Usage Metering & Billing Pipeline  ·  View 20 of 22  ·  Assurance

Security Zones and Privileged Paths

Five zones by decreasing exposure, and the separation that keeps one identity from losing a lot of money.

Editable source SVG draw.io All views
Internet Customer admin Product & edge services Partner feeds Perimeter WAF + CloudFront API Gateway OIDC, mTLS Request authorisation meter scope, account scope Application — private subnets, no inbound internet Ingest validator Aggregator Rating service Entitlement service Invoice run Privileged — separate roles, second approver, no standing access Pricing change Restatement Credit memo issue Data and evidence — reachable only by VPC endpoint Event ledger Plan registry Privileged-action log write-once Invoice ledger KMS per-zone keys OIDC role + mTLS scoped to its meters append only two-person written before execution Security Zones and Privileged Paths Person or role Application we own External / third party Security / platform Interface / broker Data store synchronous event / async No identity holds pricing, restatement and credit-memo rights together. The privileged zone writes its audit record before the action runs, so an action that fails is still on the record. v 1.0 · owner Architecture Practice · date 2026-10

Decisions

  • No identity holds pricing change, restatement and credit-memo rights together, and none of the three can be exercised without a second approver. These are the three ways to lose a lot of money quickly, and they are the reason the privileged zone exists at all.
  • Producers authenticate as workload identities authorised to specific meters, so a compromised service cannot fabricate usage on another meter — the blast radius of a service compromise is that service's own meters.
  • The privileged zone writes its audit record before the action runs, into a store the platform's own operators cannot delete from. The operators are an in-scope threat.
  • Account-scoped authorisation on every read path is verified by an automated test on every change to a read path, because a cross-tenant usage leak is a breach, not a bug.

Assumptions

  • No standing access to the privileged zone; rights are assumed for a bounded session and recorded (stated assumption).
  • Per-zone KMS keys, so a key compromise does not span the record and the financial ledger.

Risks

  • The dimension map may carry customer identifiers, which makes an event store subject to deletion requests that the statutory retention of the financial record resists. The design splits them; the policy still has to be written.
  • Write-once retention is not reversible. A retention misconfiguration is permanent by design.
◀  Billing Period Lifecycle All views Identity and Entitlement Flow  ▶
Solution Architecture v1.0 · Amazon Web Services · Billing Platform Architecture · 2026-1020-security-zones