Step 2: Architecture Assessment - pci-dss-gw

🏗️ Step 2: Architecture Assessment - pci-dss-gw

• ✅ Requirements Validation
• 📎 Executive Summary
• 🏗️ WAF Pillar Assessment
• 📦 Resource SKU Recommendations
• 🎯 Architecture Decision Summary
• 🚀 Implementation Handoff
• 🔒 Approval Gate
• References

Generated by @architect agent | 2026-02-09

✅ Requirements Validation

[!IMPORTANT] All critical requirements from 01-requirements.md are architecturally feasible. Budget has been refined with live Azure Pricing MCP data.

📎 Executive Summary

Architecture Overview

This is a PCI-DSS Level 1 payment gateway on Azure, designed for 10,000 TPS sustained throughput with 99.99% availability. The architecture follows a hub-spoke network topology with AKS as the compute platform, PostgreSQL Flexible Server for transactional data, and Cosmos DB for low-latency session state.

Primary Optimization Pillar

Security — PCI-DSS v4.0 Level 1 compliance drives architectural decisions. All other pillars are optimized within PCI constraints.

Architecture Pattern

Key Architecture Decisions

🏗️ WAF Pillar Assessment

🔒 Security — 9/10 (Confidence: High)

Strengths: Comprehensive PCI-DSS control mapping. Zero-trust architecture with managed identity everywhere. HSM-backed key management.

Gaps:

• Penetration testing schedule not yet defined (PCI Req 11)
• QSA validation of Azure Firewall IDPS as acceptable IDS/IPS control is pending

Recommendations:

1. Schedule quarterly penetration tests with a PCI-certified ASV
2. Implement Azure Policy deny rules for non-compliant configurations
3. Enable Defender for Key Vault for anomaly detection on cryptographic operations

🔄 Reliability — 8/10 (Confidence: High)

Strengths: Zone-redundant deployment across all tiers. Idempotent transaction design prevents duplicate charges. Service Bus DLQ handles transient failures.

Gaps:

• Active-passive failover is manual — RTO ≤ 30 min depends on operator response time
• Cosmos DB failover to germanywestcentral is not yet configured
• No documented chaos engineering / game day testing plan

Recommendations:

1. Implement automated failover runbook with Azure Automation for RTO ≤ 15 min
2. Configure Cosmos DB multi-region with germanywestcentral as read-replica (can promote on failover)
3. Schedule quarterly chaos engineering tests (AKS node drain, zone failure simulation)

Composite SLA Calculation:

Composite SLA: 99.99% × 99.99% × 99.99% × 99.99% × 99.99% × 99.99% × 99.99% = 99.93%

[!WARNING] Composite SLA (99.93%) is below the 99.99% target. To achieve 99.99%, implement multi-region active-active for the most critical path (Front Door → AKS → PostgreSQL) or accept 99.95%+ with strong DR automation.

⚡ Performance — 8/10 (Confidence: Medium)

Strengths: KEDA enables event-driven scaling tied to Service Bus queue depth. Dual-database architecture offloads read-heavy cache operations from PostgreSQL.

Gaps:

• No dedicated Redis cache for API response caching — Cosmos DB may add latency vs. Redis for hot-path caching
• Load testing plan not yet defined to validate 15k TPS peak
• PgBouncer configuration (pool size, mode) needs tuning for 10k TPS

Recommendations:

1. Conduct Azure Load Testing at 15k TPS to validate node count and latency targets
2. Consider Azure Cache for Redis (Enterprise, 6 GB) as a hot-path cache if Cosmos DB latency exceeds targets under load
3. Configure PgBouncer in transaction mode with pool_size = 200 per pod

💰 Cost — 7/10 (Confidence: Medium)

Estimated Monthly Cost (from Azure Pricing MCP — swedencentral):

[!NOTE] 💰 Prices sourced from Azure Pricing MCP (swedencentral, 2026-02-09). Production with full HA (20 nodes, max Cosmos RU/s) could reach ~$27,800/mo. Reserved Instances (1-year) save ~35% on compute and PostgreSQL.

Savings Opportunities:

🔧 Operations — 8/10 (Confidence: High)

Strengths: Full IaC approach with Bicep/AVM. Blue-green deployment minimizes downtime. Container scanning gates prevent vulnerable images.

Gaps:

• No documented incident response playbook specific to payment failures
• Runbook for database failover not yet created
• Change management process for PCI CDE changes undefined

Recommendations:

1. Create payment transaction failure runbook with escalation paths
2. Document CDE change management process for PCI-DSS Req 6 compliance
3. Implement GitOps (Flux v2) for AKS workload deployments with audit trail

📦 Resource SKU Recommendations

Service Maturity Assessment

[!TIP] All recommended services are Generally Available (GA) with Azure Verified Modules where available. No preview or deprecated services in this architecture.

🎯 Architecture Decision Summary

🚀 Implementation Handoff

For Bicep Plan Agent

1. Network: Hub VNet (firewall, bastion) + Spoke VNet (AKS, PostgreSQL, Cosmos DB, APIM). Private endpoints for all data services.
2. Compute: AKS with system node pool (D4s_v5 × 3) + user CDE node pool (D8s_v5 × 3-20). KEDA add-on. Workload Identity.
3. Data: PostgreSQL Flexible Server E16s v5 zone-redundant HA. Cosmos DB NoSQL autoscale 10K-50K RU/s.
4. Security: Key Vault Premium. Azure Firewall Premium. NSGs on all subnets. AKS network policies (Calico).
5. Edge: Front Door Premium + WAF policy. APIM Premium VNet-integrated.
6. Messaging: Service Bus Premium 1 MU.
7. Monitoring: Log Analytics workspace (1-year retention) + Application Insights + Defender for Cloud + Defender for Containers.
8. DDoS: Network Protection on hub VNet.
9. Identity: Managed identities for all service-to-service. Workload Identity for AKS pods. PIM for admin access.

AVM Modules to Use

Required Tags

tags: {
  Environment: environment    // 'dev' | 'staging' | 'prod'
  ManagedBy: 'Bicep'
  Project: 'pci-dss-gw'
  Owner: '<to-be-confirmed>'
}

🔒 Approval Gate

Estimated Monthly Cost: $13,328 – $19,032 (typical prod), up to ~$27,800 at peak scale

[!IMPORTANT] ⚠️ Composite SLA (99.93%) is slightly below 99.99% target. Mitigation: implement automated DR runbook to achieve operational SLA ≥ 99.99% with rapid failover. Alternatively, accept 99.95%+ with strong DR automation.

Top Risks:

1. Composite SLA gap — mitigate with multi-region or accept 99.95%
2. DDoS + APIM Premium are large fixed costs ($5,739/mo combined) — validate necessity with QSA
3. Load testing not yet conducted — 15k TPS peak is untested assumption

Reply "approve" to proceed to bicep-plan, or provide feedback.

References

[!NOTE] 📚 The following Microsoft Learn resources provide additional guidance.

Generated by Azure Agentic InfraOps | GitHub