1---2name: phase-2-architecture3description: Phase 2 Architecture Analysis guide. Use when documenting system components, connections, data stores, or analyzing technical architecture for threat modeling.4---56# Phase 2: Architecture Analysis78## Objective9Document every component, connection, and data store in the system. This becomes the attack surface map for later phases.1011## Tools Reference1213Start with `manage_architecture(action="describe", section=SECTION)` to load the14exact fields and accepted enum values for `components`, `connections`, or15`data_stores`.1617### manage_architecture(action="add", section="components", values=COMPONENT)18| Parameter | Required | Values |19|---|---|---|20| name | Yes | e.g., "API Gateway", "User Database" |21| type | Yes | Compute, Storage, Network, Security, Database, Messaging, Analytics, Container, Serverless, Other |22| service_provider | No | AWS, Azure, GCP, CNCF, On-Premise, Hybrid, Other |23| specific_service | No | e.g., "Lambda", "RDS", "API Gateway", "EC2" |24| version | No | e.g., "Python 3.9", "PostgreSQL 13" |25| description | No | What this component does |26| configuration | No | Dict of config details |2728### manage_architecture(action="add", section="connections", values=CONNECTION)29| Parameter | Required | Values |30|---|---|---|31| source_id | Yes | Component or data-store node ID |32| destination_id | Yes | Component or data-store node ID |33| protocol | No | HTTP, HTTPS, TCP, UDP, SSH, FTP, SMTP, WebSocket, gRPC, MQTT, Other |34| port | No | Integer port number |35| encryption | No | true/false |36| description | No | What flows over this connection |3738### manage_architecture(action="add", section="data_stores", values=DATA_STORE)39| Parameter | Required | Values |40|---|---|---|41| name | Yes | e.g., "Customer PII Store" |42| type | Yes | Relational, NoSQL, Object Storage, File System, Cache, Data Warehouse, Graph, Time Series, Ledger, Other |43| classification | Yes | Public, Internal, Confidential, Restricted |44| encryption_at_rest | No | true/false |45| backup_frequency | No | Hourly, Daily, Weekly, Monthly, Continuous, None |46| description | No | What data is stored |4748### Other Phase 2 Tools49- `manage_architecture(action="list", section=SECTION)` -- Review one entity type50- `manage_architecture(action="list", section="all")` -- Review the complete architecture51- `manage_architecture(action="plan", section="all")` -- AI-powered analysis guidance52- `manage_architecture(action="clear", section="all")` -- Start over if no asset flows depend on it53- Add and update operations accept `items` for batches; get field details with `describe`5455## Workflow56571. **Call `manage_workflow(action="guidance", phase="2")`** for detailed instructions582. **Scan the codebase** for services, APIs, databases, queues, caches, external integrations593. **Add components** with `manage_architecture(action="add", section="components", ...)`604. **Add data stores** with `section="data_stores"` and include classification615. **After all nodes exist, add connections** with `section="connections"` and include protocol and encryption status; data stores are valid endpoints626. **If AWS**: Use `search_documentation()` to validate service security configs637. **Document assumptions** about the architecture6465## What to Look For in Code6667| Code Pattern | Component Type |68|---|---|69| Dockerfile, ECS/EKS config | Container |70| Lambda handler, serverless.yml | Serverless |71| Database connection strings, ORM config | Database |72| S3 client, blob storage | Storage |73| API routes, REST/gRPC endpoints | Compute/Network |74| Queue/topic publishers/subscribers | Messaging |75| Redis/Memcached clients | Cache (Data Store) |7677## Completion Criteria78- [ ] All system components added79- [ ] Every component and data store participates in a connection, unless the architecture has only one node80- [ ] All data stores documented with classification81- [ ] `manage_architecture(action="list", section="all")` shows a comprehensive inventory82- [ ] Call `manage_workflow(action="advance")` to proceed to Phase 38384## Common Pitfalls85- Forgetting external dependencies (third-party APIs, CDNs, DNS)86- Not specifying encryption status on connections87- Missing data stores (logs, caches, temp files are also data stores)88- Not classifying data store sensitivity89- Modeling a data store but omitting its connections
awslabs