Financial-Services-Example/ARCHITECTURE_REPORT.json at main · Merlin-Studio/Financial-Services-Example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
{
  "_license": "Generated by Merlin Studio (https://app.merlin-studio.cloud). Licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0).",
  "data": [
    {
      "category": "IP Planning",
      "check": "Hub subnet sizing",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "Architecture uses dual Shared VPC pattern (one production VPC, one non-production VPC) with no inter-VPC peering. Hub-spoke subnet sizing check does not apply to this topology. Note: the FAST stage directory is named `hub-and-spokes-peerings` because that's FAST's stage naming convention; the actual configuration in this example is dual Shared VPC."
    },
    {
      "category": "IP Planning",
      "check": "CIDR overlap",
      "status": "PASS",
      "score_impact": 0,
      "weight": 20,
      "explanation": "No IP range overlap between VPC subnets and on-premises networks."
    },
    {
      "category": "IP Planning",
      "check": "GKE secondary ranges",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "Secondary IP ranges configured for GKE pod/service networking."
    },
    {
      "category": "Multi-Region",
      "check": "DR region configured",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "DR region configured: us-east4."
    },
    {
      "category": "Multi-Region",
      "check": "DR data sovereignty",
      "status": "PASS",
      "score_impact": 0,
      "weight": 20,
      "explanation": "Not a government org or multi-region not required; check not applicable."
    },
    {
      "category": "Multi-Region",
      "check": "DR subnet coverage",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "2 subnet(s) configured in DR region us-east4."
    },
    {
      "category": "GKE",
      "check": "Network refs valid",
      "status": "PASS",
      "score_impact": 0,
      "weight": 20,
      "explanation": "GKE network references match defined VPCs/subnets."
    },
    {
      "category": "GKE",
      "check": "Private cluster",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "All production GKE clusters use private cluster mode."
    },
    {
      "category": "Hybrid",
      "check": "Interconnect redundancy",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "1 Interconnect connection(s) with 'NONE' redundancy meets 99% availability target."
    },
    {
      "category": "Hybrid",
      "check": "VLAN region",
      "status": "PASS",
      "score_impact": 0,
      "weight": 5,
      "explanation": "All VLAN attachments have regions configured."
    },
    {
      "category": "Naming",
      "check": "Cross-section consistency",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "Cross-section resource name references are consistent."
    },
    {
      "category": "Identity",
      "check": "SA least privilege",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "All service accounts use purpose-specific predefined roles."
    },
    {
      "category": "Security",
      "check": "CMEK Encryption",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "CMEK enabled. Key rings will be auto-generated from workload services."
    },
    {
      "category": "Security",
      "check": "DLP Configuration",
      "status": "PASS",
      "score_impact": 0,
      "weight": 0,
      "explanation": "DLP check skipped \u2014 Advanced Security section not applicable for this profile/compliance."
    },
    {
      "category": "Security",
      "check": "Cloud Armor WAF",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "Cloud Armor enabled with 1 WAF policy(ies)."
    },
    {
      "category": "Identity",
      "check": "Service accounts",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "Custom service accounts defined."
    },
    {
      "category": "Hierarchy",
      "check": "Hierarchy type",
      "status": "PASS",
      "score_impact": 0,
      "weight": 20,
      "explanation": "Using team_based hierarchy."
    },
    {
      "category": "Security",
      "check": "Org policies",
      "status": "PASS",
      "score_impact": 0,
      "weight": 50,
      "explanation": "12 organization policies enforced."
    },
    {
      "category": "Logging",
      "check": "Log retention",
      "status": "PASS",
      "score_impact": 0,
      "weight": 5,
      "explanation": "Audit logging configured with adequate retention."
    }
  ]
}