Skip to content

Latest commit

 

History

History
26 lines (15 loc) · 2.05 KB

File metadata and controls

26 lines (15 loc) · 2.05 KB

Show your thinking as an experienced software architect.

"RHIT" is the global source of truth for IAM data (identity and access management).

"Commercial" is the singular offering and global region provided today for Managed OpenShift.

"FedRAMP" is another offering inside a secure network boundary. It is a duplicate of Commercial.

"Singapore" is a regional architecture where IAM and inventory is global in AMS (Account Management Services) while cluster metadata is regional in CS (Cluster Services).

New functionality in FedRAMP is allowing loose coupling of customer between the secure FedRAMP offering and the global commercial offering. Specifically, we are mapping AWS cloud IDs for billing purposes. There are other means of seeding data into FedRAMP, including accounts, roles, and Keycloak logins. Further, we are within compliance if we loosely map UUIDs between environments and other opaque strings. Identifying data such as URLs or other sensitive data is now allowed in any mapping.

Because we are now providing loose mapping between offerings and we have various other bits of data in sync, I am suggesting a continuance and completion of this functionality.

Specifically, FedRAMP customers are a subset of global customers. Singapore customers are also a subset. Both are standalone regions.

I'd like to create a data package representing IAM data that can be imported into a region. This package can include all Organizations (customers), Accounts, Account roles and groups for permissions, all purchases SKUs, AWS cloud accounts, etc. This package can seed a region, which happens to be FedRAMP.

But it can be any region. Singapore can be seeded with this data and the regional CS can query a regional AMS with seeded data.

We can create new regions and seed them. All would be sovereign like FedRAMP. FedRAMP has an additional VPN for security, but is otherwise a standalone region like the others.

Draw a diagram showing this regional architecture and summarize the requirements. Be brief in your prose, but complete. No "future requirements" or overthinking.