GCP-US-Federal-Agency-Example/ARCHITECTURE_REPORT.json at main · Merlin-Studio/GCP-US-Federal-Agency-Example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
[
  {
    "category": "IP Planning",
    "check": "Hub subnet sizing",
    "status": "PASS",
    "score_impact": 0,
    "weight": 10,
    "explanation": "Hub subnets are adequately sized."
  },
  {
    "category": "IP Planning",
    "check": "CIDR overlap",
    "status": "PASS",
    "score_impact": 0,
    "weight": 20,
    "explanation": "No IP range overlap between VPC subnets and on-premises networks."
  },
  {
    "category": "IP Planning",
    "check": "GKE secondary ranges",
    "status": "PASS",
    "score_impact": 0,
    "weight": 15,
    "explanation": "Secondary IP ranges configured for GKE pod/service networking."
  },
  {
    "category": "Multi-Region",
    "check": "DR region configured",
    "status": "PASS",
    "score_impact": 0,
    "weight": 15,
    "explanation": "DR region configured: us-east1."
  },
  {
    "category": "Multi-Region",
    "check": "DR data sovereignty",
    "status": "PASS",
    "score_impact": 0,
    "weight": 20,
    "explanation": "DR region is in the same country as primary region."
  },
  {
    "category": "Multi-Region",
    "check": "DR subnet coverage",
    "status": "PASS",
    "score_impact": 0,
    "weight": 15,
    "explanation": "3 subnet(s) configured in DR region us-west2."
  },
  {
    "category": "GKE",
    "check": "Network refs valid",
    "status": "PASS",
    "score_impact": 0,
    "weight": 20,
    "explanation": "GKE network references match defined VPCs/subnets."
  },
  {
    "category": "GKE",
    "check": "Private cluster",
    "status": "PASS",
    "score_impact": 0,
    "weight": 10,
    "explanation": "All production GKE clusters use private cluster mode."
  },
  {
    "category": "Hybrid",
    "check": "Interconnect redundancy",
    "status": "PASS",
    "score_impact": 0,
    "weight": 10,
    "explanation": "1 Interconnect connection(s) with 'NONE' redundancy meets 99% availability target."
  },
  {
    "category": "Hybrid",
    "check": "VLAN region",
    "status": "PASS",
    "score_impact": 0,
    "weight": 5,
    "explanation": "All VLAN attachments have regions configured."
  },
  {
    "category": "Naming",
    "check": "Cross-section consistency",
    "status": "PASS",
    "score_impact": 0,
    "weight": 15,
    "explanation": "Cross-section resource name references are consistent."
  },
  {
    "category": "Identity",
    "check": "SA least privilege",
    "status": "PASS",
    "score_impact": 0,
    "weight": 15,
    "explanation": "All service accounts use purpose-specific predefined roles."
  },
  {
    "category": "Security",
    "check": "CMEK Encryption",
    "status": "WARN",
    "score_impact": -5,
    "weight": 10,
    "explanation": "CMEK enabled but no key rings configured. The CMEK composer will auto-generate keys from workload services."
  },
  {
    "category": "Security",
    "check": "DLP Configuration",
    "status": "PASS",
    "score_impact": 0,
    "weight": 0,
    "explanation": "DLP check skipped \u2014 Advanced Security section not applicable for this profile/compliance."
  },
  {
    "category": "Security",
    "check": "Cloud Armor WAF",
    "status": "PASS",
    "score_impact": 0,
    "weight": 10,
    "explanation": "Cloud Armor enabled with 1 WAF policy(ies)."
  },
  {
    "category": "Identity",
    "check": "Service accounts",
    "status": "PASS",
    "score_impact": 0,
    "weight": 10,
    "explanation": "Custom service accounts defined."
  },
  {
    "category": "Hierarchy",
    "check": "Hierarchy type",
    "status": "PASS",
    "score_impact": 0,
    "weight": 20,
    "explanation": "Using combined hierarchy."
  },
  {
    "category": "Security",
    "check": "Org policies",
    "status": "PASS",
    "score_impact": 0,
    "weight": 50,
    "explanation": "15 organization policies enforced."
  },
  {
    "category": "Logging",
    "check": "Log retention",
    "status": "PASS",
    "score_impact": 0,
    "weight": 5,
    "explanation": "Audit logging configured with adequate retention."
  }
]