Step 2: Architecture Assessment - pci-dss-gw

Step 2: Architecture Assessment - pci-dss-gw

Generated by architect agent | 2026-02-09

Requirements Validation ✅

[!IMPORTANT] All critical requirements from 01-requirements.md are architecturally feasible. Budget has been refined with live Azure Pricing MCP data.

Executive Summary

Architecture Overview

This is a PCI-DSS Level 1 payment gateway on Azure, designed for 10,000 TPS sustained throughput with 99.99% availability. The architecture follows a hub-spoke network topology with AKS as the compute platform, PostgreSQL Flexible Server for transactional data, and Cosmos DB for low-latency session state.

Primary Optimization Pillar

Security — PCI-DSS v4.0 Level 1 compliance drives architectural decisions. All other pillars are optimized within PCI constraints.

Architecture Pattern

Key Architecture Decisions

WAF Pillar Assessment

🔒 Security — 9/10 (Confidence: High)

Strengths: Comprehensive PCI-DSS control mapping. Zero-trust architecture with managed identity everywhere. HSM-backed key management.

Gaps:

• Penetration testing schedule not yet defined (PCI Req 11)
• QSA validation of Azure Firewall IDPS as acceptable IDS/IPS control is pending

Recommendations:

1. Schedule quarterly penetration tests with a PCI-certified ASV
2. Implement Azure Policy deny rules for non-compliant configurations
3. Enable Defender for Key Vault for anomaly detection on cryptographic operations

🔄 Reliability — 8/10 (Confidence: High)

Strengths: Zone-redundant deployment across all tiers. Idempotent transaction design prevents duplicate charges. Service Bus DLQ handles transient failures.

Gaps:

• Active-passive failover is manual — RTO ≤ 30 min depends on operator response time
• Cosmos DB failover to germanywestcentral is not yet configured
• No documented chaos engineering / game day testing plan

Recommendations:

1. Implement automated failover runbook with Azure Automation for RTO ≤ 15 min
2. Configure Cosmos DB multi-region with germanywestcentral as read-replica (can promote on failover)
3. Schedule quarterly chaos engineering tests (AKS node drain, zone failure simulation)

Composite SLA Calculation:

Composite SLA: 99.99% × 99.99% × 99.99% × 99.99% × 99.99% × 99.99% × 99.99% = 99.93%

[!WARNING] Composite SLA (99.93%) is below the 99.99% target. To achieve 99.99%, implement multi-region active-active for the most critical path (Front Door → AKS → PostgreSQL) or accept 99.95%+ with strong DR automation.

⚡ Performance — 8/10 (Confidence: Medium)

Strengths: KEDA enables event-driven scaling tied to Service Bus queue depth. Dual-database architecture offloads read-heavy cache operations from PostgreSQL.

Gaps:

• No dedicated Redis cache for API response caching — Cosmos DB may add latency vs. Redis for hot-path caching
• Load testing plan not yet defined to validate 15k TPS peak
• PgBouncer configuration (pool size, mode) needs tuning for 10k TPS

Recommendations:

1. Conduct Azure Load Testing at 15k TPS to validate node count and latency targets
2. Consider Azure Cache for Redis (Enterprise, 6 GB) as a hot-path cache if Cosmos DB latency exceeds targets under load
3. Configure PgBouncer in transaction mode with pool_size = 200 per pod

💰 Cost — 7/10 (Confidence: Medium)

Estimated Monthly Cost (from Azure Pricing MCP — swedencentral):

[!NOTE] 💰 Prices sourced from Azure Pricing MCP (swedencentral, 2026-02-09). Production with full HA (20 nodes, max Cosmos RU/s) could reach ~$27,800/mo. Reserved Instances (1-year) save ~35% on compute and PostgreSQL.

Savings Opportunities:

🔧 Operations — 8/10 (Confidence: High)

Strengths: Full IaC approach with Bicep/AVM. Blue-green deployment minimizes downtime. Container scanning gates prevent vulnerable images.

Gaps:

• No documented incident response playbook specific to payment failures
• Runbook for database failover not yet created
• Change management process for PCI CDE changes undefined

Recommendations:

1. Create payment transaction failure runbook with escalation paths
2. Document CDE change management process for PCI-DSS Req 6 compliance
3. Implement GitOps (Flux v2) for AKS workload deployments with audit trail

Resource SKU Recommendations

Service Maturity Assessment

[!TIP] All recommended services are Generally Available (GA) with Azure Verified Modules where available. No preview or deprecated services in this architecture.

Architecture Decision Summary

Implementation Handoff

For Bicep Plan Agent

1. Network: Hub VNet (firewall, bastion) + Spoke VNet (AKS, PostgreSQL, Cosmos DB, APIM). Private endpoints for all data services.
2. Compute: AKS with system node pool (D4s_v5 × 3) + user CDE node pool (D8s_v5 × 3-20). KEDA add-on. Workload Identity.
3. Data: PostgreSQL Flexible Server E16s v5 zone-redundant HA. Cosmos DB NoSQL autoscale 10K-50K RU/s.
4. Security: Key Vault Premium. Azure Firewall Premium. NSGs on all subnets. AKS network policies (Calico).
5. Edge: Front Door Premium + WAF policy. APIM Premium VNet-integrated.
6. Messaging: Service Bus Premium 1 MU.
7. Monitoring: Log Analytics workspace (1-year retention) + Application Insights + Defender for Cloud + Defender for Containers.
8. DDoS: Network Protection on hub VNet.
9. Identity: Managed identities for all service-to-service. Workload Identity for AKS pods. PIM for admin access.

AVM Modules to Use

Required Tags

tags: {
  Environment: environment    // 'dev' | 'staging' | 'prod'
  ManagedBy: 'Bicep'
  Project: 'pci-dss-gw'
  Owner: '<to-be-confirmed>'
}

Approval Gate

Estimated Monthly Cost: $13,328 – $19,032 (typical prod), up to ~$27,800 at peak scale

[!IMPORTANT] ⚠️ Composite SLA (99.93%) is slightly below 99.99% target. Mitigation: implement automated DR runbook to achieve operational SLA ≥ 99.99% with rapid failover. Alternatively, accept 99.95%+ with strong DR automation.

Top Risks:

1. Composite SLA gap — mitigate with multi-region or accept 99.95%
2. DDoS + APIM Premium are large fixed costs ($5,739/mo combined) — validate necessity with QSA
3. Load testing not yet conducted — 15k TPS peak is untested assumption

Reply "approve" to proceed to bicep-plan, or provide feedback.

References

[!NOTE] 📚 The following Microsoft Learn resources provide additional guidance.