Deliverables

flowchart TB
  subgraph pri["Primary site"]
    direction TB
    p1["Application tier"]
    p2[("Transactional DB")]
    p3[("Object storage")]
    p4["Secrets + config"]
  end
  subgraph dr["Recovery site — warm"]
    direction TB
    d1["Application tier<br/><i>scaled to 0 · IaC ready</i>"]
    d2[("DB replica<br/><i>async · lag &lt; 30s</i>")]
    d3[("Storage replica<br/><i>cross-region · 15 min</i>")]
    d4["Secrets replicated"]
  end

  p2 ==>|"async"| d2
  p3 ==>|"async"| d3
  p4 ==>|"sync"| d4

  subgraph run["Recovery sequence — tested 2026-05-18"]
    direction TB
    s1["1. Declare · 5 min"]
    s2["2. Promote replica · 8 min"]
    s3["3. Scale app tier · 6 min"]
    s4["4. Repoint DNS · 5 min<br/><i>TTL 60s</i>"]
    s5["5. Verify + reconcile · 12 min"]
    s1 --> s2 --> s3 --> s4 --> s5
  end
  dr --> run
  run --> res(["Restored — measured RTO 36 min"])

flowchart LR
  subgraph who["Identities"]
    direction TB
    dev(["Developers<br/><i>group</i>"])
    sre(["SRE<br/><i>group</i>"])
    aud(["Auditors<br/><i>group</i>"])
    wl["Workload Identity<br/><i>order-api</i>"]
    ci["Pipeline Identity<br/><i>deploy-prod</i>"]
  end

  subgraph roles["Roles"]
    direction TB
    r1["Reader<br/><i>standing</i>"]
    r2["Operator<br/><i>standing</i>"]
    r3["Break-Glass Admin<br/><i>JIT — 60 min, approved, logged</i>"]
    r4["Deployer<br/><i>pipeline only</i>"]
    r5["Data Reader — Masked<br/><i>no raw PII</i>"]
  end

  subgraph what["Resources"]
    direction TB
    a1["Prod Compute"]
    a2["Prod Data Store"]
    a3["Key Vault"]
    a4["Audit Logs<br/><i>append-only</i>"]
  end

  dev --> r1 --> a1
  dev --> r5 --> a2
  sre --> r2 --> a1
  sre --> r3
  r3 --> a1
  r3 --> a2
  aud --> r1 --> a4
  wl --> r5
  wl --> a3
  ci --> r4 --> a1

flowchart TB
  hsm[("HSM / Key Service<br/><i>root of trust · FIPS 140-2 L3</i>")]
  cmk["Customer Master Key<br/><i>per environment · rotate 1y</i>"]
  dek["Data Encryption Keys<br/><i>per dataset · rotate 90d</i>"]

  hsm --> cmk -->|"wraps"| dek

  subgraph vault["Secret Store"]
    direction TB
    v1["Static secrets<br/><i>rotate 90d</i>"]
    v2["Dynamic credentials<br/><i>DB · TTL 1h</i>"]
    v3["PKI issuer<br/><i>mTLS certs · TTL 24h</i>"]
  end
  cmk -->|"encrypts vault at rest"| vault

  subgraph wl["Workloads"]
    direction TB
    w1["Service A<br/><i>workload identity</i>"]
    w2["Pipeline<br/><i>OIDC federation</i>"]
  end

  w1 -->|"attests identity — no stored secret"| vault
  w2 -->|"short-lived token — no stored secret"| vault
  vault -->|"lease · auto-renew · revocable"| w1
  dek -->|"envelope decrypt"| w1
  audit[("Audit log<br/><i>every issue and revoke</i>")]
  vault --> audit