Internal Users External Users

Employees Developers Mobile Web

client Browser
VPN Connection
Description: Connection established by OpenVPN clients Internet Connection
Network: 192.168.251.0/24 Description: Requests from iOS/Android/Web applications
Port: 1194/UDP Network: Internet
Authentication: User's SSL certificate with AES-256-CBC Port: 443/TCP
cipher Authorization: All valid HTTPS requests
Authentication: User's login and password, user's PIN, device token

VPC/Internal Network
Description: Virtual Private Cloud
Firewall Network: 10.1.0.0/21 Server Load Balancer

Server Load Balancer

Admin Tool Access Description: Single entry point for HTTPS requests to public application
Description: HTTPS requests to different parts of the Admin Tool application Network: 47.254.202.71
Network: 10.1.2.0/24 Port: 443/TCP
VPN/ Raiz Corporate Network Port: 443/TCP
Server Load Balancer
Instance type: slb.s1.small
Description: Single entry point for HTTPS requests to private application
Authotization: Access only from VPN connection Specification: Max connection: 5000, Connections Per Second (CPS): 3000,
Network: 47.254.203.137
Authentication: Users managed by JumpCloud Queries Per Second (QPS): 1000
Port: 443/TCP
Instance type: slb.s1.small
Specification: Max connection: 5000, Connections Per Second (CPS): 3000,

Server Load Balancer

Queries Per Second (QPS): 1000 Relational Databases
Network: 10.1.2.0/24
Securities Port: 3433/TCP
Authorization: Access only from within VPC
Kubernetes Cluster Authentication: Database user's login and password
Description: Cluster infrastructure to run applications on
vSwitch Network: 10.1.2.0/24
Pod Network: 172.16.0.0/16
Applications databases Bank Accounts database MoneyThor database
Service Network: 172.17.0.0/20
Description: Database cluster for storing Description: Database cluster for storing Description: Database cluster for storing
applications databases bank account sensitive information categorized users transactions
Operations Instance type: rds.pg.s3.large Instance type: rds.pg.s1.small Instance type: rds.pg.s1.small
Specification: 4 vCPU/8GiB Specification: 1 vCPU/2GiB Specification: 1 vCPU/2GiB

Servers Access
Description: Established by SSH clients master master master
Investor Success Network: 10.1.2.0/24
Port: 22/TCP
Authorization: Access only from VPN connection Instance Instance Instance
Authentication: User's 2048-bit RSA key Master Master Master

Replicas Replicas Replicas

IT
node node node

Instance Instance Instance In-memory Databases

Network: 10.1.2.0/24
Port: 6379/TCP
Authorization: Access only from within VPC
JumpBox Server for developers/devops Authentication: Cluster password
Description: Single entry point to for accessing internal infrastrucure
Network: 10.1.2.0/24
Port: 22/TCP; 6443 TCP
Cache databases Backgroupd jobs storage
Instance type: ecs.t5-lc1m1.small
Description: Database cluster used for Description: Database cluster used for as
Specification: 1vCPU/1 GiB
caching a storage for background jobs
Authorization: Access only from withing VPC
Instance type: redis.master.small.default Instance type: redis.master.small.default
Authentication:Users managed by JumpCloud; Kubernetes cluster access
Specification: 1GiB Specification: 1GiB
authenticated based on user's SSL/TLS certificates

Master Replica Master Replica

Others
Authorization: Access only from within VPC

Internet Connection OSS

Description: HTTPS requests to external services Description: Object Storage Service
Network: Internet
Port: 443/TCP

Bucket Bucket
External Services
Bucket Bucket

JumpBox Server for Looker integration

Description: Single entry point for Looker for read-only database access
Network: 10.1.2.0/24
Port: 22/TCP
Instance type: ecs.t5-lc1m1.small
Specification: 1vCPU/1 GiB
Authorization: Access only from withing VPC or Looker public IPs
Authentication: Looker 2048-bit RSA key