Production Deployment Ownership

Regions, network boundaries, workload owners, state, and named crossings

Production Deployment Ownership Regions, network boundaries, workload owners, state, and named crossings AWS us-east-1 / production private application network AWS eu-west-1 / disaster recovery Customers · web + mobile · Architecture component Customers web + mobile Global Edge · CDN + WAF · AWS us-east-1 / production · edge team Global Edge CDN + WAF edge team API Gateway · public :443 · AWS us-east-1 / production · platform API Gateway public :443 platform API Pods / AZ-a · private subnet · AWS us-east-1 / production › private application network · app team API Pods / AZ-a private subnet app team API Pods / AZ-b · private subnet · AWS us-east-1 / production › private application network · app team API Pods / AZ-b private subnet app team Redis · multi-AZ cache · AWS us-east-1 / production › private application network · platform Redis multi-AZ cache platform PostgreSQL · primary / encrypted · AWS us-east-1 / production › private application network · data team PostgreSQL primary / encrypted data team Event Bus · orders.v1 · AWS us-east-1 / production › private application network · platform Event Bus orders.v1 platform Workers · private workload · AWS us-east-1 / production › private application network · app team Workers private workload app team DR Replica · eu-west-1 · AWS eu-west-1 / disaster recovery · data team DR Replica eu-west-1 data team Audit Archive · immutable objects · AWS us-east-1 / production · security Audit Archive immutable objects security Observability · metrics + traces · Architecture component · SRE Observability metrics + traces SRE HTTPS mTLS cache SQL publish cross-region WAL evidence OTLP Legend External Cloud Security Backend Database Message bus

Runtime Ownership

  • • Platform owns the edge, gateway, cache, and event bus
  • • Application teams own API pods and workers
  • • Data owns primary and disaster-recovery state

Named Crossings

  • • Public HTTPS terminates at the managed edge
  • • mTLS crosses into the application network
  • • Cross-region WAL is explicit and encrypted

Operational Evidence

  • • Workers emit traces to SRE-owned observability
  • • Audit evidence lands in immutable storage
  • • Unknown placement should remain marked, never invented