{ "version": "certarail.production-network-secrets-design.v1", "title": "CertaRail production network and secrets security design", "status": "REQUIRES_ACTIVATION", "productionReady": false, "authority": "TARGET_PRODUCTION_DESIGN", "currentBoundary": "The current repository proves Local loopback networking, container hardening, selected server-side secret-safe boundaries and application cryptographic primitives. It does not prove Production TLS/mTLS, private cloud topology, approved CORS deployment, KMS/HSM or Vault custody, live rotation/revocation, emergency access or environment isolation. Production startup remains blocked.", "sourceContract": "This contract extends certarail.production-iam-design.v1 and certarail.environment-taxonomy.v1. Current Compose, .env examples and sandbox crypto/key derivation remain Local or sandbox mechanisms and must not be promoted as Production secret management.", "dependencies": { "iam": "certarail.production-iam-design.v1", "environmentTaxonomy": "certarail.environment-taxonomy.v1" }, "references": [ { "label": "TLS 1.3 · RFC 8446", "href": "https://www.rfc-editor.org/rfc/rfc8446.html" }, { "label": "Recommendations for Secure Use of TLS and DTLS · RFC 9325", "href": "https://www.rfc-editor.org/rfc/rfc9325.html" }, { "label": "OAuth 2.0 Mutual TLS · RFC 8705", "href": "https://www.rfc-editor.org/rfc/rfc8705.html" }, { "label": "WHATWG Fetch Standard · CORS protocol", "href": "https://fetch.spec.whatwg.org/#http-cors-protocol" }, { "label": "HTTP Strict Transport Security · RFC 6797", "href": "https://www.rfc-editor.org/rfc/rfc6797.html" }, { "label": "NIST SP 800-207 · Zero Trust Architecture", "href": "https://csrc.nist.gov/pubs/sp/800/207/final" }, { "label": "NIST SP 800-207A · Cloud-native Zero Trust", "href": "https://csrc.nist.gov/pubs/sp/800/207/a/final" }, { "label": "NIST SP 800-57 Part 1 Rev. 5 · Key Management", "href": "https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final" } ], "decisions": { "tls": { "defaultMinimumVersion": "TLS_1_3", "conditionalCompatibilityVersion": "TLS_1_2", "forbiddenVersions": [ "SSL_2_0", "SSL_3_0", "TLS_1_0", "TLS_1_1" ], "tls12Exception": { "approval": "SECURITY_EXCEPTION_REQUIRED", "scope": "ONE_NAMED_PROVIDER_OR_LEGACY_INTERFACE", "fallback": "PROHIBITED", "expiry": "TIME_BOUND_WITH_NAMED_OWNER_AND_MIGRATION_DATE", "ciphers": [ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" ] }, "zeroRtt": { "default": "DISABLED", "mutations": "PROHIBITED", "eligibility": "Only an explicitly profiled idempotent read may be considered after replay analysis and cluster-wide anti-replay evidence." }, "transportPlanes": [ { "id": "public-browser-edge", "exposure": "PUBLIC_APPROVED_HTTPS_EDGE_ONLY", "minimumVersion": "TLS_1_3", "encrypted": true, "peerAuthentication": "SERVER_CERTIFICATE", "identityCheck": "Exact SNI, hostname and approved certificate chain" }, { "id": "partner-service-api", "exposure": "APPROVED_INGRESS_GATEWAY", "minimumVersion": "TLS_1_3", "encrypted": true, "peerAuthentication": "MTLS", "identityCheck": "Exact registered client certificate plus certificate-bound OAuth audience" }, { "id": "internal-service", "exposure": "PRIVATE_NETWORK_ONLY", "minimumVersion": "TLS_1_3", "encrypted": true, "peerAuthentication": "MTLS", "identityCheck": "Environment-scoped workload identity and exact destination service identity" }, { "id": "administration-control-plane", "exposure": "DEDICATED_PRIVATE_MANAGEMENT_PLANE", "minimumVersion": "TLS_1_3", "encrypted": true, "peerAuthentication": "MTLS", "identityCheck": "Managed-device operator identity, JIT grant and exact administrative endpoint" }, { "id": "managed-data-service", "exposure": "PRIVATE_ENDPOINT_ONLY", "minimumVersion": "TLS_1_3", "encrypted": true, "peerAuthentication": "MTLS", "identityCheck": "Workload identity, pinned service endpoint and database/broker authorization" } ], "certificatePolicy": { "source": "APPROVED_ENVIRONMENT_SCOPED_CA_OR_MANAGED_CERTIFICATE_SERVICE", "privateKeys": "NON_EXPORTABLE_KMS_HSM_OR_WORKLOAD_LOCAL", "inventory": "Owner, service, environment, SANs, issuer, serial, key ID, not-before, expiry, renewal state and revocation state.", "renewal": "Automated before expiry with old/new validation, rollback, expiry alerts and forced replacement after compromise.", "hsts": "PUBLIC_HTTPS_EDGE_AFTER_DOMAIN_AND_SUBDOMAIN_READINESS" } }, "privateNetworking": { "defaultIngress": "DENY", "defaultEgress": "DENY", "noImplicitTrustFromNetworkLocation": true, "publicIngress": [ "APPROVED_HTTPS_EDGE", "APPROVED_PARTNER_MTLS_GATEWAY" ], "dataServices": [ { "id": "POSTGRESQL", "publicAddress": false, "access": "PRIVATE_ENDPOINT_ONLY" }, { "id": "KAFKA", "publicAddress": false, "access": "PRIVATE_ENDPOINT_ONLY" }, { "id": "REDIS_OR_VALKEY", "publicAddress": false, "access": "PRIVATE_ENDPOINT_ONLY" }, { "id": "VAULT_OR_SECRET_MANAGER", "publicAddress": false, "access": "PRIVATE_ENDPOINT_ONLY" }, { "id": "KMS_OR_HSM", "publicAddress": false, "access": "PRIVATE_ENDPOINT_ONLY" }, { "id": "OBJECT_AND_BACKUP_STORAGE", "publicAddress": false, "access": "PRIVATE_ENDPOINT_ONLY" }, { "id": "AUDIT_AND_OBSERVABILITY_CONTROL_PLANE", "publicAddress": false, "access": "PRIVATE_ENDPOINT_ONLY" }, { "id": "ADMINISTRATION_API", "publicAddress": false, "access": "PRIVATE_ENDPOINT_ONLY" } ], "allowedFlows": [ { "sourceIdentity": "approved-edge-gateway", "destinationIdentity": "control-plane-api", "port": "TCP/8443", "purpose": "Validated public and partner API ingress" }, { "sourceIdentity": "control-plane-api", "destinationIdentity": "postgresql-runtime", "port": "TCP/5432", "purpose": "Tenant-bound transactional state" }, { "sourceIdentity": "outbox-publisher", "destinationIdentity": "kafka-broker", "port": "TCP/9093", "purpose": "mTLS/SASL outbox publication" }, { "sourceIdentity": "approved-runtime-workload", "destinationIdentity": "vault-or-secret-manager", "port": "TCP/443", "purpose": "Identity-bound secret lease retrieval" }, { "sourceIdentity": "approved-crypto-workload", "destinationIdentity": "kms-private-endpoint", "port": "TCP/443", "purpose": "Purpose-bound encrypt, decrypt, sign or verify operation" }, { "sourceIdentity": "webhook-delivery-worker", "destinationIdentity": "approved-partner-endpoint", "port": "TCP/443", "purpose": "Allowlisted signed webhook delivery" } ], "egress": { "path": "IDENTITY_AWARE_EGRESS_PROXY_OR_CONTROLLED_NAT", "destinations": "EXACT_SCHEME_HOST_PORT_AND_PROVIDER_PROFILE_ALLOWLIST", "redirects": "DENY", "dnsRebindingDefence": "REQUIRED", "resolution": "Resolve and validate all address records before connect; reject private, loopback, link-local, metadata and newly disallowed ranges; pin the validated destination for the connection." }, "managementPlane": { "path": "SEPARATE_PRIVATE_ACCESS_PLANE", "access": "MANAGED_DEVICE_PLUS_JIT_IDENTITY", "sharedWithPublicIngress": false, "emergencyPath": "ISOLATED_AND_DISABLED_UNTIL_BREAK_GLASS_APPROVAL" }, "segmentation": "Separate environment account/project and network, workload-level network policy, private DNS and private managed-service endpoints; peering and transitive routing are denied by default." }, "cors": { "default": "DISABLED", "policyOwner": "SERVER_SIDE_CONFIGURATION", "exactOriginAllowlist": true, "reflectRequestOrigin": false, "wildcardWithCredentials": false, "acceptNullOrigin": false, "varyOrigin": true, "preflightMaxAgeSeconds": 600, "serviceApis": "NO_CORS_HEADERS", "isAuthorizationControl": false, "csrfProtectionSeparate": true, "profiles": [ { "id": "tenant-web-bff", "origins": "Exact tenant web origins registered for one environment", "credentials": "Secure HttpOnly host-only SameSite session cookie", "methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS as required per route", "headers": "Content-Type, Idempotency-Key, X-CSRF-Token and exact documented request headers" }, { "id": "hosted-checkout", "origins": "Same-origin hosted checkout only", "credentials": "Secure HttpOnly checkout session cookie", "methods": "GET, POST, OPTIONS for exact checkout routes", "headers": "Content-Type, Idempotency-Key and X-CSRF-Token" }, { "id": "embedded-checkout", "origins": "Exact origin registered in the server-issued embed session", "credentials": "No ambient cookie; origin-bound memory-only header token", "methods": "GET, POST, OPTIONS for exact embedded routes", "headers": "Content-Type, Idempotency-Key and checkout session header" }, { "id": "partner-and-internal-apis", "origins": "None", "credentials": "mTLS/OAuth service identity outside browser CORS", "methods": "No CORS profile", "headers": "No Access-Control-Allow-* headers" } ], "responseRules": [ "Parse and canonicalize the Origin header, compare it to an exact environment-scoped allowlist and emit the matched canonical origin only.", "Emit Vary: Origin whenever a response can vary by Origin; preflight cache policy must vary by origin, method and requested headers.", "Reject malformed, multiple, opaque/null, HTTP or unregistered origins before handler execution.", "Allow-Credentials is emitted only for an approved cookie-based BFF/hosted profile and never with a wildcard origin.", "CORS does not replace session authentication, authorization, CSRF token plus Fetch Metadata validation, CSP frame-ancestors or postMessage origin checks." ] }, "kms": { "provider": "BANK_APPROVED_KMS_OR_HSM_SELECTED_AT_ACTIVATION", "moduleBoundary": "NON_EXPORTABLE_HSM_BACKED_OR_BANK_APPROVED_EQUIVALENT", "rootKeyReuseAcrossEnvironments": false, "keyFamilies": [ { "id": "DATA_ENVELOPE_KEK", "purpose": "Wrap tenant- and object-scoped data encryption keys", "nonExportable": true, "environmentBound": true, "tenantBinding": "AAD_AND_KEY_POLICY" }, { "id": "SECRET_WRAPPING_KEK", "purpose": "Wrap persisted application secret material", "nonExportable": true, "environmentBound": true, "tenantBinding": "NAMESPACE_AND_AAD_WHERE_TENANT_SCOPED" }, { "id": "APPLICATION_SIGNING_KEY", "purpose": "Sign bounded application artifacts and assertions", "nonExportable": true, "environmentBound": true, "tenantBinding": "SEPARATE_KEY_OR_EXACT_SIGNING_CONTEXT" }, { "id": "WEBHOOK_ROOT_KEY", "purpose": "Derive or wrap tenant endpoint signing keys", "nonExportable": true, "environmentBound": true, "tenantBinding": "TENANT_ENDPOINT_AND_KEY_GENERATION_CONTEXT" }, { "id": "EVIDENCE_INTEGRITY_KEY", "purpose": "Sign evidence manifests and immutable export roots", "nonExportable": true, "environmentBound": true, "tenantBinding": "MANIFEST_CONTEXT_AND_TENANT_SCOPE" }, { "id": "BACKUP_RECOVERY_KEK", "purpose": "Wrap environment backup data keys", "nonExportable": true, "environmentBound": true, "tenantBinding": "BACKUP_SET_AND_ENVIRONMENT_CONTEXT" } ], "envelopeEncryption": { "dataKey": "RANDOM_PER_OBJECT_OR_BOUNDED_DATASET", "plaintextDataKeyPersistence": "PROHIBITED", "aad": "tenant_id + environment + purpose + object_type + object_id + schema_version + key_version", "ciphertextMetadata": "Algorithm, KMS key ID/version, encrypted data key, nonce, AAD schema version and ciphertext digest; never plaintext key material." }, "roleSeparation": [ { "role": "KEY_POLICY_ADMIN", "may": "Define reviewed key policy and aliases", "mayNot": "Encrypt, decrypt, sign, export or self-approve deletion" }, { "role": "CRYPTO_USER", "may": "Invoke exact encrypt/decrypt/sign operation for an approved workload", "mayNot": "Change key policy, schedule deletion or export key material" }, { "role": "KEY_CUSTODIAN", "may": "Perform dual-control recovery, rotation and destruction ceremony", "mayNot": "Read application plaintext or approve own request" }, { "role": "AUDITOR", "may": "Read metadata, policy and immutable operation evidence", "mayNot": "Use cryptographic operations or mutate policy" } ], "lifecycle": { "create": "Dual-controlled policy and purpose registration before use", "disable": "Maker-checker change with impact analysis, canary denial and rollback window", "delete": "Delayed destruction only after retention, backup, legal-hold and dependency evidence; cancellation remains possible during the delay", "backup": "Only where the key class permits recovery; encrypted, access-separated and restoration-tested" } }, "vault": { "provider": "BANK_APPROVED_SECRET_MANAGER_SELECTED_AT_ACTIVATION", "sourceOfTruth": true, "authentication": "ENVIRONMENT_SCOPED_WORKLOAD_IDENTITY_ONLY", "staticCredentialsDefault": "PROHIBITED", "dynamicLeasesPreferred": true, "delivery": "Agent, sidecar or native workload-identity integration writes a bounded memory/tmpfs lease; applications never receive a reusable Vault root token.", "cache": "Memory only, least lifetime, zeroized on replacement or shutdown; no fallback to stale material after revocation or lease expiry.", "forbiddenLocations": [ "SOURCE_CONTROL", "IMAGE_LAYER", "BROWSER_STORAGE", "URL", "CI_LOG", "APPLICATION_LOG", "EVIDENCE_PAYLOAD", "ANALYTICS", "TICKET_OR_CHAT", "UNENCRYPTED_ENV_FILE" ], "inventoryFields": [ "owner", "purpose", "environment", "tenant_scope", "consumer_identities", "version", "created_at", "expires_at", "last_used_at", "rotation_state", "revocation_state", "incident_reference" ], "namespaces": [ "One namespace or mount per canonical environment", "Separate application, platform, integration and emergency policy domains", "Tenant-specific path and policy where a secret grants tenant authority", "No wildcard read/list capability across tenants or environments" ], "audit": "Record identity, secret metadata reference, version, operation, policy result and time; never record secret value or derived credential." }, "secretRotation": { "transitions": [ "PREPARED", "DISTRIBUTED", "DUAL_READ_VERIFY", "PRIMARY", "RETIRED", "REVOKED" ], "compromiseSlaMinutes": 15, "policies": [ { "id": "WORKLOAD_X509_SVID", "maxLifetimeSeconds": 3600, "plannedOverlapSeconds": 600, "rule": "Stream and rotate automatically; workload-local private key is never exported." }, { "id": "ACCESS_TOKEN", "maxLifetimeSeconds": 300, "plannedOverlapSeconds": 0, "rule": "Issue from current authority only; no token extension." }, { "id": "PRIVILEGED_ACCESS_TOKEN", "maxLifetimeSeconds": 180, "plannedOverlapSeconds": 0, "rule": "Fresh step-up and live PDP check; no refresh token." }, { "id": "DATABASE_DYNAMIC_CREDENTIAL", "maxLifetimeSeconds": 3600, "plannedOverlapSeconds": 300, "rule": "Issue a role-scoped lease and revoke it automatically on expiry." }, { "id": "PROVIDER_API_CREDENTIAL", "maxLifetimeSeconds": 7776000, "plannedOverlapSeconds": 86400, "rule": "Rotate sooner when provider policy allows; current/next validation and negative old-key test are mandatory." }, { "id": "WEBHOOK_SIGNING_KEY", "maxLifetimeSeconds": 7776000, "plannedOverlapSeconds": 604800, "rule": "Publish key ID, verify current/previous generations during the bounded overlap and reject unknown or retired key IDs." }, { "id": "KMS_WRAPPING_KEY", "maxLifetimeSeconds": 31536000, "plannedOverlapSeconds": 2592000, "rule": "Rotate the key version; rewrap data keys asynchronously and retain the old version only for verified decrypt dependencies." }, { "id": "PUBLIC_EDGE_CERTIFICATE", "maxLifetimeSeconds": 2592000, "plannedOverlapSeconds": 604800, "rule": "Automated renewal, external expiry monitoring and rollback-tested deployment." } ], "mandatoryTriggers": [ "Known or suspected disclosure, unauthorized use or unexplained authentication", "Owner, custodian, consumer identity, tenant or environment boundary change", "Algorithm, provider, trust anchor or policy change", "Failed integrity check, inventory mismatch, expired attestation or overdue scheduled rotation", "Break-glass use affecting the credential or its trust path" ], "evidence": [ "Change/incident ID, owner, maker and checker", "Old/new metadata fingerprints and affected consumers", "Distribution acknowledgements and current/next validation results", "Cutover time, negative old-key test, revocation propagation and rollback result" ] }, "keyOwnership": [ { "id": "TENANT_CUSTODY_PRIVATE_KEYS", "owner": "EXTERNAL_REGULATED_CUSTODIAN", "custodian": "External custodian HSM and named key officers", "approver": "Tenant custody/security authority under dual control", "consumers": "Custodian signing service only", "certaRailAccess": "PROHIBITED" }, { "id": "TENANT_IDP_AND_PARTNER_CLIENT_KEYS", "owner": "DEPLOYING_BANK_OR_TENANT_IAM_OWNER", "custodian": "Tenant-managed HSM/KMS", "approver": "Tenant IAM owner plus Security checker", "consumers": "Registered IdP, confidential clients and verifier trust store", "certaRailAccess": "PUBLIC_METADATA_OR_EXACT_CRYPTO_OPERATION_ONLY" }, { "id": "TLS_EDGE_AND_SERVICE_CERTIFICATE_KEYS", "owner": "DEPLOYING_BANK_PLATFORM_SECURITY", "custodian": "Environment CA, managed certificate service or workload", "approver": "Platform Security plus service owner", "consumers": "Exact edge or workload identity", "certaRailAccess": "NON_EXPORTABLE_OPERATION_ONLY" }, { "id": "KMS_KEY_HIERARCHY", "owner": "DEPLOYING_BANK_SECURITY", "custodian": "Bank-approved KMS/HSM and independent custodians", "approver": "Key-policy maker and independent checker", "consumers": "Purpose-bound workload identities", "certaRailAccess": "NO_ROOT_OR_EXPORT_ACCESS" }, { "id": "VAULT_ROOT_RECOVERY_AND_UNSEAL", "owner": "DEPLOYING_BANK_SECURITY", "custodian": "Independent sealed recovery custodians or managed service", "approver": "Incident commander plus Security checker", "consumers": "Break-glass recovery ceremony only", "certaRailAccess": "NO_STANDING_ACCESS" }, { "id": "WEBHOOK_ENDPOINT_SIGNING_KEYS", "owner": "TENANT_INTEGRATION_OWNER", "custodian": "CertaRail production secret manager; receiver stores one-time delivered copy", "approver": "Tenant integration maker and independent checker", "consumers": "Named delivery worker and registered receiver endpoint", "certaRailAccess": "PURPOSE_BOUND_SIGN_OPERATION_ONLY" }, { "id": "EVIDENCE_AND_BACKUP_KEYS", "owner": "DEPLOYING_BANK_SECURITY_AND_RECORDS_OWNER", "custodian": "Separated KMS/HSM recovery domain", "approver": "Security plus Records/Recovery checker", "consumers": "Evidence signer or recovery workflow only", "certaRailAccess": "PURPOSE_BOUND_OPERATION_ONLY" } ], "credentialRevocation": [ { "id": "HUMAN_SESSION_AND_REFRESH_FAMILY", "action": "Disable membership/JIT grant, revoke the refresh family and terminate active BFF sessions; reuse revokes the entire family.", "propagationSlaMinutes": 5, "evidence": [ "Credential/key metadata reference and reason without secret material", "Requester, maker/checker or incident authority and timestamps", "Authoritative disable/revoke result plus propagation observations", "Negative authentication/use test, affected-resource reconciliation and replacement link" ] }, { "id": "ACCESS_TOKEN", "action": "Deny high-risk token IDs at the PDP and rely on short expiry; every privileged request performs a live entitlement/revocation check.", "propagationSlaMinutes": 5, "evidence": [ "Credential/key metadata reference and reason without secret material", "Requester, maker/checker or incident authority and timestamps", "Authoritative disable/revoke result plus propagation observations", "Negative authentication/use test, affected-resource reconciliation and replacement link" ] }, { "id": "WORKLOAD_CERTIFICATE", "action": "Stop issuance for the attested identity, remove trust/authorization and replace the SVID; short validity bounds residual exposure.", "propagationSlaMinutes": 5, "evidence": [ "Credential/key metadata reference and reason without secret material", "Requester, maker/checker or incident authority and timestamps", "Authoritative disable/revoke result plus propagation observations", "Negative authentication/use test, affected-resource reconciliation and replacement link" ] }, { "id": "SERVICE_CLIENT", "action": "Disable the exact tenant/environment client, revoke active grants and rotate its asymmetric key/certificate.", "propagationSlaMinutes": 5, "evidence": [ "Credential/key metadata reference and reason without secret material", "Requester, maker/checker or incident authority and timestamps", "Authoritative disable/revoke result plus propagation observations", "Negative authentication/use test, affected-resource reconciliation and replacement link" ] }, { "id": "DATABASE_LEASE", "action": "Revoke the dynamic lease/role sessions, terminate affected connections and issue a replacement only after workload re-attestation.", "propagationSlaMinutes": 5, "evidence": [ "Credential/key metadata reference and reason without secret material", "Requester, maker/checker or incident authority and timestamps", "Authoritative disable/revoke result plus propagation observations", "Negative authentication/use test, affected-resource reconciliation and replacement link" ] }, { "id": "PROVIDER_CREDENTIAL", "action": "Disable/detach at the provider, block local use, reconcile commands during the uncertainty window and activate a separately prepared version.", "propagationSlaMinutes": 5, "evidence": [ "Credential/key metadata reference and reason without secret material", "Requester, maker/checker or incident authority and timestamps", "Authoritative disable/revoke result plus propagation observations", "Negative authentication/use test, affected-resource reconciliation and replacement link" ] }, { "id": "WEBHOOK_SIGNING_KEY", "action": "Mark the key ID revoked, stop signing, reject it at verification, issue a new generation and reconcile delivery attempts in the overlap.", "propagationSlaMinutes": 5, "evidence": [ "Credential/key metadata reference and reason without secret material", "Requester, maker/checker or incident authority and timestamps", "Authoritative disable/revoke result plus propagation observations", "Negative authentication/use test, affected-resource reconciliation and replacement link" ] }, { "id": "KMS_KEY", "action": "Deny new cryptographic use, isolate affected consumers and rewrap/re-sign with a replacement version; destruction waits for governed evidence.", "propagationSlaMinutes": 5, "evidence": [ "Credential/key metadata reference and reason without secret material", "Requester, maker/checker or incident authority and timestamps", "Authoritative disable/revoke result plus propagation observations", "Negative authentication/use test, affected-resource reconciliation and replacement link" ] } ], "breakGlass": { "iamOperation": "BREAK_GLASS_SESSION", "approval": "TWO_DISTINCT_PRINCIPALS", "selfApproval": "PROHIBITED", "custodians": 2, "maxSessionMinutes": 15, "standingAccess": "PROHIBITED", "authentication": "Two named custodians with separate non-exportable hardware authenticators in the isolated emergency realm.", "networkPath": "Dedicated private emergency path, disabled in normal operation and unable to traverse public ingress.", "secretAccess": "Exact sealed secret/key metadata and command allowlist for the declared incident; no list-all, export or root-token delivery.", "rotateAffectedCredentialsAfterUse": true, "prohibitedBypass": [ "Tenant custody/private-key boundary", "Maker-checker for asset or money movement", "Evidence integrity, retention or legal hold", "Production activation gates", "Bulk tenant data or secret export" ], "evidence": [ "Incident declaration, reason, impact and alternative-path failure", "Both custodian identities, hardware-auth events and issued/expiry time", "Complete approved command/session record and accessed resource metadata", "Automatic expiry, affected-credential rotation and next-business-day independent review" ] }, "environmentSeparation": { "environmentClasses": [ "DEMO", "LOCAL", "HOSTED_SANDBOX", "PROVIDER_SANDBOX", "PRODUCTION" ], "isolationDimensions": [ "CLOUD_ACCOUNT_OR_PROJECT", "NETWORK_AND_PRIVATE_DNS", "PKI_TRUST_DOMAIN", "KMS_KEY_HIERARCHY", "VAULT_NAMESPACE_OR_MOUNT", "IDP_CLIENT_ISSUER_AND_AUDIENCE", "DATA_STORES_QUEUES_CACHES_AND_TOPICS", "LOGS_AUDIT_AND_BACKUPS" ], "productionDataToLowerEnvironments": "PROHIBITED", "productionSecretsToLowerEnvironments": "PROHIBITED", "lowerEnvironmentData": "Synthetic or irreversibly sanitized, explicitly approved fixtures only.", "crossEnvironmentTrust": "DENY_BY_DEFAULT", "artifactPromotion": "IMMUTABLE_DIGEST_AND_PROVENANCE", "configurationPromotion": "Prohibited: each environment re-binds identity, endpoints, keys, secrets and policies from its own approved control plane.", "telemetry": "Only explicitly approved one-way metadata/aggregate export; no credential, restricted payload or control-plane trust is inherited." }, "activationGates": [ { "id": "NETWORK_TLS_PROFILE_ACCEPTED", "owner": "Platform Security", "status": "OPEN", "evidence": "External and internal scans, certificate inventory/renewal drill, mTLS identity denial and TLS 1.0/1.1/unsafe cipher/0-RTT negative results." }, { "id": "NETWORK_PRIVATE_TOPOLOGY_ENFORCED", "owner": "Cloud Security", "status": "OPEN", "evidence": "Approved topology, no-public-IP proof, identity-and-port flow matrix, egress/SSRF tests and denied lateral/transitive paths." }, { "id": "NETWORK_CORS_AND_CSRF_NEGATIVE_SUITE_PASSED", "owner": "Application Security", "status": "OPEN", "evidence": "Exact-origin matrix with wildcard, reflection, null/malformed/multiple origin, preflight cache, CSRF and postMessage denial tests." }, { "id": "SECRETS_KMS_AND_VAULT_INTEGRATED", "owner": "Platform Security", "status": "OPEN", "evidence": "Named bank-approved providers, key/secret inventory, non-exportability and role separation tests, envelope round trip and denied wildcard access." }, { "id": "SECRETS_ROTATION_AND_REVOCATION_DRILLED", "owner": "Security Operations", "status": "OPEN", "evidence": "Planned and compromise rotations for every class, current/next cutover, rollback, five-minute revocation observations and negative old-key tests." }, { "id": "SECRETS_BREAK_GLASS_DRILLED", "owner": "Incident Response", "status": "OPEN", "evidence": "Two-custodian 15-minute exercise, command/session record, denied prohibited bypass, automatic expiry, credential replacement and review." }, { "id": "NETWORK_ENVIRONMENT_ISOLATION_PROVEN", "owner": "Security Engineering", "status": "OPEN", "evidence": "Cross-environment network, PKI, KMS, vault, audience, data, queue, log and backup denial suite plus immutable artifact promotion proof." }, { "id": "NETWORK_SECRETS_SECURITY_ACCEPTANCE_COMPLETE", "owner": "CISO delegate", "status": "OPEN", "evidence": "Updated threat model, external penetration test, recovery exercise, residual-risk acceptance and signed production activation record." } ] }, "sections": [ { "id": "network-secrets-current-boundary", "title": "Текущая граница реализации", "lead": "A22.2 фиксирует target Production contract. Текущий Compose остаётся loopback-only Local runtime: Nginx слушает HTTP, PostgreSQL/Kafka/Redis используют local-only development credentials and/or plaintext transports, а production KMS, Vault, private endpoints и emergency control plane не подключены.", "table": { "caption": "Design versus current runtime evidence", "columns": [ "Контур", "Текущий факт", "Статус A22.2" ], "rows": [ [ "Local Compose network", "Loopback host ports, internal Docker networks and hardening controls", "Не является Production private-network proof" ], [ "TLS/mTLS", "Local Nginx-to-Go and stateful services do not implement this Production TLS profile", "Target design defined · activation open" ], [ "Secrets/KMS", "Local environment configuration and application crypto seams exist without approved Production Vault/KMS/HSM custody", "Target design defined · activation open" ], [ "Rotation/revocation", "Selected sandbox credentials have bounded or one-time semantics", "No end-to-end Production drill or SLA evidence" ], [ "Environment separation", "Canonical five-class taxonomy is published", "Production account/network/key/data isolation remains unproven" ] ] }, "callout": { "tone": "critical", "title": "DESIGN ONLY · Production security остаётся закрытой", "description": "Этот contract не создаёт сеть, certificate, key, secret, provider account или emergency credential. Все activation gates остаются OPEN, а production startup нельзя разрешать по факту публикации документа." } }, { "id": "production-tls", "title": "TLS и peer authentication", "lead": "TLS 1.3 является default minimum для всех Production planes. TLS 1.2 допускается только как отдельное time-bound compatibility exception для одного named interface; downgrade fallback отсутствует.", "table": { "caption": "Production transport profiles", "columns": [ "Plane", "Exposure", "Minimum", "Peer authentication", "Identity check" ], "rows": [ [ "public-browser-edge", "PUBLIC_APPROVED_HTTPS_EDGE_ONLY", "TLS_1_3", "SERVER_CERTIFICATE", "Exact SNI, hostname and approved certificate chain" ], [ "partner-service-api", "APPROVED_INGRESS_GATEWAY", "TLS_1_3", "MTLS", "Exact registered client certificate plus certificate-bound OAuth audience" ], [ "internal-service", "PRIVATE_NETWORK_ONLY", "TLS_1_3", "MTLS", "Environment-scoped workload identity and exact destination service identity" ], [ "administration-control-plane", "DEDICATED_PRIVATE_MANAGEMENT_PLANE", "TLS_1_3", "MTLS", "Managed-device operator identity, JIT grant and exact administrative endpoint" ], [ "managed-data-service", "PRIVATE_ENDPOINT_ONLY", "TLS_1_3", "MTLS", "Workload identity, pinned service endpoint and database/broker authorization" ] ] }, "bullets": [ "Запрещены SSL_2_0, SSL_3_0, TLS_1_0, TLS_1_1, NULL/RC4/CBC/static-RSA suites, compression, insecure renegotiation и silent downgrade.", "TLS 1.2 exception разрешает только TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 и имеет owner, expiry, migration date и negative downgrade evidence.", "0-RTT выключен по умолчанию и запрещён для create/approve/confirm/replay/rotate/revoke/delete/export и любых команд с side effect.", "Certificate inventory, automated renewal, expiry alerting, revocation and old/new validation являются частью acceptance evidence." ] }, { "id": "production-private-networking", "title": "Private networking и egress", "lead": "Public reachability заканчивается на approved HTTPS/mTLS gateways. Data, secret, cryptographic, administration и observability control planes не имеют public address; каждый flow задаётся source identity, destination identity, port и purpose.", "table": { "caption": "Exact allowed service flows", "columns": [ "Source identity", "Destination identity", "Port", "Purpose" ], "rows": [ [ "approved-edge-gateway", "control-plane-api", "TCP/8443", "Validated public and partner API ingress" ], [ "control-plane-api", "postgresql-runtime", "TCP/5432", "Tenant-bound transactional state" ], [ "outbox-publisher", "kafka-broker", "TCP/9093", "mTLS/SASL outbox publication" ], [ "approved-runtime-workload", "vault-or-secret-manager", "TCP/443", "Identity-bound secret lease retrieval" ], [ "approved-crypto-workload", "kms-private-endpoint", "TCP/443", "Purpose-bound encrypt, decrypt, sign or verify operation" ], [ "webhook-delivery-worker", "approved-partner-endpoint", "TCP/443", "Allowlisted signed webhook delivery" ] ] }, "bullets": [ "Ingress default: DENY; egress default: DENY. Unknown identity, destination, port, DNS answer or purpose is denied.", "Private connectivity does not authorize a principal: mTLS/workload identity, OAuth audience, current PDP policy and application tenant binding remain mandatory.", "IDENTITY_AWARE_EGRESS_PROXY_OR_CONTROLLED_NAT; EXACT_SCHEME_HOST_PORT_AND_PROVIDER_PROFILE_ALLOWLIST; redirects are denied and DNS/IP rebinding defences are required.", "Management and emergency planes are isolated from public ingress; peering, transitive routing and cross-environment trust are denied by default." ] }, { "id": "production-cors", "title": "CORS, CSRF и browser origins", "lead": "CORS отключён по умолчанию. Browser-enabled routes use an exact server-owned HTTPS origin allowlist per surface and environment; partner/internal service APIs do not emit CORS headers.", "table": { "caption": "Browser origin profiles", "columns": [ "Profile", "Allowed origins", "Credentials", "Methods", "Headers" ], "rows": [ [ "tenant-web-bff", "Exact tenant web origins registered for one environment", "Secure HttpOnly host-only SameSite session cookie", "GET, POST, PUT, PATCH, DELETE, OPTIONS as required per route", "Content-Type, Idempotency-Key, X-CSRF-Token and exact documented request headers" ], [ "hosted-checkout", "Same-origin hosted checkout only", "Secure HttpOnly checkout session cookie", "GET, POST, OPTIONS for exact checkout routes", "Content-Type, Idempotency-Key and X-CSRF-Token" ], [ "embedded-checkout", "Exact origin registered in the server-issued embed session", "No ambient cookie; origin-bound memory-only header token", "GET, POST, OPTIONS for exact embedded routes", "Content-Type, Idempotency-Key and checkout session header" ], [ "partner-and-internal-apis", "None", "mTLS/OAuth service identity outside browser CORS", "No CORS profile", "No Access-Control-Allow-* headers" ] ] }, "bullets": [ "Parse and canonicalize the Origin header, compare it to an exact environment-scoped allowlist and emit the matched canonical origin only.", "Emit Vary: Origin whenever a response can vary by Origin; preflight cache policy must vary by origin, method and requested headers.", "Reject malformed, multiple, opaque/null, HTTP or unregistered origins before handler execution.", "Allow-Credentials is emitted only for an approved cookie-based BFF/hosted profile and never with a wildcard origin.", "CORS does not replace session authentication, authorization, CSRF token plus Fetch Metadata validation, CSP frame-ancestors or postMessage origin checks." ], "callout": { "tone": "warning", "title": "CORS не является access control", "description": "Non-browser clients ignore CORS. Server authentication, authorization, CSRF defence, exact frame-ancestors, origin-bound sessions and postMessage checks остаются самостоятельными controls." } }, { "id": "production-kms", "title": "KMS/HSM и envelope encryption", "lead": "Каждый canonical environment получает отдельную key hierarchy. Private keys and KEKs are non-exportable; workloads invoke only a purpose-bound cryptographic operation over a private endpoint.", "table": { "caption": "Production key families", "columns": [ "Key family", "Purpose", "Environment", "Tenant binding" ], "rows": [ [ "DATA_ENVELOPE_KEK", "Wrap tenant- and object-scoped data encryption keys", "Dedicated", "AAD_AND_KEY_POLICY" ], [ "SECRET_WRAPPING_KEK", "Wrap persisted application secret material", "Dedicated", "NAMESPACE_AND_AAD_WHERE_TENANT_SCOPED" ], [ "APPLICATION_SIGNING_KEY", "Sign bounded application artifacts and assertions", "Dedicated", "SEPARATE_KEY_OR_EXACT_SIGNING_CONTEXT" ], [ "WEBHOOK_ROOT_KEY", "Derive or wrap tenant endpoint signing keys", "Dedicated", "TENANT_ENDPOINT_AND_KEY_GENERATION_CONTEXT" ], [ "EVIDENCE_INTEGRITY_KEY", "Sign evidence manifests and immutable export roots", "Dedicated", "MANIFEST_CONTEXT_AND_TENANT_SCOPE" ], [ "BACKUP_RECOVERY_KEK", "Wrap environment backup data keys", "Dedicated", "BACKUP_SET_AND_ENVIRONMENT_CONTEXT" ] ] }, "bullets": [ "Envelope AAD binds tenant_id + environment + purpose + object_type + object_id + schema_version + key_version. Plaintext data keys are never persisted.", "Key-policy administrator, crypto user, custodian and auditor are distinct; no principal may create policy, use a key and approve destructive lifecycle changes alone.", "Disable/delete is maker-checker, impact-tested and delayed. Legal hold, backup/recovery and decrypt dependencies block destruction.", "KMS logs record metadata and result only; plaintext, private key, data key, bearer and restricted payload are prohibited." ] }, { "id": "production-vault", "title": "Vault / secret manager", "lead": "A bank-approved secret manager is the Production source of truth. Workloads authenticate with environment-scoped identity, receive the narrowest dynamic lease and never receive a reusable root credential.", "table": { "caption": "Mandatory secret metadata", "columns": [ "Fields", "Delivery", "Cache", "Audit" ], "rows": [ [ "owner, purpose, environment, tenant_scope, consumer_identities, version, created_at, expires_at, last_used_at, rotation_state, revocation_state, incident_reference", "Agent, sidecar or native workload-identity integration writes a bounded memory/tmpfs lease; applications never receive a reusable Vault root token.", "Memory only, least lifetime, zeroized on replacement or shutdown; no fallback to stale material after revocation or lease expiry.", "Record identity, secret metadata reference, version, operation, policy result and time; never record secret value or derived credential." ] ] }, "bullets": [ "Forbidden locations: SOURCE_CONTROL, IMAGE_LAYER, BROWSER_STORAGE, URL, CI_LOG, APPLICATION_LOG, EVIDENCE_PAYLOAD, ANALYTICS, TICKET_OR_CHAT, UNENCRYPTED_ENV_FILE.", "One namespace or mount per canonical environment", "Separate application, platform, integration and emergency policy domains", "Tenant-specific path and policy where a secret grants tenant authority", "No wildcard read/list capability across tenants or environments", "Long-lived static secret is an approved exception with owner, expiry and migration plan; dynamic database/cloud credentials are the default." ] }, { "id": "production-secret-rotation", "title": "Secret rotation", "lead": "Rotation is an observable state machine, not an overwrite. Current/next material is prepared and verified before cutover; old material is negatively tested before the operation is complete.", "table": { "caption": "Maximum lifetimes and bounded overlap", "columns": [ "Credential/key class", "Max lifetime", "Planned overlap", "Rule" ], "rows": [ [ "WORKLOAD_X509_SVID", "3600s", "600s", "Stream and rotate automatically; workload-local private key is never exported." ], [ "ACCESS_TOKEN", "300s", "0s", "Issue from current authority only; no token extension." ], [ "PRIVILEGED_ACCESS_TOKEN", "180s", "0s", "Fresh step-up and live PDP check; no refresh token." ], [ "DATABASE_DYNAMIC_CREDENTIAL", "3600s", "300s", "Issue a role-scoped lease and revoke it automatically on expiry." ], [ "PROVIDER_API_CREDENTIAL", "7776000s", "86400s", "Rotate sooner when provider policy allows; current/next validation and negative old-key test are mandatory." ], [ "WEBHOOK_SIGNING_KEY", "7776000s", "604800s", "Publish key ID, verify current/previous generations during the bounded overlap and reject unknown or retired key IDs." ], [ "KMS_WRAPPING_KEY", "31536000s", "2592000s", "Rotate the key version; rewrap data keys asynchronously and retain the old version only for verified decrypt dependencies." ], [ "PUBLIC_EDGE_CERTIFICATE", "2592000s", "604800s", "Automated renewal, external expiry monitoring and rollback-tested deployment." ] ] }, "steps": [ { "title": "PREPARED", "description": "Persist the transition, actor, approvals, material metadata fingerprint, consumer acknowledgements and outcome before advancing." }, { "title": "DISTRIBUTED", "description": "Persist the transition, actor, approvals, material metadata fingerprint, consumer acknowledgements and outcome before advancing." }, { "title": "DUAL_READ_VERIFY", "description": "Persist the transition, actor, approvals, material metadata fingerprint, consumer acknowledgements and outcome before advancing." }, { "title": "PRIMARY", "description": "Persist the transition, actor, approvals, material metadata fingerprint, consumer acknowledgements and outcome before advancing." }, { "title": "RETIRED", "description": "Persist the transition, actor, approvals, material metadata fingerprint, consumer acknowledgements and outcome before advancing." }, { "title": "REVOKED", "description": "Old material is unusable, negative use is observed, dependants are reconciled and evidence is closed." } ], "bullets": [ "Suspected compromise starts containment/rotation within 15 minutes; the affected credential is revoked sooner where technically possible.", "Known or suspected disclosure, unauthorized use or unexplained authentication", "Owner, custodian, consumer identity, tenant or environment boundary change", "Algorithm, provider, trust anchor or policy change", "Failed integrity check, inventory mismatch, expired attestation or overdue scheduled rotation", "Break-glass use affecting the credential or its trust path" ] }, { "id": "production-key-ownership", "title": "Key ownership и custody", "lead": "Ownership means accountability for policy and lifecycle; custody means control of private material. CertaRail does not become custodian of tenant asset private keys and does not receive KMS/Vault root or export authority.", "table": { "caption": "Key owner/custodian matrix", "columns": [ "Key class", "Owner", "Custodian", "Approver", "Consumers", "CertaRail access" ], "rows": [ [ "TENANT_CUSTODY_PRIVATE_KEYS", "EXTERNAL_REGULATED_CUSTODIAN", "External custodian HSM and named key officers", "Tenant custody/security authority under dual control", "Custodian signing service only", "PROHIBITED" ], [ "TENANT_IDP_AND_PARTNER_CLIENT_KEYS", "DEPLOYING_BANK_OR_TENANT_IAM_OWNER", "Tenant-managed HSM/KMS", "Tenant IAM owner plus Security checker", "Registered IdP, confidential clients and verifier trust store", "PUBLIC_METADATA_OR_EXACT_CRYPTO_OPERATION_ONLY" ], [ "TLS_EDGE_AND_SERVICE_CERTIFICATE_KEYS", "DEPLOYING_BANK_PLATFORM_SECURITY", "Environment CA, managed certificate service or workload", "Platform Security plus service owner", "Exact edge or workload identity", "NON_EXPORTABLE_OPERATION_ONLY" ], [ "KMS_KEY_HIERARCHY", "DEPLOYING_BANK_SECURITY", "Bank-approved KMS/HSM and independent custodians", "Key-policy maker and independent checker", "Purpose-bound workload identities", "NO_ROOT_OR_EXPORT_ACCESS" ], [ "VAULT_ROOT_RECOVERY_AND_UNSEAL", "DEPLOYING_BANK_SECURITY", "Independent sealed recovery custodians or managed service", "Incident commander plus Security checker", "Break-glass recovery ceremony only", "NO_STANDING_ACCESS" ], [ "WEBHOOK_ENDPOINT_SIGNING_KEYS", "TENANT_INTEGRATION_OWNER", "CertaRail production secret manager; receiver stores one-time delivered copy", "Tenant integration maker and independent checker", "Named delivery worker and registered receiver endpoint", "PURPOSE_BOUND_SIGN_OPERATION_ONLY" ], [ "EVIDENCE_AND_BACKUP_KEYS", "DEPLOYING_BANK_SECURITY_AND_RECORDS_OWNER", "Separated KMS/HSM recovery domain", "Security plus Records/Recovery checker", "Evidence signer or recovery workflow only", "PURPOSE_BOUND_OPERATION_ONLY" ] ] } }, { "id": "production-credential-revocation", "title": "Credential revocation", "lead": "Revocation is complete only when the authoritative disable decision has propagated and a denied use is observed. Ticket closure alone is not evidence of revocation.", "table": { "caption": "Revocation actions and propagation SLA", "columns": [ "Class", "Action", "Max propagation", "Evidence" ], "rows": [ [ "HUMAN_SESSION_AND_REFRESH_FAMILY", "Disable membership/JIT grant, revoke the refresh family and terminate active BFF sessions; reuse revokes the entire family.", "5m", "Credential/key metadata reference and reason without secret material; Requester, maker/checker or incident authority and timestamps; Authoritative disable/revoke result plus propagation observations; Negative authentication/use test, affected-resource reconciliation and replacement link" ], [ "ACCESS_TOKEN", "Deny high-risk token IDs at the PDP and rely on short expiry; every privileged request performs a live entitlement/revocation check.", "5m", "Credential/key metadata reference and reason without secret material; Requester, maker/checker or incident authority and timestamps; Authoritative disable/revoke result plus propagation observations; Negative authentication/use test, affected-resource reconciliation and replacement link" ], [ "WORKLOAD_CERTIFICATE", "Stop issuance for the attested identity, remove trust/authorization and replace the SVID; short validity bounds residual exposure.", "5m", "Credential/key metadata reference and reason without secret material; Requester, maker/checker or incident authority and timestamps; Authoritative disable/revoke result plus propagation observations; Negative authentication/use test, affected-resource reconciliation and replacement link" ], [ "SERVICE_CLIENT", "Disable the exact tenant/environment client, revoke active grants and rotate its asymmetric key/certificate.", "5m", "Credential/key metadata reference and reason without secret material; Requester, maker/checker or incident authority and timestamps; Authoritative disable/revoke result plus propagation observations; Negative authentication/use test, affected-resource reconciliation and replacement link" ], [ "DATABASE_LEASE", "Revoke the dynamic lease/role sessions, terminate affected connections and issue a replacement only after workload re-attestation.", "5m", "Credential/key metadata reference and reason without secret material; Requester, maker/checker or incident authority and timestamps; Authoritative disable/revoke result plus propagation observations; Negative authentication/use test, affected-resource reconciliation and replacement link" ], [ "PROVIDER_CREDENTIAL", "Disable/detach at the provider, block local use, reconcile commands during the uncertainty window and activate a separately prepared version.", "5m", "Credential/key metadata reference and reason without secret material; Requester, maker/checker or incident authority and timestamps; Authoritative disable/revoke result plus propagation observations; Negative authentication/use test, affected-resource reconciliation and replacement link" ], [ "WEBHOOK_SIGNING_KEY", "Mark the key ID revoked, stop signing, reject it at verification, issue a new generation and reconcile delivery attempts in the overlap.", "5m", "Credential/key metadata reference and reason without secret material; Requester, maker/checker or incident authority and timestamps; Authoritative disable/revoke result plus propagation observations; Negative authentication/use test, affected-resource reconciliation and replacement link" ], [ "KMS_KEY", "Deny new cryptographic use, isolate affected consumers and rewrap/re-sign with a replacement version; destruction waits for governed evidence.", "5m", "Credential/key metadata reference and reason without secret material; Requester, maker/checker or incident authority and timestamps; Authoritative disable/revoke result plus propagation observations; Negative authentication/use test, affected-resource reconciliation and replacement link" ] ] }, "bullets": [ "Compromise revocation bypasses planned overlap: block first, then distribute replacement and reconcile ambiguous operations.", "Short lifetime limits residual risk but does not replace disable, PDP policy update, session termination, provider-side revoke or key-ID rejection.", "Every revocation links replacement material by metadata reference only; no secret or recoverable private key appears in evidence." ] }, { "id": "production-break-glass", "title": "Break-glass", "lead": "Break-glass reuses the A22.1 BREAK_GLASS_SESSION contract: two distinct hardware-bound custodians activate one incident-scoped 15-minute session over an isolated private emergency path.", "table": { "caption": "Emergency access contract", "columns": [ "Control", "Fixed decision" ], "rows": [ [ "IAM operation", "BREAK_GLASS_SESSION" ], [ "Approval", "TWO_DISTINCT_PRINCIPALS; self-approval PROHIBITED" ], [ "Session", "15m; standing access PROHIBITED" ], [ "Network", "Dedicated private emergency path, disabled in normal operation and unable to traverse public ingress." ], [ "Secret boundary", "Exact sealed secret/key metadata and command allowlist for the declared incident; no list-all, export or root-token delivery." ], [ "Cannot bypass", "Tenant custody/private-key boundary; Maker-checker for asset or money movement; Evidence integrity, retention or legal hold; Production activation gates; Bulk tenant data or secret export" ] ] }, "bullets": [ "Incident declaration, reason, impact and alternative-path failure", "Both custodian identities, hardware-auth events and issued/expiry time", "Complete approved command/session record and accessed resource metadata", "Automatic expiry, affected-credential rotation and next-business-day independent review" ], "callout": { "tone": "critical", "title": "Emergency access не означает unrestricted root", "description": "Session exposes only the smallest command/resource allowlist needed for the incident, expires automatically, pages Security immediately and triggers affected-credential replacement plus next-business-day review." } }, { "id": "production-environment-separation", "title": "Environment separation", "lead": "DEMO, LOCAL, HOSTED_SANDBOX, PROVIDER_SANDBOX and PRODUCTION share source artifacts, not trust or secret material. Production is isolated across account/project, network, PKI, KMS, Vault, identity clients, data planes, telemetry and recovery.", "table": { "caption": "Canonical environment separation", "columns": [ "Environment", "Isolated dimensions", "Data/secret rule" ], "rows": [ [ "DEMO", "CLOUD_ACCOUNT_OR_PROJECT, NETWORK_AND_PRIVATE_DNS, PKI_TRUST_DOMAIN, KMS_KEY_HIERARCHY, VAULT_NAMESPACE_OR_MOUNT, IDP_CLIENT_ISSUER_AND_AUDIENCE, DATA_STORES_QUEUES_CACHES_AND_TOPICS, LOGS_AUDIT_AND_BACKUPS", "Synthetic or explicitly approved irreversibly sanitized fixtures only" ], [ "LOCAL", "CLOUD_ACCOUNT_OR_PROJECT, NETWORK_AND_PRIVATE_DNS, PKI_TRUST_DOMAIN, KMS_KEY_HIERARCHY, VAULT_NAMESPACE_OR_MOUNT, IDP_CLIENT_ISSUER_AND_AUDIENCE, DATA_STORES_QUEUES_CACHES_AND_TOPICS, LOGS_AUDIT_AND_BACKUPS", "Synthetic or explicitly approved irreversibly sanitized fixtures only" ], [ "HOSTED_SANDBOX", "CLOUD_ACCOUNT_OR_PROJECT, NETWORK_AND_PRIVATE_DNS, PKI_TRUST_DOMAIN, KMS_KEY_HIERARCHY, VAULT_NAMESPACE_OR_MOUNT, IDP_CLIENT_ISSUER_AND_AUDIENCE, DATA_STORES_QUEUES_CACHES_AND_TOPICS, LOGS_AUDIT_AND_BACKUPS", "Synthetic or explicitly approved irreversibly sanitized fixtures only" ], [ "PROVIDER_SANDBOX", "CLOUD_ACCOUNT_OR_PROJECT, NETWORK_AND_PRIVATE_DNS, PKI_TRUST_DOMAIN, KMS_KEY_HIERARCHY, VAULT_NAMESPACE_OR_MOUNT, IDP_CLIENT_ISSUER_AND_AUDIENCE, DATA_STORES_QUEUES_CACHES_AND_TOPICS, LOGS_AUDIT_AND_BACKUPS", "Synthetic or explicitly approved irreversibly sanitized fixtures only" ], [ "PRODUCTION", "CLOUD_ACCOUNT_OR_PROJECT, NETWORK_AND_PRIVATE_DNS, PKI_TRUST_DOMAIN, KMS_KEY_HIERARCHY, VAULT_NAMESPACE_OR_MOUNT, IDP_CLIENT_ISSUER_AND_AUDIENCE, DATA_STORES_QUEUES_CACHES_AND_TOPICS, LOGS_AUDIT_AND_BACKUPS", "No Production data or secrets may move to a lower environment" ] ] }, "bullets": [ "Cross-environment trust: DENY_BY_DEFAULT; artifact promotion: IMMUTABLE_DIGEST_AND_PROVENANCE.", "Prohibited: each environment re-binds identity, endpoints, keys, secrets and policies from its own approved control plane.", "Only explicitly approved one-way metadata/aggregate export; no credential, restricted payload or control-plane trust is inherited.", "No shared IdP client, audience, PKI trust domain, KMS alias/root, Vault namespace, database, topic, cache prefix, log sink or backup set crosses into Production." ] }, { "id": "production-network-secrets-activation", "title": "Activation gates и acceptance evidence", "table": { "caption": "Open Production network and secrets gates", "columns": [ "Gate", "Owner", "Status", "Required evidence" ], "rows": [ [ "NETWORK_TLS_PROFILE_ACCEPTED", "Platform Security", "OPEN", "External and internal scans, certificate inventory/renewal drill, mTLS identity denial and TLS 1.0/1.1/unsafe cipher/0-RTT negative results." ], [ "NETWORK_PRIVATE_TOPOLOGY_ENFORCED", "Cloud Security", "OPEN", "Approved topology, no-public-IP proof, identity-and-port flow matrix, egress/SSRF tests and denied lateral/transitive paths." ], [ "NETWORK_CORS_AND_CSRF_NEGATIVE_SUITE_PASSED", "Application Security", "OPEN", "Exact-origin matrix with wildcard, reflection, null/malformed/multiple origin, preflight cache, CSRF and postMessage denial tests." ], [ "SECRETS_KMS_AND_VAULT_INTEGRATED", "Platform Security", "OPEN", "Named bank-approved providers, key/secret inventory, non-exportability and role separation tests, envelope round trip and denied wildcard access." ], [ "SECRETS_ROTATION_AND_REVOCATION_DRILLED", "Security Operations", "OPEN", "Planned and compromise rotations for every class, current/next cutover, rollback, five-minute revocation observations and negative old-key tests." ], [ "SECRETS_BREAK_GLASS_DRILLED", "Incident Response", "OPEN", "Two-custodian 15-minute exercise, command/session record, denied prohibited bypass, automatic expiry, credential replacement and review." ], [ "NETWORK_ENVIRONMENT_ISOLATION_PROVEN", "Security Engineering", "OPEN", "Cross-environment network, PKI, KMS, vault, audience, data, queue, log and backup denial suite plus immutable artifact promotion proof." ], [ "NETWORK_SECRETS_SECURITY_ACCEPTANCE_COMPLETE", "CISO delegate", "OPEN", "Updated threat model, external penetration test, recovery exercise, residual-risk acceptance and signed production activation record." ] ] }, "callout": { "tone": "critical", "title": "Production network и secrets controls не активированы", "description": "Все gates имеют статус OPEN. Local loopback binds, generated JSON, AES-GCM helper, sandbox one-time secret или passing unit tests не подтверждают Production TLS, private endpoints, KMS/Vault custody, rotation/revocation SLA, break-glass или environment isolation." } } ] }