GROM-LABProject Atlas · Reference architecture
A fictional, industry-neutral architecture exercise showing how I turn business requirements and credible threats into design decisions that teams can build and operate.
Scenario
Project Atlas is a fictional multi-tenant SaaS platform used by organisations to manage sensitive documents, workflows and partner integrations. Customers use a public web application; partners integrate through an API; administrators use a separate privileged interface.
The design assumes an Azure PaaS-first delivery model, Entra ID for the workforce, OAuth client credentials for partner integrations, infrastructure as code and GitHub Actions for deployment. No design, hostname, process or control state represents a real employer.
Diagram 01 · Target state
Trust boundaries are deliberate: public traffic terminates at the edge, workloads reach data services privately, and identities—not network location alone—authorise each action.
Architecture decisions
The privileged interface uses a distinct hostname, Conditional Access policy and access path. Eligible roles activate through PIM rather than remaining permanently assigned.
Reduces:Session theft, privilege persistence and accidental administration.SQL, Blob Storage and Key Vault use private endpoints. Application managed identities replace embedded secrets and shared connection credentials.
Reduces:Internet exposure, credential leakage and uncontrolled data-plane access.Infrastructure changes are peer-reviewed, scanned and deployed through short-lived federated credentials. Production changes require approval and create auditable evidence.
Reduces:Configuration drift, long-lived secrets and unreviewed change.Identity, WAF, application, control-plane and data-access telemetry are routed centrally with health monitoring, retention and named response ownership.
Reduces:Detection blind spots and slow, evidence-poor response.Diagram 02 · Trust boundaries
Resilience & assurance
Zone-redundant services are used where the service tier supports them. Database point-in-time restore and geo-redundant storage are tested against the 15-minute RPO and two-hour RTO rather than treated as configuration claims.
Release evidence includes policy compliance, external exposure checks, identity-path tests, backup restoration and confirmation that critical telemetry reaches monitoring. Exceptions have owners and expiry dates.
Residual risk register
Short sessions, anomaly detection and step-up authentication for sensitive actions.
MediumPIM, approval, segregation of duties and immutable audit export reduce—but cannot eliminate—insider risk.
MediumBackups are geo-redundant; full active-active operation is rejected as disproportionate to the stated availability target.
LowBack to the lab book
Back to all projects →