Architecture overview
Deploying this solution with the default parameters builds the following environment in the target AWS account.
![Verifiable Controls Evidence Store solution architecture diagram](/images/solutions/latest/verifiable-controls-evidence-store/images/verifiable-controls-arch-diagram-v1.1.png)
Verifiable Controls Evidence Store solution architecture diagram
Verifiable Controls Evidence Store follows a micro-service
architecture, where the presentation service (UI) is a React
single-page application. The business logic is powered by the
combination of
Amazon API Gateway
The solution provides a RESTful interface with CRUD (create, read, update, delete) APIs for managing evidence providers, as well as for storage and retrieval of evidence data.
At its core, the solution leverages Amazon Quantum Ledger Database
By default, the solution builds the following infrastructure:
-
An Amazon CloudFront
distribution to serve the optional UI. CloudFront delivers low latency, high performance, and secure static web hosting. An Amazon Simple Storage Service (Amazon S3) web UI bucket hosts the static web application artifacts. -
An Amazon Cognito
user pool to provide customers a quick and convenient authentication mechanism to explore the solution’s functionalities without extensive configuration. -
API Gateway to expose a set of RESTful APIs. API Gateway processes HTTP requests issued by the Evidence Store consumers. It orchestrates the authentication and authorization workflows by validating the request’s credentials (signature and API key) against AWS Identity and Access Management
(IAM) and its API usage plan. -
An evidence store Lambda function to process the validated requests from API Gateway. This Lambda function encapsulates the solution's business logic, receiving rest requests from the user via API Gateway, validating them and storing, and retrieving data to and from the various databases.
-
Amazon QLDB to track and store evidence records. QLDB ensures evidence records’ immutability and cryptographically verifiable nature. Evidence records are stored in Amazon S3.
-
Amazon DynamoDB
to store evidence providers and their respective evidence content schemas. The request processing Lambda function relies on this data to validate evidence content before committing to its QLDB ledger. -
A stream processing Lambda function to replicate evidence records to Amazon OpenSearch Service
, which offers advanced query capabilities (full text search) across the entire evidence record data structure. -
Amazon Kinesis Data Streams
to replicate records to Amazon OpenSearch Service to offer consumers a better query experience. Amazon Kinesis provides the channels for the solution to replicate and archive evidence records in near real-time. -
Amazon Data Firehose
to archive evidence records to an Amazon S3 bucket. -
AWS CloudWatch
and AWS X-Ray for logging and monitoring. -
AWS Config
and AWS Security Hub to publish findings to Amazon EventBridge. -
Amazon Simple Queue Service
(SQS) to provide rate limiting capabilities to AWS Config and the Security Hub Evidence Collector. -
Evidence collector Lambda functions to invoke the
Create Evidence API
to record the finding. These include the Security Hub evidence collector and the S3 evidence collector.