Observability Platform  ·  View 23 of 25  ·  Assurance

Trust Zones

Six zones by decreasing exposure, and why the restricted one is the one that matters.

Editable source SVG draw.io All views
Internet — untrusted, and assumed hostile Web & mobile clients identity is a claim Third-party SaaS webhook or pull Edge — its own trust zone, its own limits WAF per-key rate limits API Gateway client ingest only Attribute allow-list no service identity Workload accounts — where telemetry is produced Service pods OTel SDK Node agents identity per workload PrivateLink endpoint no public ingest path Observability account — the platform Gateway + redaction before any write Buffer & stores encrypted with KMS Query frontend authorises by class Alert evaluation reads, never writes Restricted — narrower audience than the rest of telemetry Compliance class S3 Object Lock, 7 years KMS keys held outside the platform Query audit reading is an audited act Outside the failure domain — separate account, separate region Self-telemetry stack managed services Dead-man switch break-glass path HTTPS, keyed keyed SigV4 private redacted narrow role logged first crypto-shred heartbeat Trust Zones — Telemetry Is Production Data External / third party Security / platform Interface / broker Decision point Application we own Data store event / async synchronous batch Six zones, and the one that matters most is the fifth: a debugging interface over production logs is a production data interface, so reading it is authorised narrowly and written to the audit before it executes. Client telemetry crosses the edge keyed and rate limited, and never carries a service identity. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • Redaction happens at the gateway, before any write, and every redaction is counted and attributed. The platform assumes logs will contain personal data despite policy, because they always do.
  • The compliance class has a narrower audience than the rest of telemetry and its own retention and deletion controls, which is what lets everything else expire on schedule.
  • Reading production telemetry is an audited action, written before it executes. A debugging interface over production logs is a production data interface.

The untrusted edge

  • Client telemetry is its own trust zone with its own rate limits and attribute allow-list, and a client-supplied resource identity can never impersonate an in-house service.
  • Keys are held outside the platform, so crypto-shredding a retention class is available as a deletion mechanism of last resort.

Risks

  • Gateway redaction is pattern-based and will miss things. It reduces exposure; it does not make the log store safe to open widely, which is why authorisation by class exists as well.
  • Break-glass access to the platform when the identity provider is down is a real requirement and a real standing risk. It is short-lived and recorded, and it is still a door.
◀  The Cardinality Loop All views Identity and Access  ▶
Solution Architecture v1.0 · Amazon Web Services with open-source collection and storage · Reliability Architecture · 2026-09 · 25 views23-security-trust-zones