https://console.controlmonkey.io/static/js/35.e1ae8b3d.chunk.js

1(this["webpackJsonpcm-console"]=this["webpackJsonpcm-console"]||[]).push([[35],{1143:function(e,t,o){"use strict";o.d(t,"e",(function(){return n})),o.d(t,"o",(function(){return r})),o.d(t,"q",(function(){return i})),o.d(t,"p",(function(){return c})),o.d(t,"n",(function(){return u})),o.d(t,"a",(function(){return h})),o.d(t,"k",(function(){return g})),o.d(t,"l",(function(){return b})),o.d(t,"j",(function(){return m})),o.d(t,"f",(function(){return y})),o.d(t,"r",(function(){return p})),o.d(t,"s",(function(){return v})),o.d(t,"b",(function(){return R})),o.d(t,"t",(function(){return E})),o.d(t,"i",(function(){return G})),o.d(t,"h",(function(){return I})),o.d(t,"d",(function(){return P})),o.d(t,"c",(function(){return M})),o.d(t,"m",(function(){return j})),o.d(t,"g",(function(){return q})),o.d(t,"u",(function(){return T})),o.d(t,"w",(function(){return K})),o.d(t,"v",(function(){return C}));var a=o(11),s=o(6),n={BACKUP:{key:"backup",label:"Backup & Recovery Points",icon:"database"},XREGION:{key:"xregion",label:"Cross-Region & Cross-Account",icon:"globe"},IMMUT:{key:"immut",label:"Immutability & Deletion Protection",icon:"lock"},REDUND:{key:"redund",label:"Redundancy & Failover",icon:"nodes"},IAC:{key:"iac",label:"IaC & Recoverability",icon:"code"},OBJ:{key:"obj",label:"Recovery Objectives",icon:"clock"}},r={CRITICAL:"critical",HIGH:"high",MEDIUM:"medium",LOW:"low"},i=[r.CRITICAL,r.HIGH,r.MEDIUM,r.LOW],c={critical:"Critical",high:"High",medium:"Medium",low:"Low"},d=[{id:"848028448276",name:"CM Demo"},{id:"374000778541",name:"Networking"},{id:"615372048829",name:"Production EU"},{id:"209481773650",name:"Shared Services"},{id:"731905524418",name:"Staging"},{id:"486120397755",name:"Sandbox"}],l=["us-east-1","us-west-2","eu-west-1","eu-central-1"],u={"us-east-1":"US East (N. Virginia)","us-west-2":"US West (Oregon)","eu-west-1":"Europe (Ireland)","eu-central-1":"Europe (Frankfurt)","ap-southeast-1":"Asia Pacific (Singapore)",eastus:"East US",westeurope:"West Europe",northeurope:"North Europe",southeastasia:"Southeast Asia","us-central1":"Iowa","europe-west1":"Belgium","asia-southeast1":"Singapore"},p=["Security Team","SRE","Networking Team","Team A","QA","Developers","DBA","Sales Engineers","DevOps"],g=[{key:"aws",name:"AWS",icon:"aws",accounts:d,regions:l},{key:"azure",name:"Azure",icon:"azure",accounts:[{id:"deac18c3-20ee-482c-8efe-a8374c4daddd",name:"Azure Demo"},{id:"7b41f92e-3c5d-4a08-9f27-61ce8a0b4d13",name:"Azure Sandbox"}],regions:["eastus","westeurope","northeurope","southeastasia"]},{key:"gcp",name:"GCP",icon:"gcp",accounts:[{id:"sales-demo-418511",name:"GCP Demo"}],regions:["us-central1","europe-west1","asia-southeast1"]},{key:"datadog",name:"Datadog",icon:"datadog",accounts:[{id:"c9076de2-5c27-11f0-ab3a-02bdf89964d3",name:"Datadog CM"}],regions:["us1","eu1"]},{key:"cloudflare",name:"Cloudflare",icon:"cloudflare",accounts:[{id:"06408c8b89a546fb5cbfdad866fd7d6a",name:"Cloudflare Sales Demo"}],regions:["global"]}],h=g.flatMap((function(e){return e.accounts})),b=(Object.fromEntries(g.flatMap((function(e){return e.accounts.map((function(t){return[t.id,e.key]}))}))),{aws:{rds:"RDS",ddb:"DynamoDB",s3:"S3",ec2:"EC2",ebs:"EBS",efs:"EFS",redshift:"Redshift",opensearch:"OpenSearch",cache:"ElastiCache",asg:"Auto Scaling",docdb:"DocumentDB",alb:"Load Balancer"},azure:{rds:"SQL Database",ddb:"Cosmos DB",s3:"Blob Storage",ec2:"Virtual Machine",ebs:"Managed Disk",efs:"Azure Files",redshift:"Synapse",opensearch:"AI Search",cache:"Azure Cache",asg:"VM Scale Set",docdb:"Cosmos DB For MongoDB",alb:"Application Gateway"},gcp:{rds:"Cloud SQL",ddb:"Firestore",s3:"Cloud Storage",ec2:"Compute Engine",ebs:"Persistent Disk",efs:"Filestore",redshift:"BigQuery",opensearch:"Elasticsearch",cache:"Memorystore",asg:"Instance Group",docdb:"Datastore",alb:"Cloud Load Balancing"},datadog:{rds:"Database Monitor",ddb:"Metric Monitor",s3:"Log Archive",ec2:"Host Monitor",ebs:"Disk Monitor",efs:"Storage Monitor",redshift:"Analytics Dashboard",opensearch:"Log Index",cache:"Cache Monitor",asg:"Service Monitor",docdb:"Database Monitor",alb:"Synthetic Test"},cloudflare:{rds:"D1 Database",ddb:"KV Namespace",s3:"R2 Bucket",ec2:"Worker",ebs:"Durable Object",efs:"R2 Bucket",redshift:"Analytics Engine",opensearch:"Vectorize Index",cache:"Cache Reserve",asg:"Worker Route",docdb:"D1 Database",alb:"Load Balancer"}}),f={azure:{rds:"Microsoft.Sql/servers/databases",ddb:"Microsoft.DocumentDB/databaseAccounts",s3:"Microsoft.Storage/storageAccounts",ec2:"Microsoft.Compute/virtualMachines",ebs:"Microsoft.Compute/disks",efs:"Microsoft.Storage/fileServices",redshift:"Microsoft.Synapse/workspaces",opensearch:"Microsoft.Search/searchServices",cache:"Microsoft.Cache/redis",asg:"Microsoft.Compute/virtualMachineScaleSets",docdb:"Microsoft.DocumentDB/mongoClusters",alb:"Microsoft.Network/applicationGateways"},datadog:{rds:"datadog/database_monitor",ddb:"datadog/metric_monitor",s3:"datadog/log_archive",ec2:"datadog/host_monitor",ebs:"datadog/disk_monitor",efs:"datadog/storage_monitor",redshift:"datadog/dashboard",opensearch:"datadog/log_index",cache:"datadog/cache_monitor",asg:"datadog/service_monitor",docdb:"datadog/database_monitor",alb:"datadog/synthetic_test"},cloudflare:{rds:"cloudflare/d1_database",ddb:"cloudflare/kv_namespace",s3:"cloudflare/r2_bucket",ec2:"cloudflare/worker",ebs:"cloudflare/durable_object",efs:"cloudflare/r2_bucket",redshift:"cloudflare/analytics_engine",opensearch:"cloudflare/vectorize_index",cache:"cloudflare/cache_reserve",asg:"cloudflare/worker_route",docdb:"cloudflare/d1_database",alb:"cloudflare/load_balancer"},gcp:{rds:"sqladmin.googleapis.com/Instance",ddb:"firestore.googleapis.com/Database",s3:"storage.googleapis.com/Bucket",ec2:"compute.googleapis.com/Instance",ebs:"compute.googleapis.com/Disk",efs:"file.googleapis.com/Instance",redshift:"bigquery.googleapis.com/Dataset",opensearch:"elasticsearch.googleapis.com/Cluster",cache:"redis.googleapis.com/Instance",asg:"compute.googleapis.com/InstanceGroup",docdb:"datastore.googleapis.com/Database",alb:"compute.googleapis.com/Backen

1dService"}},m=[{id:"pol-1",name:"Tier-1 Production Databases",tier:"mission",tierLabel:"Mission Critical",desc:"Customer-facing transactional data. Must survive a Region loss.",rpo:"15 min",rto:"1 h",lastEval:"12 minutes ago",status:"Active",req:{multiAz:!0,minAz:3,xRegion:!0,xAccount:!0,verifyDeps:!0,backupFreq:"Every 1 hour",retention:"90 days",maxRpAge:"2 hours",pitr:!0,vaultLock:"Compliance",deletionProtection:!0,drill:"Every 30 days",kmsKeyType:"Multi-Region customer-managed"},dest:{regions:["us-west-2"],accounts:["374000778541"]}},{id:"pol-2",name:"Regulated Data (EU)",tier:"critical",tierLabel:"Critical",desc:"GDPR-scoped data. Recovery must stay inside the EU.",rpo:"1 h",rto:"4 h",lastEval:"12 minutes ago",status:"Active",req:{multiAz:!0,minAz:2,xRegion:!0,xAccount:!0,verifyDeps:!0,backupFreq:"Every 12 hours",retention:"35 days",maxRpAge:"24 hours",pitr:!0,vaultLock:"Governance",deletionProtection:!0,drill:"Every 90 days",kmsKeyType:"Customer-managed"},dest:{regions:["eu-central-1"],accounts:["615372048829"]}},{id:"pol-3",name:"Internal Services",tier:"important",tierLabel:"Important",desc:"Internal tooling. Region-local recovery is acceptable.",rpo:"12 h",rto:"24 h",lastEval:"1 hour ago",status:"Active",req:{multiAz:!0,minAz:2,xRegion:!1,xAccount:!1,verifyDeps:!1,backupFreq:"Every 24 hours",retention:"30 days",maxRpAge:"36 hours",pitr:!1,vaultLock:"Off",deletionProtection:!1,drill:"Every 180 days",kmsKeyType:"Any"},dest:{regions:[],accounts:[]}}],y=[{id:"RES-COV-101",ootb:!0,cat:n.BACKUP,sev:r.CRITICAL,title:"Unprotected Data Resources",desc:"Stateful resources with no backup plan and no native automated backup.",resources:38,accounts:3,regions:3,trend:6,example:"38 stateful resources have no backup at all, including 9 RDS instances, 14 EBS volumes and 6 DynamoDB tables.",fix:"Assign these resources to an AWS Backup plan, or enable the service's native automated backup.",source:"AWS Backup Audit Manager - resources included in at least one backup plan"},{id:"RES-COV-102",ootb:!0,cat:n.BACKUP,sev:r.CRITICAL,title:"Stale Backups Beyond The Backup Window",desc:"A backup plan exists and the resource reads as protected, but jobs have been failing.",resources:17,accounts:2,regions:2,trend:4,example:"17 resources have not produced a recovery point within their backup window; 11 are more than 7 days stale.",fix:"Investigate the failing backup jobs and take an on-demand backup of the affected resources.",source:"AWS Backup Audit Manager - last recovery point was created"},{id:"RES-DST-101",ootb:!0,cat:n.XREGION,sev:r.CRITICAL,title:"Recovery Points Encrypted With Non-Portable Keys",desc:"AWS-managed key policies are immutable and cannot be shared across accounts.",resources:29,accounts:2,regions:3,trend:2,example:"29 recovery points use AWS-managed keys that cannot be shared cross-account, blocking the configured copy for 12 RDS instances and 9 EBS volumes.",fix:"Re-encrypt with a customer-managed KMS key, using a multi-Region key where the copy crosses Regions.",source:"AWS Backup encryption + cross-account copy troubleshooting"},{id:"RES-IAC-101",ootb:!0,cat:n.IAC,sev:r.HIGH,title:"Data Recoverable But Infrastructure Is Not",desc:"You can restore the volume, but there is nothing to attach it to.",resources:84,accounts:3,regions:3,trend:-3,example:"84 resources have healthy backups but no IaC definition; restoring them requires manually rebuilding 31 dependent VPC, security group and IAM resources.",fix:"Import these resources and their dependencies into a Terraform stack so the recovery target can be rebuilt.",source:"Well-Architected REL13-BP04 / BP05 - ControlMonkey differentiator"},{id:"RES-IMM-101",ootb:!0,cat:n.IMMUT,sev:r.HIGH,title:"Backup Vaults Without Immutability",desc:"Anyone holding backup:DeleteRecoveryPoint can destroy the last copy.",resources:118,accounts:3,regions:3,trend:0,example:"7 of 9 backup vaults have no Vault Lock; 164 recovery points across 3 accounts can be manually deleted.",fix:"Apply AWS Backup Vault Lock in compliance mode, or deny manual deletion in the vault access policy.",source:"AWS Backup Vault Lock;

1 Config BACKUP_RECOVERY_POINT_MANUAL_DELETION_DISABLED"},{id:"RES-SPF-101",ootb:!0,cat:n.REDUND,sev:r.HIGH,title:"Single-AZ Data Tier",desc:"An AZ event takes the database offline with no automatic failover, degrading RTO from seconds to hours.",resources:14,accounts:3,regions:2,trend:1,example:"14 data-tier resources run in a single Availability Zone: 8 RDS instances, 4 ElastiCache replication groups and 2 One Zone EFS file systems.",fix:"Convert to a Multi-AZ deployment, or add a replica in a second Availability Zone.",source:"AWS Resilience Hub - Single-AZ deployment checks"},{id:"RES-CAP-101",ootb:!0,cat:n.OBJ,sev:r.MEDIUM,title:"Point-In-Time Recovery Disabled",desc:"Daily snapshots mean up to 24 h of data loss on a logical corruption. PITR cuts that to ~5 minutes.",resources:24,accounts:2,regions:3,trend:-2,example:"19 DynamoDB tables and 5 RDS instances have point-in-time recovery disabled; worst-case data loss is 24 hours.",fix:"Enable point-in-time recovery, or automated backups, on the resource.",source:"Config DYNAMODB_PITR_ENABLED / DB_INSTANCE_BACKUP_ENABLED"},{id:"RES-DEP-001",ootb:!1,policy:"pol-1",cat:n.XREGION,sev:r.CRITICAL,title:"KMS Key Not Available In Destination Region",desc:"The resource's key has no replica in the destination region.",resources:22,accounts:2,regions:2,trend:11,rule:"Cross-Region Recovery \u2192 Destination Region",example:"prod-orders-db is encrypted with a single-Region key that has no replica in us-west-2. Snapshot copy fails with KMSKeyNotAccessibleFault.",fix:"Create a multi-Region KMS key replica in us-west-2, or specify a destination-region key on the copy action.",source:"aws-samples/aws-tf-kms - multi-region replica & cross-account access"},{id:"RES-RPO-001",ootb:!1,policy:"pol-1",cat:n.OBJ,sev:r.CRITICAL,title:"Achieved RPO Exceeds Target RPO",desc:"The newest recovery point (in the Region the policy requires recovery from) is older than the target allows.",resources:62,accounts:3,regions:2,trend:9,rule:"Target RPO",example:"Achieved RPO for prod-orders-db in us-west-2 is 4h 12m against a target of 15m.",fix:"Increase copy frequency, or switch to a cross-Region read replica.",source:"Measured from newest recovery point in the policy's required scope"},{id:"RES-DST-201",ootb:!1,policy:"pol-1",cat:n.XREGION,sev:r.CRITICAL,title:"Destination Vault Denies Copy From Source Account",desc:"The destination vault has no access policy permitting the source account, so every copy job is denied.",resources:68,accounts:1,regions:1,trend:34,rule:"Cross-Account Recovery \u2192 Destination Account",example:"Vault dr-vault in account 374000778541 has no policy allowing backup:CopyIntoBackupVault from 848028448276. All 34 copy jobs are denied.",fix:"Add a vault access policy allowing backup:CopyIntoBackupVault from the source account.",source:"AWS Backup - creating backup copies across accounts"},{id:"RES-COV-201",ootb:!1,policy:"pol-1",cat:n.XREGION,sev:r.CRITICAL,title:"Cross-Region Copy Not Configured",desc:"The resource is protected in its source Region, but no backup rule copies it to the policy's destination.",resources:62,accounts:3,regions:3,trend:5,rule:"Cross-Region Recovery",example:"prod-orders-db is protected in us-east-1 but no backup rule copies to us-west-2, as required by Tier-1 Production Databases.",fix:"Add a copy action to us-west-2 on the backup rule.",source:"Policy destination vs. configured copy actions"},{id:"RES-RTO-001",ootb:!1,policy:"pol-1",cat:n.OBJ,sev:r.CRITICAL,title:"Estimated RTO Exceeds Target RTO",desc:"Modeled restore time is longer than the policy allows.",resources:46,accounts:3,regions:2,trend:7,rule:"Target RTO",example:"Estimated RTO for prod-orders-db is 4h 10m against a target of 1h: detect 5m + decide 10m + copy 2h 05m + restore 1h 20m + cutover 30m.",fix:"Pre-stage a cross-Region read replica so recovery is a promotion, not a restore.",source:"Additive RTO model, calibrated by restore-test timings where available"},{id:"RES-DEP-002",ootb:!1,policy:"pol-1",cat:n.XREGION,sev:r.CRITICAL,title:"AMI Not Copied To Destination Region",desc:"The launch template in the destination references an AMI ID that does not resolve there.",resources:14,accounts:2,regions:2,trend:7,rule:"Cross-Region Recovery \u2192 Verify Dependencies",example:"web-tier-01 boots from ami-0a1b2c3d which exists only in us-east-1. Recovery would produce an instance that cannot start.",fix:"Copy the AMI to us-west-2 and update the destination launch template.",source:"aws-samples/sample-multi-region-application-architecture"},{id:"RES-COV-202",ootb:!1,policy:"pol-1",alsoPolicies:["pol-2","pol-3"],cat:n.OBJ,sev:r.HIGH,title:"Backup Frequency Coarser Than Target RPO",desc:"Structurally unable to meet the target even when every backup succeeds.",resources:48,accounts:3,regions:3,trend:0,rule:"Target RPO vs Backup Frequency",example:"inventory-db is backed up every 24h. The policy targets an RPO of 15m, so this resource can never comply.",fix:"Increase backup frequency, or enable point-in-time recovery.",source:"Backup plan cron vs. policy target RPO"},{id:"RES-DEP-003",ootb:!1,policy:"pol-2",cat:n.XREGION,sev:r.HIGH,title:"Secret Not Replicated To Destination Region",desc:"The restored database comes up, but no application can authenticate to it.",resources:24,accounts:2,regions:2,trend:12,rule:"Cross-Region Recovery \u2192 Verify Dependencies",example:"prod-orders-db credentials live in secret prod/orders/db with no replica in eu-central-1.",fix:"Add a replica region to the secret.",source:"Secrets Manager multi-Region replicas"},{id:"RES-CAP-201",ootb:!1,policy:"pol-1",cat:n.REDUND,sev:r.HIGH,title:"Multi-AZ Not Enabled",desc:"The resource exposes a Multi-AZ capability that is switched off.",resources:18,accounts:2,regions:2,trend:-1,rule:"Multi-AZ Resilience",example:"prod-orders-db (AWS::RDS::DBInstance, us-east-1) is Single-AZ. Tier-1 Production Databases requires Multi-AZ across at least 3 zones.",f

1ix:"Modify the instance to Multi-AZ, or add a standby replica in a second zone.",source:"Policy Multi-AZ requirement vs. resource configuration"},{id:"RES-QTA-001",ootb:!1,policy:"pol-1",cat:n.OBJ,sev:r.CRITICAL,title:"Destination Region Quota Below Production Usage",desc:"Failover would stall part-way. Quota increases take days to approve, so this cannot be fixed during an incident.",resources:12,accounts:2,regions:1,trend:6,rule:"Target RTO \u2192 Destination Region",example:"us-east-1 runs 384 Standard vCPUs. The us-west-2 applied quota is 64. A full failover would stall at 17% of production capacity.",fix:"Raise destination-region quotas to at least production usage plus headroom.",source:"AWS DR whitepaper (Warm Standby) + Service Quotas usage vs. applied quota"},{id:"RES-DEP-007",ootb:!1,policy:"pol-1",cat:n.XREGION,sev:r.CRITICAL,title:"RDS Option Group Missing In Destination Region",desc:"Option groups cannot be copied across Regions.",resources:8,accounts:1,regions:1,trend:4,rule:"Cross-Region Recovery \u2192 Verify Dependencies",example:"oracle-erp-db uses option group prod-oracle-tde, absent in us-west-2. Copy fails with \u201cThe snapshot requires a target option group\u201d.",fix:"Pre-create an identical option group in the destination Region before the next copy.",source:"AWS Backup cross-Region copy - option groups must be created manually"},{id:"RES-DEP-006",ootb:!1,policy:"pol-1",cat:n.XREGION,sev:r.MEDIUM,title:"Private Hosted Zone Not Associated With Destination VPC",desc:"Everything else recovers, and internal service discovery still returns NXDOMAIN.",resources:10,accounts:2,regions:2,trend:5,rule:"Cross-Region Recovery \u2192 Verify Dependencies",example:"Private hosted zone svc.internal is associated only with vpc-0aa1 in us-east-1. Recovered workloads in us-west-2 cannot resolve db.svc.internal.",fix:"Associate the destination VPC with the hosted zone. Cross-account requires the CLI, not the console.",source:"Route 53 - associating a PHZ with VPCs in different accounts"}],v={mission:{label:"Mission Critical",cls:"mission"},critical:{label:"Critical",cls:"critical"},important:{label:"Important",cls:"important"},low:{label:"Non-Critical",cls:"noncritical"}},R=[{id:"app-1",name:"Checkout & Payments",tier:"mission",owner:"Developers",desc:"Cart, checkout, payment authorization and the order write path.",rules:{accounts:["848028448276","374000778541"],regions:["us-east-1","us-west-2"],types:["rds","ddb","ec2","asg","alb","cache"],tags:[["App","checkout"]]},added:["public-alb"],excluded:[],policy:"pol-1"},{id:"app-2",name:"Customer Data Platform",tier:"critical",owner:"DBA",desc:"Customer records, documents and consent data. GDPR scoped.",rules:{accounts:["615372048829","374000778541"],regions:["eu-west-1","us-east-1"],types:["s3","ddb","efs","docdb"],tags:[["DataClass","regulated"]]},added:[],excluded:[],policy:"pol-2"},{id:"app-3",name:"Analytics Pipeline",tier:"critical",owner:"DBA",desc:"Ingestion, warehouse and the reporting API.",rules:{accounts:["374000778541","209481773650"],regions:["us-east-1"],types:["redshift","s3","opensearch","ec2","ebs"],tags:[["App","analytics"]]},added:[],excluded:["etl-scratch-vol"],policy:"pol-1"},{id:"app-4",name:"Internal Tooling",tier:"important",owner:"SRE",desc:"CI, artifact storage and internal dashboards.",rules:{accounts:["209481773650","731905524418"],regions:["us-east-1","us-west-2"],types:["ec2","ebs","efs","cache","asg"],tags:[["Environment","internal"]]},added:[],excluded:[],policy:"pol-3"},{id:"app-5",name:"Marketing Site",tier:"low",owner:"Team A",desc:"Public marketing pages and the CDN origin.",rules:{accounts:["731905524418"],regions:["us-east-1"],types:["s3","ec2","alb"],tags:[["App","marketing"]]},added:[],excluded:[],policy:"pol-3"}],S=["production","staging","internal"],E={rds:"AWS::RDS::DBInstance",ddb:"AWS::DynamoDB::Table",s3:"AWS::S3::Bucket",ec2:"AWS::EC2::Instance",ebs:"AWS::EC2::Volume",efs:"AWS::EFS::FileSystem",redshift:"AWS::Redshift::Cluster",opensearch:"AWS::OpenSearchService::Domain",cache:"AWS::ElastiCache::ReplicationGroup",asg:"AWS::AutoScaling::AutoScalingGroup",docdb:"AWS::DocDB::DBCluster",alb:"AWS::ElasticLoadBalancingV2::LoadBalancer"},A={rds:["orders","payments","inventory","billing","reports","erp","ledger"],ddb:["sessions","carts","profiles","audit","idempotency","catalog"],s3:["documents","pii-store","data-lake","assets","backups","exports"],ec2:["web-tier","batch","jenkins","bastion","worker","ingest"],ebs:["app-data","etl-scratch","index-vol","log-vol"],efs:["shared-assets","media-store","home-dirs"],redshift:["warehouse","marts"],opensearch:["search","logs"],cache:["session-cache","rate-limit","lookup-cache"],asg:["api-asg","worker-asg","web-

1asg"],docdb:["ledger-docdb","events-docdb"],alb:["public-alb","internal-alb","api-alb"]};[["Order Fulfilment","mission","Developers","Warehouse allocation and shipping events.","pol-1",["rds","ddb","ec2"],["848028448276"],["us-east-1"],46],["Customer Identity","mission","Security Team","Login, sessions and consent records.","pol-1",["ddb","cache","rds"],["848028448276","374000778541"],["us-east-1","us-west-2"],38],["Billing & Invoicing","critical","Team A","Invoice generation and revenue recognition.","pol-1",["rds","s3"],["374000778541"],["us-east-1"],52],["Notification Service","critical","SRE","Email, SMS and push delivery.","pol-3",["ddb","ec2","asg"],["209481773650"],["us-east-1"],34],["Search & Discovery","critical","Developers","Product search index and query API.","pol-3",["opensearch","ec2","ebs"],["209481773650"],["us-west-2"],41],["Content Management","important","Team A","Editorial content and media assets.","pol-3",["s3","efs","ec2"],["731905524418"],["us-east-1"],29],["Partner API Gateway","critical","Networking Team","Third-party partner integrations.","pol-2",["ec2","asg","alb"],["615372048829"],["eu-west-1"],27],["Fraud Detection","mission","Security Team","Real-time transaction scoring.","pol-1",["ddb","redshift","ec2"],["374000778541"],["us-east-1"],31],["Data Warehouse","critical","DBA","Nightly ETL and BI serving layer.","pol-1",["redshift","s3","ebs"],["374000778541"],["us-west-2"],44],["Employee Portal","important","QA","Internal HR and IT self-service.","pol-3",["rds","ec2"],["209481773650"],["us-east-1"],23],["Loyalty Programme","important","Sales Engineers","Points, tiers and rewards.","pol-3",["ddb","rds"],["731905524418"],["us-west-2"],19],["Document Archive","critical","Security Team","Long-term regulated document retention.","pol-2",["s3","efs"],["615372048829"],["eu-west-1"],26],["Mobile Backend","critical","DevOps","Mobile app API and device registry.","pol-3",["ddb","ec2","alb"],["848028448276"],["us-west-2"],33],["Reporting Service","important","DBA","Scheduled customer-facing reports.","pol-3",["rds","s3"],["209481773650"],["eu-central-1"],21],["Config Service","important","SRE","Feature flags and runtime config.","pol-3",["ddb","cache"],["209481773650"],["us-east-1"],16],["Media Transcoding","low","QA","Video and image processing pipeline.","pol-3",["ec2","ebs","s3"],["731905524418"],["us-west-2"],24],["Internal Wiki","low","QA","Documentation and runbooks.","pol-3",["ec2","efs"],["486120397755"],["us-west-2"],14],["Sandbox Experiments","low","SRE","Engineering scratch environments.","pol-3",["ec2","ebs"],["486120397755"],["eu-central-1"],18]].forEach((function(e,t){var o=Object(s.a)(e,9),a=o[0],n=o[1],r=o[2],i=o[3],c=o[4],d=o[5],l=o[6],u=o[7],p=o[8];R.push({id:"app-".concat(t+6),name:a,tier:n,owner:r,desc:i,rules:{accounts:l,regions:u,types:d,tags:[]},added:[],excluded:[],policy:c||null,_size:p})}));var D={"app-1":128,"app-2":96,"app-3":74,"app-4":210,"app-5":38};R.forEach((function(e){e._size&&(D[e.id]=e._size)}));var k={"app-1":"checkout","app-2":null,"app-3":"analytics","app-4":null,"app-5":"marketing"};R.forEach((function(e){e.id in k||(k[e.id]=null)}));var C=function(e){return(b[e.provider]||b.aws)[e.kind]||G[e.kind]||e.kind},I=function(){var e=[],t=0,o=function(e,o,a,s,n,r,i){var c=A[e]||[e],l=c[o%c.length],u=Math.floor(o/c.length);return{id:"r-".concat(t++),name:0===u?l:"".concat(l,"-").concat(String(u+1).padStart(2,"0")),kind:e,type:E[e],account:a,accountName:(d.find((function(e){return e.id===a}))||{}).name||a,region:s,env:n,appTag:r,dataClass:i}};R.forEach((function(t){for(var a=D[t.id]||40,s=t.rules,n=s.accounts,r=s.regions,i=s.types,c=s.tags||[],d=(c.find((function(e){return"Environment"===e[0]}))||[])[1],l=(c.find((function(e){return"DataClass"===e[0]}))||[])[1],u=0;u<a;u++)e.push(o(i[u%i.length],u,n[u%n.length],r[u%r.length],d||S[u%S.length],k[t.id],l||(u%6===0?"regulated":"standard")))}));for(var a=1426-e.length,s=Object.keys(E),n=0;n<a;n++)e.push(o(s[n%s.length],n+7,d[(n+3)%d.length].id,l[(n+1)%l.length],"staging",null,n%9===0?"regulated":"standard"));return e.forEach((function(e){e.provider="aws"})),e}();function w(e){var t=I.filter((function(t){return function(e,t){var o,a,n,r;return!(null!==(o=t.accounts)&&void 0!==o&&o.length&&!t.accounts.includes(e.account))&&(!(null!==(a=t.regi

1ons)&&void 0!==a&&a.length&&!t.regions.includes(e.region))&&(!(null!==(n=t.types)&&void 0!==n&&n.length&&!t.types.includes(e.kind))&&!(null!==(r=t.tags)&&void 0!==r&&r.length&&!t.tags.every((function(t){var o=Object(s.a)(t,2),a=o[0],n=o[1];return"App"===a&&e.appTag===n||"Environment"===a&&e.env===n||"DataClass"===a&&e.dataClass===n})))))}(t,e.rules)&&!e.excluded.includes(t.name)})),o=I.filter((function(o){return e.added.includes(o.name)&&!t.some((function(e){return e.id===o.id}))}));return[].concat(Object(a.a)(t),Object(a.a)(o))}var P={},M={};R.forEach((function(e){w(e).forEach((function(t){P[t.id]?(M[e.id]=M[e.id]||[]).push(t):P[t.id]=e.id}))}));var T=function(e){return I.filter((function(t){return P[t.id]===e.id}))},B=[["azure",62],["gcp",44],["datadog",48],["cloudflare",18]];!function(){var e=I.filter((function(e){return!P[e.id]})),t=B.flatMap((function(e){var t=Object(s.a)(e,2),o=t[0],a=t[1];return Array(a).fill(o)}));e.slice(0,t.length).forEach((function(e,o){var a=t[o],s=g.find((function(e){return e.key===a})),n=s.accounts[o%s.accounts.length];e.provider=a,e.account=n.id,e.accountName=n.name,e.region=s.regions[o%s.regions.length],e.type=f[a][e.kind]||e.type}))}(),function(){var e=new Set(R.filter((function(e){return e.policy})).map((function(e){return e.id})));I.forEach((function(t){t.policyCovered=e.has(P[t.id])}))}();var O={"RES-COV-101":["No backup","Backup required"],"RES-COV-102":["Last RP 23d ago","Within 24h"],"RES-DST-101":["AWS-managed key","Customer-managed key"],"RES-IAC-101":["Not in IaC","Codified"],"RES-IMM-101":["No Vault Lock","Vault Lock"],"RES-SPF-101":["1 AZ","2 AZs"],"RES-CAP-101":["PITR off","PITR on"],"RES-DEP-001":["No key in us-west-2","Key available"],"RES-RPO-001":["RPO 4h 12m","RPO 15m"],"RES-DST-201":["Copy denied","Copy permitted"],"RES-COV-201":["No copy","Copy to us-west-2"],"RES-RTO-001":["RTO 4h 10m","RTO 1h"],"RES-DEP-002":["AMI in 1 Region","AMI in us-west-2"],"RES-COV-202":["Every 24h","Every 15m"],"RES-DEP-003":["No replica","Replica in eu-central-1"],"RES-CAP-201":["Single-AZ","Multi-AZ, 3 zones"],"RES-QTA-001":["64 vCPU quota","384 vCPU needed"],"RES-DEP-007":["No option group","Option group present"],"RES-DEP-006":["Zone not associated","Associated with DR VPC"]},x={"RES-COV-101":["rds","ddb","ebs","efs","s3","redshift","docdb"],"RES-COV-102":["rds","ddb","ebs","efs","redshift","docdb"],"RES-DST-101":["rds","ebs","ddb","efs","redshift"],"RES-IAC-101":["rds","ddb","ebs","efs","s3","ec2","cache","opensearch"],"RES-IMM-101":["rds","ddb","ebs","efs","s3","redshift","docdb"],"RES-SPF-101":["rds","cache","efs","opensearch","docdb"],"RES-CAP-101":["ddb","rds","s3","docdb"],"RES-DEP-001":["rds","ebs","ddb","efs","redshift"],"RES-RPO-001":["rds","ddb","s3","ebs","docdb"],"RES-DST-201":["rds","ddb","ebs","efs","s3"],"RES-COV-201":["rds","ddb","ebs","efs","s3","redshift"],"RES-RTO-001":["rds","ddb","ebs","redshift","docdb","opensearch"],"RES-DEP-002":["ec2","asg"],"RES-COV-202":["rds","ddb","ebs","docdb"],"RES-DEP-003":["rds","docdb","ec2"],"RES-CAP-201":["rds","cache","opensearch","docdb","efs"],"RES-QTA-001":["asg","ec2"],"RES-DEP-007":["rds"],"RES-DEP-006":["ec2","asg","rds"]},N=function(e){var t=new Date;return t.setDate(t.getDate()-e),t.toISOString().slice(0,10)},L=function(e){return N(-e)},W=[2,3,5,8,13,21,36,50].map(N),V=N(0),_=[{reason:"Sandbox account, data is reproducible",owner:"SRE",expires:L(103)},{reason:"Decommissioned in Q4, migration in flight",owner:"DBA",expires:L(57)},{reason:"Compensating control: nightly logical export to S3",owner:"DBA",expires:L(166)},{reason:"Accepted by risk review RR-2291",owner:"Security Team",expires:L(134)}],G={rds:"RDS",ddb:"DynamoDB",s3:"S3",ec2:"EC2",ebs:"EBS",efs:"EFS",redshift:"Redshift",opensearch:"OpenSearch",cache:"ElastiCache",asg:"Auto Scaling",docdb:"DocumentDB",alb:"Load Balancer"};var q=function(){var e=[],t=0;return y.forEach((function(o){for(var a=x[o.id],s=I.filter((function(e){return!a||a.includes(e.kind)})),n=O[o.id]||["\u2014","\u2014"],r=Math.min(o.resources,s.length),i=Math.max(1,Math.floor(s.length/r)),c=new Set,d=13*t%s.length,l=0;l<r;l++){for(var u=s[d%s.length],p=0;c.has(u.id)&&p++<s.length;)u=s[++d%s.length];c.add(u.id),d+=i,e.push({id:"".concat(o.id,"-").concat(l),checkId:o.id,check:o.title,cat:o.cat,sev:o.sev,resId:u.id,res:u.name,resType:u.type,kind:u.kind,provider:u.provider,account:u.account,region:u.region,iac:["managed","drifted","unmanaged"][(l+t)%3],policy:o.ootb?null:o.policy,cur:n[0],tgt:n[1],status:l%17===5?"suppressed":"open",suppression:l%17===5?_[(l+t)%_.length]:null,first:W[(l+t)%W.length],last:V}

1),t++}})),e}();q.forEach((function(e){e.app=P[e.resId]||null}));var z=new Set(x["RES-COV-101"]);!function(){var e=new Set(q.filter((function(e){return"RES-COV-101"===e.checkId})).map((function(e){return e.resId}))),t=new Set(q.filter((function(e){return"RES-IAC-101"===e.checkId})).map((function(e){return e.resId})));I.forEach((function(o,a){o.backupRelevant=z.has(o.kind),o.protected=o.backupRelevant&&!e.has(o.id)&&37*a%100>=30,o.codified=!t.has(o.id)&&61*a%100>=22}))}();var F={key:"full",label:"Fully Recoverable"},U={key:"data",label:"Data Recoverable"},H={key:"infra",label:"Infra Recoverable"},Z={key:"none",label:"Not Recoverable"},j=["full","data","infra","none"],K=function(e){var t=e.protected,o=e.codified;return t&&o?F:t?U:o?H:Z}},1513:function(e,t,o){}}]);