Deliverables

The curriculum covers what an architect should know. This covers what an architect actually hands over: 55 artifacts, each with a worked example, a note on when it is worth producing, who reads it, and the ways it usually goes wrong. Filter by the artifact's type, the kind of engagement that calls for it, the stack or industry it is drawn against, or the audience it is written for.

Identify the deliverable → 42 diagrams, shown one at a time with the answer withheld. Nothing to submit.

2 of 55 deliverables shown.

flowchart TB
  root["Organisation Root<br/><i>policy: deny unapproved regions</i>"]

  subgraph plat["Platform"]
    direction TB
    ident["Identity<br/><i>directory, privileged access</i>"]
    conn["Connectivity<br/><i>hub VNet/VPC, firewall, DNS, VPN</i>"]
    mgmt["Management<br/><i>logs, backup, monitoring</i>"]
  end

  subgraph land["Landing Zones"]
    direction TB
    subgraph corp["Corporate"]
      p1["Prod A<br/><i>spoke</i>"]
      n1["Non-Prod A<br/><i>spoke</i>"]
    end
    subgraph online["Internet-Facing"]
      p2["Prod B<br/><i>spoke</i>"]
      n2["Non-Prod B<br/><i>spoke</i>"]
    end
  end

  sandbox["Sandbox<br/><i>spend cap, no connectivity, auto-expire</i>"]
  decom["Decommissioned<br/><i>deny all</i>"]

  root --> plat
  root --> land
  root --> sandbox
  root --> decom
  conn --- p1
  conn --- n1
  conn --- p2
  conn --- n2
  mgmt -.->|"diagnostics forwarded"| land
  ident -.->|"roles and groups"| land

Deployment & Infrastructure View

Cloud Landing Zone Diagram

The account, network, identity and policy scaffolding every future workload will be dropped into, drawn before the first workload exists.

Landing Zones Design

flowchart LR
  subgraph who["Identities"]
    direction TB
    dev(["Developers<br/><i>group</i>"])
    sre(["SRE<br/><i>group</i>"])
    aud(["Auditors<br/><i>group</i>"])
    wl["Workload Identity<br/><i>order-api</i>"]
    ci["Pipeline Identity<br/><i>deploy-prod</i>"]
  end

  subgraph roles["Roles"]
    direction TB
    r1["Reader<br/><i>standing</i>"]
    r2["Operator<br/><i>standing</i>"]
    r3["Break-Glass Admin<br/><i>JIT — 60 min, approved, logged</i>"]
    r4["Deployer<br/><i>pipeline only</i>"]
    r5["Data Reader — Masked<br/><i>no raw PII</i>"]
  end

  subgraph what["Resources"]
    direction TB
    a1["Prod Compute"]
    a2["Prod Data Store"]
    a3["Key Vault"]
    a4["Audit Logs<br/><i>append-only</i>"]
  end

  dev --> r1 --> a1
  dev --> r5 --> a2
  sre --> r2 --> a1
  sre --> r3
  r3 --> a1
  r3 --> a2
  aud --> r1 --> a4
  wl --> r5
  wl --> a3
  ci --> r4 --> a1

Security View

IAM Role Model

Which identities may do what to which resource, expressed through roles rather than by naming people, so that access can be reviewed.

Identity & Access Management Design