSO; short-lived credentials, no long-lived IAM users
- WAF: Managed rules, bot control and rate limits at the boundary
- ALB: Public entry terminating TLS; only the WAF-fronted listener is exposed
- ECS Services: App containers in private subnets; no public IPs
- NAT Gateway: Controlled egress for private subnets
- Encrypted RDS: Private database; storage encrypted with the customer KMS key
- Secrets Manager: DB credentials rotated automatically; fetched at runtime
- KMS: Customer-managed keys for data at rest across tiers
- CloudTrail: Immutable API audit log across the org
- Config Rules: Continuous resource-compliance evaluation
- GuardDuty: Threat detection over logs, DNS and VPC flow
- Inspector: Workload vulnerability scanning
- Security Hub: Aggregates and prioritizes all findings in one place
Event flow
- GuardDuty: threat findings from logs, DNS, flow
- Inspector: workload vulnerabilities
- Config Rules: compliance drift
- Security Hub: normalizes and prioritizes findings
- EventBridge Rules: routes by severity
- Auto-Remediation λ: isolates instances, revokes exposed keys
- Ticketing: files tracked issues for medium+
- On-call Pager: pages for critical