...
...
AWS Services
The below table lists mandatory and optional managed AWS services that are used by
Assets
Stateful Data Assets - To Include in Backups
| Excerpt |
|---|
When running in AWS, stores data persistently in RDS, EFS and optionally MemoryDB. All these services support encryption at rest. The default Terraform templates provided as part of the product are configured to use encryption at rest. MemoryDB is configured by the customer. It is recommended to configure it with encryption at rest if sensitive information will be stored in it. |
Sensitive Data
Data can be separated in two categories: system configuration data and solution runtime data.
System Configuration Data
System data is stored in the system database in RDS. It includes things like users and roles with login credentials. Login credentials are stored in a secure way and cannot be reverse engineered. Other information in this category controls how the system is configured. The data is not sensitive from a personal integrity perspective but is from a general IT security perspective. It is thus recommended to have encryption at rest enabled for the system database.
Solution Runtime Data
As workflows are executed in the system and process payload they persist intermittent data. This data is stored in various locations:
...
Depending on the characteristics on the solution, this information can contain sensitive information about subscribers etc. Thus it is recommended to use encryption at rest for EFS and MemoryDB as soon as there is some data with personal integrity being processed in the workflows.
Data Location
EFS Disk Content
Solutions that use disk persisted data is storing this on a mounted EFS disk resource. Using the provided Terraform template, the EFS resource is given the name "[EKS-CLUSTER-ANME]-efs-disk". It is mounted into the pods at the path "/opt/mz/persistent" which is the path where executing workflows can access the storage.
...
Aggregation Aggregation Profile [hide]profile[/hide](3.0)
Duplicate UDR Detection Duplicate UDR Profile[hide]profile[/hide][hide]3.0[/hide]
Inter Workflow Inter Workflow Profile [hide]profile[/hide][hide]3.0[/hide]
RDS Managed database
The provided Terraform installation templates sets up a PostgreSQL database in RDS to be used as the system database. The RDS resource gets the name "[EKS-CLUSTER-ANME]-db".
MemoryDB Redis database
Some features in can use a Redis compatible database to store state. In AWS the MemoryDB for Redis service can be used for this. Access to this is configured in:
- Redis Profile Redis Profile[hide]3.0[/hide]
and can be consumed by:
- Aggregation Profile Aggregation Profile [hide]profile[/hide](3.0)
- Distributed Storage Profile Distributed Storage Profile[hide]profile[/hide][hide]3.0[/hide]
Stateless Assets - To Manage as Infrastructure as Code
The AWS infrastructure should be managed as IaC using Terraform, CloudFormation or similar tool. comes with templates written in Terraform that will setup a basic environment. The default configuration of these templates setup the following resources, which are sufficient to run standard system with solutions that are not particularly demanding on resources.
...