# Phase 2 Architecture

> Phase 2 Architecture Analysis guide. Use when documenting system components, connections, data stores, or analyzing technical architecture for threat modeling.

- Skill: `awslabs/phase-2-architecture` (Agent Skill)
- Install (CLI): `npx skillmds@latest add awslabs/phase-2-architecture`
- Raw SKILL.md: https://api.skillmd.com/api/skills/awslabs/phase-2-architecture/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: awslabs (https://skillmd.com/u/awslabs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/awslabs/phase-2-architecture

---


# Phase 2: Architecture Analysis

## Objective
Document every component, connection, and data store in the system. This becomes the attack surface map for later phases.

## Tools Reference

Start with `manage_architecture(action="describe", section=SECTION)` to load the
exact fields and accepted enum values for `components`, `connections`, or
`data_stores`.

### manage_architecture(action="add", section="components", values=COMPONENT)
| Parameter | Required | Values |
|---|---|---|
| name | Yes | e.g., "API Gateway", "User Database" |
| type | Yes | Compute, Storage, Network, Security, Database, Messaging, Analytics, Container, Serverless, Other |
| service_provider | No | AWS, Azure, GCP, CNCF, On-Premise, Hybrid, Other |
| specific_service | No | e.g., "Lambda", "RDS", "API Gateway", "EC2" |
| version | No | e.g., "Python 3.9", "PostgreSQL 13" |
| description | No | What this component does |
| configuration | No | Dict of config details |

### manage_architecture(action="add", section="connections", values=CONNECTION)
| Parameter | Required | Values |
|---|---|---|
| source_id | Yes | Component or data-store node ID |
| destination_id | Yes | Component or data-store node ID |
| protocol | No | HTTP, HTTPS, TCP, UDP, SSH, FTP, SMTP, WebSocket, gRPC, MQTT, Other |
| port | No | Integer port number |
| encryption | No | true/false |
| description | No | What flows over this connection |

### manage_architecture(action="add", section="data_stores", values=DATA_STORE)
| Parameter | Required | Values |
|---|---|---|
| name | Yes | e.g., "Customer PII Store" |
| type | Yes | Relational, NoSQL, Object Storage, File System, Cache, Data Warehouse, Graph, Time Series, Ledger, Other |
| classification | Yes | Public, Internal, Confidential, Restricted |
| encryption_at_rest | No | true/false |
| backup_frequency | No | Hourly, Daily, Weekly, Monthly, Continuous, None |
| description | No | What data is stored |

### Other Phase 2 Tools
- `manage_architecture(action="list", section=SECTION)` -- Review one entity type
- `manage_architecture(action="list", section="all")` -- Review the complete architecture
- `manage_architecture(action="plan", section="all")` -- AI-powered analysis guidance
- `manage_architecture(action="clear", section="all")` -- Start over if no asset flows depend on it
- Add and update operations accept `items` for batches; get field details with `describe`

## Workflow

1. **Call `manage_workflow(action="guidance", phase="2")`** for detailed instructions
2. **Scan the codebase** for services, APIs, databases, queues, caches, external integrations
3. **Add components** with `manage_architecture(action="add", section="components", ...)`
4. **Add data stores** with `section="data_stores"` and include classification
5. **After all nodes exist, add connections** with `section="connections"` and include protocol and encryption status; data stores are valid endpoints
6. **If AWS**: Use `search_documentation()` to validate service security configs
7. **Document assumptions** about the architecture

## What to Look For in Code

| Code Pattern | Component Type |
|---|---|
| Dockerfile, ECS/EKS config | Container |
| Lambda handler, serverless.yml | Serverless |
| Database connection strings, ORM config | Database |
| S3 client, blob storage | Storage |
| API routes, REST/gRPC endpoints | Compute/Network |
| Queue/topic publishers/subscribers | Messaging |
| Redis/Memcached clients | Cache (Data Store) |

## Completion Criteria
- [ ] All system components added
- [ ] Every component and data store participates in a connection, unless the architecture has only one node
- [ ] All data stores documented with classification
- [ ] `manage_architecture(action="list", section="all")` shows a comprehensive inventory
- [ ] Call `manage_workflow(action="advance")` to proceed to Phase 3

## Common Pitfalls
- Forgetting external dependencies (third-party APIs, CDNs, DNS)
- Not specifying encryption status on connections
- Missing data stores (logs, caches, temp files are also data stores)
- Not classifying data store sensitivity
- Modeling a data store but omitting its connections