data-sharing-project.d2

direction: right
gh: GitHub repository {
  icon: ./icons/github/logo.svg

  direction: left
  style: {
    stroke: "#000000"
    fill: "#ffffff"
  }

  pr: Pull Request {
    icon: ./icons/github/pull-request.svg
    shape: image
    width: 30
    height: 50
  }

  branch: Branch {
    icon: ./icons/github/branch.svg
    shape: image
    width: 30
    height: 50
  }

  merge: Merge {
    icon: ./icons/github/merge.svg
    shape: image
    width: 30
    height: 50
  }

  commit: Commit {
    icon: ./icons/github/commit.svg
    shape: image
    width: 30
    height: 50
  }

  branch -> commit
  commit -> pr: vulnerability scan
  pr -> merge: code review
  merge -> branch
}

internet: The Internet {
  icon: ./icons/gcp/my_cloud.svg
  shape: image
}

letsencrypt: "Let's Encrypt" {
  icon: ./icons/letsencrypt/logo.svg
  shape: image
}

gcp: "" {
  style: {
    stroke: "#000000"
    fill: "#f1f3f4"
  }

  gcpicon: "" {
    icon: ./icons/gcp/logo-text.svg
    width: 300
    shape: image
  }

  scc: Security Command Center {
    icon: ./icons/gcp/security_command_center.svg
    style: {
      stroke: "#808080"
      fill: "#ffffff"
    }
  }

  project: Data sharing Project {
    style: {
      stroke: "#ffffff"
      fill: "#e1f6fe"
    }

    vpc: Default VPC Network 10.1.0.0/16 {
      style: {
        stroke: blue
        font-color: blue
        stroke-dash: 3
        fill: transparent
      }

      fw: Firewall {
        style: {
          stroke: black
          font-color: black
          stroke-dash: 3
          fill: transparent
        }
        clouddns: Cloud DNS {
          icon: ./icons/gcp/cloud_dns.svg
          style: {
            stroke: "#808080"
            fill: "#ffffff"
          }
        }

        registry: Artifact Registry {
          icon: ./icons/gcp/artifact_registry.svg
          style: {
            stroke: "#808080"
            fill: "#ffffff"
          }
        }

        k8s: Google Managed PaaS/GKE Autopilot {
          style: {
            stroke: blue
            font-color: blue
            fill: transparent
          }

          ingress: Google Managed Ingress {
            icon: ./icons/kubernetes/pod.svg
            shape: image
          }

          certmanager: TLS Certificate Manager {
            icon: ./icons/certmanager/logo.svg
            shape: image
          }

          container: Low attack surface container {
            style: {
              stroke: black
              font-color: black
              fill: transparent
            }

            django: Django App {
              icon: ./icons/django/logo.svg
              shape: image
            }
          }

          pg: PostgreSQL Database Cluster {
            icon: ./icons/cloudnativepg/logo.svg
            shape: image
          }

          flux: GitOps operator {
            icon: ./icons/flux/logo.svg
            shape: image
          }

          ingress -> container: mtls
          container -> pg: mtls
        }
      }
    }
  }
}

internet -> gcp.project.vpc.fw.k8s.ingress: https
gcp.project.vpc.fw.k8s.flux -> gh: Pull based deployment via https
gcp.project.vpc.fw.k8s -> gcp.project.vpc.fw.registry: Pull images via https
letsencrypt <- gcp.project.vpc.fw.k8s.certmanager: ACME
gcp.project.vpc.fw.clouddns <-> gcp.project.vpc.fw.k8s.certmanager: Least privilege service account
gcp.project.vpc.fw.clouddns <- letsencrypt: ACME
gcp.project -> gcp.scc: All project logs/events visible in Security Command Center

explanation: |md
  # Data Sharing Project
  PHAC's core business is data aggregation and analysis.

  Data arrives in dangerous formats from untrusted sources increasingly targeted by ransomware gangs.

  Architectural choices can contain the spread of compromise just as vaccines contain the spread of disease. 

  - risk = likelihood * impact
    - Highly segmented architecture reduces impact/spread of compromise.
    - Technology selection and rapid updates reduces likelihood.
  - Continual security scanning at multiple levels to prompt updates.
    - Codesql source code scanning
    - Dependabot dependency scanning
    - Secrets scanning
    - Container security scanning
| {
  near: gcp
}