Shared Responsibility Model
Security, Compliance and Operations is a shared responsibility between the platform team and the development teams.
This shared model can help relieve the developer's operational burden as the platform team takes over the responsibility for the basic infrastructure components, while the development teams assume responsibility and management on top of it.
See also the AWS Shared Responsibility Model for more background information.
The purpose of the document is to both inform teams on the available services and to ensure that no necessary activities fall through the gaps while maximizing team autonomy.
In most cases, a service responsibility model table is provided for each service. The "Component" column indicates the area of responsibility, the "Responsible" column indicates which team is ultimately responsible and the "Platform Support" indicates the teams that assist the responsible team.
PostgreSQL
PostgreSQL is provided as infrastructure self-service via our tf-mod-aws-aurora. The somebody team provides various services over and above a base PostgreSQL database, however there are still several components that application teams are responsible for.
| Component | Responsible | Platform Support |
|---|---|---|
| Query optimization | Team | |
| Index management | Team | |
| Schema management | Team | |
| Connection pooling | Team | Somebody |
| Recovery | Team | Somebody |
| User management | Team | Somebody |
| Backup verification | Team | |
| Backups | Somebody | |
| Auto-scaling db server | Team | Somebody |
| Major version updates | Team | Somebody |
| DB to K8s network connectivity | Somebody | |
| DB server | Somebody | |
| OS | Somebody |
Redis
Redis is provided as infrastructure self-service via our tf-mod-aws-redis.
| Component | Responsible | Platform Support |
|---|---|---|
| Redis to K8s network connectivity | Somebody | |
| OS | Somebody | |
| Major version upgrades | Team | Somebody |
| Core Redis cluster | Somebody | |
| Cluster scaling/sizing | Team | Somebody |
| Backup scheduling/restore | Team | Somebody |
Elasticsearch
Elasticsearch is provided as infrastructure self-service via our tf-mod-aws-elasticsearch.
| Component | Responsible | Platform Support |
|---|---|---|
| Maintaining Terraform Module | Somebody | |
| Network connectivity between EKS and Elasticsearch | Somebody | |
| Scaling / Sizing | Team | |
| Updating | Team | |
| Backup infrastructure | Somebody | |
| Backup scheduling | Team | |
| Backup restore | Team |
Kubernetes
The Somebody team provides a core Kubernetes cluster as a service. For more information see the Kubernetes section.
| Component | Responsible | Platform Support |
|---|---|---|
| App namespace user/RBAC management | Team | Somebody |
| Application K8s Namespaced Objects | Team | |
| Cluster backup/recovery (etcd) | Somebody | |
| Cluster wide user/RBAC management | Somebody | |
| Horizontal/vertical pod auto-scaling | Team | |
| Nodes (including auto-scaling) | Somebody | |
| OS | Somebody | |
| Somebody Provided Services | Somebody |
Kubernetes IAM Integration: IAM Roles for Service account (IRSA)
IRSA is used to specify AWS IAM permissions on a per pod basis.
| Component | Responsible | Platform Support |
|---|---|---|
| Attaching roles to pod's Service Account via annotations | Team | |
| Ensuring pods have minimal required IAM permissions | Team | |
| Defining IAM policies and roles for pod consumption | Team | |
| Platform Helm Chart Service Account to Pod binding | Somebody | |
| Setting up IRSA in the EKS Cluster | Somebody |
Image security
It is important that images are scanned and patched for security vulnerabilities to prevent exploits that could serve as an entry point for attackers.
| Component | Responsible | Platform Support |
|---|---|---|
| Application images | Team | Somebody |
| SB Provided Services | Somebody | |
| Kubernetes Nodes | Somebody |
Log Aggregation
Log aggregation is provided for Kubernetes clusters via an EFK (Elastic, Filebeat, Kibana) Stack service (Elastic-Stack).
| Component | Responsible | Platform Support |
|---|---|---|
| Index management | Team | |
| Kibana dashboards | Team | |
| User rights permissions | Team | |
| All other Filebeat configuration (e.g. processors) | Team | |
| Filebeat log shipping configuration | Somebody | |
| EFK upgrades | Somebody | |
| Filebeat agents | Somebody | |
| Elasticsearch/Kibana nodes | Somebody |
RBAC
The two key areas for authentication & authorization are AWS resources and Kubernetes resources. AWS IAM roles are used for both authentication and authorization for AWS resources. For Kubernetes resources, AWS IAM roles are used only for authentication and RBAC is used for authorization.
| Component | Responsible | Platform support |
|---|---|---|
| Revoking team members' permissions to AWS or Kubernetes resources | Team | Somebody |
| Granting team members' permissions to AWS or Kubernetes resources | Team | Somebody |
| Defining IAM policies and K8s roles | Team | Somebody |