IaC Architecture - Cross-Cutting Concerns Skill

IaC Architecture - Cross-Cutting Concerns Skill

Skill Description

This skill provides comprehensive guidance on infrastructure as code architecture patterns, focusing on cross-cutting concerns that span all cloud providers and IaC tools. The Dredgen uses this skill to architect secure, compliant, cost-optimized, and maintainable infrastructure at enterprise scale.

Trigger Phrases

This skill activates when discussions involve:

• "iac best practices"
• "infrastructure architecture"
• "soc2" or "compliance"
• "security patterns"
• "cost optimization"
• "multi-cloud architecture"
• "enterprise infrastructure"
• "tagging strategy"
• "repository structure"
• "iac security"
• "infrastructure compliance"
• "cloud governance"

Core Competencies

1. Security Patterns

Encryption Standards

• Encryption at rest: AES-256 for all storage resources
• Encryption in transit: TLS 1.2+ for all network communications
• Key management: Cloud-native KMS or HashiCorp Vault
• Certificate rotation: Automated with short-lived certificates

IAM Best Practices

• Principle of least privilege
• Role-based access control (RBAC)
• Service accounts for automation
• MFA enforcement for human access
• Regular access reviews and audits
• Assume-role patterns for cross-account access

Network Segmentation

• VPC/VNet isolation per environment
• Private subnets for data and compute
• Public subnets only for load balancers
• Network ACLs and security groups
• Bastion hosts or VPN for administrative access
• Zero-trust network principles

Secrets Management

• Never commit secrets to version control
• Use cloud-native secrets managers
• Dynamic secrets generation
• Secrets rotation policies
• Audit logging for secret access
• Encryption in transit and at rest

Security Scanning Integration

• tfsec: Terraform security scanning
• checkov: Multi-IaC policy scanning
• trivy: Container and IaC vulnerability scanning
• terrascan: Compliance scanning
• Integration in CI/CD pipelines
• Fail builds on critical findings

2. SOC2 Compliance

CC6.1 - Logical and Physical Access Controls

• Encryption at rest (customer data)
• Encryption in transit (all communications)
• Key rotation policies
• Access logging

CC6.6 - Logical Access Security Measures

• Comprehensive logging (CloudTrail, Activity Logs, Audit Logs)
• Log retention (minimum 90 days)
• Log integrity protection
• SIEM integration
• Real-time alerting

CC6.7 - Restriction of Logical Access

• IAM policies with least privilege
• MFA enforcement
• Session timeout policies
• Access reviews
• Privileged access management

CC7.1 - Network Security

• Network segmentation
• Security groups/NSGs with minimal rules
• No public database access
• Private endpoints for services
• DDoS protection

CC7.2 - Detection and Monitoring

• Change management tracking
• Infrastructure drift detection
• Automated remediation
• Version control for all IaC
• Approval workflows for production changes

Audit Trail Requirements

• Immutable audit logs
• Centralized log aggregation
• Log analysis and alerting
• Compliance reporting
• Evidence collection automation

3. Cost Optimization

Tagging Strategies

• Environment tags (dev, staging, prod)
• Owner/team tags
• Cost center allocation
• Application/service tags
• Automation tags (terraform-managed)
• Data classification tags
• Compliance tags (soc2, hipaa)

Right-Sizing Patterns

• Start small, scale up based on metrics
• Use auto-scaling groups
• Implement scheduled scaling
• Leverage spot/preemptible instances
• Monitor and adjust continuously

Reserved Capacity

• Reserved instances for stable workloads
• Savings plans for flexible workloads
• Commitment-based discounts
• Regular utilization reviews

Spot/Preemptible Instances

• Batch processing workloads
• Stateless applications
• Development environments
• Mixed instance groups
• Fault-tolerant architectures

Cost Allocation

• Tag-based cost allocation
• Budget alerts and limits
• Showback/chargeback reports
• Cost anomaly detection
• FinOps integration

4. Multi-Cloud Patterns

Abstraction Layers

• Provider-agnostic modules
• Standardized interfaces
• Common tagging schemas
• Unified naming conventions
• Shared variable structures

Provider-Agnostic Modules

• Abstract compute, storage, networking
• Use Terragrunt for DRY configurations
• Implement factory patterns
• Version and document modules
• Test across providers

Cross-Cloud Networking

• VPN connections between clouds
• SD-WAN for multi-cloud
• Direct connect/ExpressRoute/Interconnect
• Consistent CIDR planning
• DNS strategy for multi-cloud

Disaster Recovery

• RTO/RPO requirements
• Active-passive configurations
• Active-active for critical systems
• Automated failover
• Regular DR testing

5. Repository Structure

Monorepo vs Polyrepo

Monorepo Benefits:

• Single source of truth
• Atomic changes across modules
• Shared tooling and standards
• Easier code reuse
• Simplified dependency management

Polyrepo Benefits:

• Independent versioning
• Team autonomy
• Smaller blast radius
• Easier access control
• Focused CI/CD pipelines

Module Organization

terraform/
├── modules/                    # Reusable modules
│   ├── compute/
│   ├── database/
│   ├── networking/
│   └── security/
├── environments/               # Environment configurations
│   ├── dev/
│   ├── staging/
│   └── prod/
├── shared/                     # Shared resources
│   ├── dns/
│   ├── monitoring/
│   └── logging/
└── policies/                   # Security policies
    ├── tfsec/
    ├── checkov/
    └── sentinel/

Environment Separation

• Separate AWS accounts/Azure subscriptions/GCP projects
• Isolated state files per environment
• Environment-specific variables
• Promotion workflows (dev → staging → prod)
• Immutable infrastructure

CI/CD Integration

• Automated validation (fmt, validate, lint)
• Security scanning in pipelines
• Plan on pull requests
• Apply on merge to main
• Drift detection scheduled jobs
• Rollback capabilities

Reference Files

• soc2-controls.md - Complete SOC2 control mapping
• security-scanning.md - Security scanner configurations
• tagging-strategy.md - Enterprise tagging standards
• repository-patterns.md - Repository organization patterns
• cost-optimization.md - Cost control strategies

Example Files

• soc2-compliant-vpc.tf - SOC2-compliant VPC configuration
• tagging-module.tf - Reusable tagging module
• security-group-patterns.tf - Secure security group patterns
• cost-tags.tf - Cost allocation tagging examples

Skill Activation

When The Dredgen detects architectural discussions involving security, compliance, cost, or governance, this skill provides:

1. Best practice recommendations
2. Compliance control mappings
3. Security patterns and examples
4. Cost optimization strategies
5. Repository structure guidance
6. Multi-cloud architecture patterns

Integration with Other Skills

• terraform-enterprise: State management and workspace patterns
• harness-cd: Pipeline integration for compliance
• vault-operations: Secrets management implementation
• terraformer: Import existing infrastructure with compliance

Success Criteria

Infrastructure architecture is successful when:

• Security scanners pass with zero critical findings
• SOC2 controls are fully implemented and documented
• Cost allocation tags are 100% compliant
• Multi-cloud patterns enable provider portability
• Repository structure supports team collaboration
• CI/CD pipelines enforce all policies
• Audit trails are complete and immutable