1.4 KiB
Executable File
1.4 KiB
Executable File
Phase 1 — Architecture & Product Selection
Selected Products
- Compute / Serving: Google Cloud Run (Fully Managed Container Ingress & Stateless Execution)
- Messaging & Eventing: Google Cloud Pub/Sub (Regional Event Bus for Asynchronous Decoupling)
- State & Storage: Google Cloud Storage & Firestore (Database & Bucket Storage for Durable Audit Event Replay)
- Security & Identity: Cloud IAM (Least Privilege Service Accounts) & KMS (Customer-Managed Encryption Keys)
- Artifact Registry: Google Artifact Registry (OCI Container Image Hosting)
Component Responsibilities
- Cloud Run Service: Accepts HTTPS requests, validates client signatures, enqueues events to Pub/Sub, returns 202 Accepted.
- Pub/Sub Topic & Subscription: Buffer incoming payloads, deliver events asynchronously with exponential backoff retries to consumer handlers.
- Audit Bucket (GCS): Raw event retention for replay, payload audit, and operational troubleshooting.
Security & Compliance
- HTTPS ingress with TLS 1.3 encryption in transit.
- Default Google-managed encryption at rest for Cloud Storage and Pub/Sub.
- Cloud Run service account bound strictly to
roles/pubsub.publisherandroles/storage.objectCreator.