22 lines
1.4 KiB
Markdown
22 lines
1.4 KiB
Markdown
# Phase 1 — Architecture & Product Selection
|
|
|
|
## Selected Products
|
|
- **Compute / Serving**: Google Cloud Run (Fully Managed Container Ingress & Stateless Execution)
|
|
- **Messaging & Eventing**: Google Cloud Pub/Sub (Regional Event Bus for Asynchronous Decoupling)
|
|
- **State & Storage**: Google Cloud Storage & Firestore (Database & Bucket Storage for Durable Audit Event Replay)
|
|
- **Security & Identity**: Cloud IAM (Least Privilege Service Accounts) & KMS (Customer-Managed Encryption Keys)
|
|
- **Artifact Registry**: Google Artifact Registry (OCI Container Image Hosting)
|
|
|
|
## Component Responsibilities
|
|
1. **Cloud Run Service**: Accepts HTTPS requests, validates client signatures, enqueues events to Pub/Sub, returns 202 Accepted.
|
|
2. **Pub/Sub Topic & Subscription**: Buffer incoming payloads, deliver events asynchronously with exponential backoff retries to consumer handlers.
|
|
3. **Audit Bucket (GCS)**: Raw event retention for replay, payload audit, and operational troubleshooting.
|
|
|
|
## Security & Compliance
|
|
- HTTPS ingress with TLS 1.3 encryption in transit.
|
|
- Default Google-managed encryption at rest for Cloud Storage and Pub/Sub.
|
|
- Cloud Run service account bound strictly to `roles/pubsub.publisher` and `roles/storage.objectCreator`.
|
|
|
|
## Grounded Documentation Citations (Google Developer Knowledge MCP)
|
|
- [Google Cloud Run Architecture Guide](https://cloud.google.com/run/docs/overview/what-is-cloud-run)
|