Six sentences from an auditor
You are standing up the payment path for a retailer that has just been told its current setup will not pass its next audit.
The auditors did not name a single product. They wrote down six sentences, and every one of them is a property the finished diagram has to have. The tray holds more components than you need.
- R1Nothing that keeps data across a restart may sit in a subnet whose route table points at the internet gateway — and nothing holding a primary account number may be reachable from that gateway at all.
- R2The service that settles with the acquiring bank has to reach the acquirer's public endpoint. Nothing on the internet may be able to open a connection back to it.
- R3Public traffic must be examined for injection and scripted-abuse patterns before it reaches anything the retailer wrote.
- R4The same public entry point serves two different back ends, chosen by the path in the URL.
- R5The acquirer credential is rotated every 24 hours by the store that holds it. No engineer and no pipeline touches it, and nothing is rebuilt or restarted when it changes.
- R6Checkout keeps per-shopper session state. Anything in the public subnet that accepts connections from the internet falls inside the audit's scope, and the session store must not widen it.
Boundaries, outermost first: VPC (10.0.0.0/16): Internet gateway, an empty slot for the picks a back end from the URL path, tier 1 Private subnet: Settlement (/settle), Checkout API (/checkout), an empty slot for the holds primary account numbers, tier 3, an empty slot for the rotates its own contents on a clock, tier 3 Public subnet: Jump host (on-call shell), an empty slot for the session state, beside a public route, tier 2, an empty slot for the outbound to the acquirer, never inbound, tier 2 Outside every boundary: Acquiring bank (third party), Shoppers (public internet), an empty slot for the screens request bodies before app code, tier 1 Connections: Shoppers calls screens request bodies before app code screens request bodies before app code calls picks a back end from the URL path picks a back end from the URL path calls Checkout API picks a back end from the URL path calls Settlement Checkout API calls session state, beside a public route Checkout API calls holds primary account numbers Settlement calls rotates its own contents on a clock Settlement sends outbound traffic to outbound to the acquirer, never inbound outbound to the acquirer, never inbound sends outbound traffic to Internet gateway Internet gateway sends outbound traffic to Acquiring bank Jump host controls Settlement