• Updated Virus Protection

• Full Disk Encrytion

• No unauthorized access

Product Team Workstations

We have validated the notebooks of all of our 15 product team members.

• Login access is restricted only to authorized persons

• Only minimal permissions are granted

• No unauthorized access

Bitbucket Cloud - META-INF

Source code management and Build system to store and build the code of our applications.

Permissions

• Admin : Can create, delete repositories and modify repository settings.

• Write : Can push and merge source code modifications and trigger manual build pipelines.

• Read : Can pull source code, read build logs and pull requests.

Repository1

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  6 Software Developer ( 1 Contractor )
  1 Product Owner

Repository2

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  6 Software Developer ( 1 Contractor )
  1 Product Owner

Repository3

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  6 Software Developer ( 1 Contractor )
  1 Product Owner

Repository4

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  6 Software Developer ( 1 Contractor )
  1 Product Owner

Repository5

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  6 Software Developer ( 1 Contractor )
  1 Product Owner

Repository6

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  1 DevOps Engineer
  6 Software Developer ( 1 Contractor )
  2 Test Engineer
  1 Product Owner
  1 Technical Account

Repository7

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  1 DevOps Engineer
  6 Software Developer ( 1 Contractor )
  2 Test Engineer
  1 Product Owner

Repository8

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  1 DevOps Engineer
  6 Software Developer ( 1 Contractor )
  2 Test Engineer
  1 Product Owner

Repository9

• Admin
  1 DevOps Engineer
  2 Product Owner
• Write
  1 DevOps Engineer
  6 Software Developer ( 1 Contractor )
  2 Test Engineer
  1 Product Owner

Artifact Management System

• Login access is restricted only to authorized persons

• Only minimal permissions are granted

• No unauthorized access

Jfrog Artifactory

Artifact management system to store the build logs and artifacts of your application.

Permissions

• Admin : Can create, delete repositories and modify repository settings.

• Write : Can upload, delete, overwrite (in snapshot repositories) artifacts.

• Read : Can list, download artifacts.

Repository1

• Admin
  1 DevOps Engineer

• Write
  1 Technical Account

• Read
  2 DevOps Engineer
  6 Software Developer ( 1 Contractor )
  2 Test Engineer
  1 Product Owner

Repository2

• Admin
  1 DevOps Engineer

• Write
  1 Technical Account

• Read
  2 DevOps Engineer
  6 Software Developer ( 1 Contractor )
  2 Test Engineer
  1 Product Owner

• Cloud Console access is restricted only to authorized persons

• SSH access is protected by keys and MFA

• Database access is possible only from the internal network

• Kubernetes access is possible only from the internal network

• Only minimal permissions are granted

• No unauthorized access

AWS Stage

Separated AWS Account for the Stage resources.

Permissions

• Admin : Can list, create, delete, modify AWS resources.

• Container Image Admin : Can list, create, delete, modify (in snapshot repositories) Docker images.

• Container Image Read : Can list Docker images.

• S3 Backup : Can list, create, delete, modify items in the Backup S3 Bucket.

• Stage Deploy : Can list, create, delete, modify Kubernetes resources and list Docker images.

• Admin
  1 DevOps Engineer
  3 Infrastructure Engineer ( 3 Contractor )
  1 Software Developer

• Container Image Admin
  1 Technical Account

• Container Image Read
  1 Technical Account

• S3 Backup
  1 Technical Account

• Stage Deploy
  2 Software Developer ( 1 Contractor )

AWS Stage Bastion

EC2 instance to access the Stage internal network and databases.

Permissions

• Root : Can administer Linux OS.

• User : Can log in and access the internal network of the Staging environment.

• Root
  1 DevOps Engineer
  1 Infrastructure Engineer ( 1 Contractor )

• User
  1 DevOps Engineer
  2 Infrastructure Engineer ( 2 Contractor )
  3 Software Developer ( 1 Contractor )
  1 Test Engineer
  1 Technical Account

AWS Production Environment

• Cloud Console access is restricted only to authorized persons

• SSH access is protected by keys and MFA

• Database access is possible only from the internal network

• Kubernetes access is possible only from the internal network

• Only minimal permissions are granted

• No unauthorized access

AWS Prod

Separated AWS Account for the Prod resources.

Permissions

• Admin : Can list, create, delete, modify AWS resources.

• Container Image Admin : Can list, create, delete, modify (in snapshot repositories) Docker images.

• Prod Deploy : Can list, create, delete, modify Kubernetes resources and list Docker images.

• Admin
  1 DevOps Engineer
  1 Infrastructure Engineer ( 1 Contractor )
  1 Software Developer

• Container Image Admin
  1 Technical Account

• Prod Deploy
  2 Software Developer ( 1 Contractor )

AWS Prod Bastion

EC2 instance to access the Prod internal network and databases.

Permissions

• Root : Can administer Linux OS.

• User : Can log in and access the internal network of the Production environment.

• Root
  1 DevOps Engineer
  1 Infrastructure Engineer ( 1 Contractor )

• User
  3 Software Developer ( 1 Contractor )
  1 Technical Account

Log Analysis and Monitoring

Datadog Loggin and Monitoring System

• Login access is restricted only to authorized persons

• Only minimal permissions are granted

• No unauthorized access

Datadog

Log management and monitoring tool for our staging and production applications.

Permissions

• Admin : Can administer all resources. Can not delete logs.

• Write : Can read, create, delete, modify monitors, dashboards. Can read logs.

• Read : Can read monitors, dashboards, logs.

• Admin
  1 DevOps Engineer
  1 Software Developer
  1 Technical Account

• Write
  1 DevOps Engineer
  1 Software Developer ( 1 Contractor )

• Read
  1 Infrastructure Engineer ( 1 Contractor )
  4 Software Developer
  2 Test Engineer
  3 Support Agent
  3 Product Owner