DockfieldAWS resilience engineering
English
Home/Architecture

Architecture

One control plane. Two trust zones. A measured recovery path.

The reference design separates production discovery, artifact trust and recovery execution so compromised production identities cannot directly control recovery.

Reference design

Multi-account, multi-Region by construction.

Production is observed with read-only discovery. Terraform moves through evidence-based promotion before selection by recovery.

DR-as-Code reference architecture
Production discovery → trusted artifact → Active-Warm recovery
Dockfield DR-as-Code reference architecturePRODUCTION TRUST LANE Primary AWS estateVPC · ALB/NLB · Route 53ECS / EKS · EFS · S3RDS / Aurora · dependenciesREAD-ONLY DISCOVERY Codification engineBoto3 inventoryID → Terraform referencesVersion + evidence manifestEXAMPLE: 5 MIN Quarantine & promotionIntegrity · policy · plan/applyNetwork · data · application testsSigned last-known-good artifactPROMOTE ONLYRECOVERY EXECUTION LANE Safe recovery storeImmutable, encrypted, versionedTerraform + provider lockRecovery timestamp + evidenceSeparate security / DR accountLAST KNOWN GOOD Data recoveryRDS / Aurora PITRNative DB replication where usedBackups: governance / retentionTime-correlated with IaCDATA PREREQUISITE Active-Warm recoveryFoundation kept recovery-readyECS / EKS compute on demandThree-tier validationControlled traffic switchTESTED FAILOVERDesign principleKeep what determines recovery speed warm. Recreate elastic container compute only when tests prove the target RTO still holds.
Automation Trust decision Recovery-ready Dependency

Ransomware resilience

Never deploy the latest snapshot blindly.

Every production-derived artifact starts untrusted. Promotion proves its quality; incident-time selection proves it predates the credible compromise boundary.

Infrastructure trust & promotion
Continuous assurance plus incident-command accountability
Ransomware-safe artifact pipelineGenerated Terraform is quarantined, tested, promoted and selected against the compromise boundary.CONTINUOUS ASSURANCECaptureInventory + manifest01QuarantineUntrusted by default02ValidateIntegrity + policy03TestNetwork · data · app04PromoteSigned exact digest05INCIDENT-TIME SELECTIONCompromise boundaryForensic evidence establishes theearliest credible compromise time.HUMAN AUTHORISATIONRecovery selectorNewest approved snapshot capturedbefore the compromise boundary.FRESH CLEAN-ROOM PLANTrusted recoveryTerraform and database restore useone correlated trusted timestamp.RE-TEST BEFORE TRAFFICThe newest artifact is not automatically the safest artifact.
GATE 01

Integrity & provenance

Producer identity, signature, digest, manifest, source account, Region, toolchain and dependency lock.

GATE 02

Security & policy

Secrets exposure, public reachability, encryption, privilege, logging, destructive change and mutable references.

GATE 03

Runtime proof

Isolated plan/apply and network, data and application validation. Failed artifacts stay quarantined.

Recovery coherence

Infrastructure and data return to one trusted point.

The manifest records the production capture time. Database recovery is checked against actual restorable boundaries before execution.

Trusted recovery timestamp
Illustrative incident timeline
Trusted infrastructure and data recovery timelineA 10:15 snapshot precedes a 10:17 compromise and is selected after incident declaration.10:15IaC capturedSELECTED TIMESTAMP10:17Earliest compromiseBOUNDARY10:22Artifact promotedAPPROVED10:42Incident declaredRECOVERY STARTRestore infrastructure and eligible database state to the same trusted point, subject to actual log and replication boundaries.
A five-minute IaC capture interval is a configuration recovery-point target, not the application's total RPO. Data loss also depends on transaction logs, replication delay, consistency and the incident boundary.

Illustrative time budget

Engineer every minute before the incident.

This shows how a sub-hour target might be decomposed after authorised failover. Assessment and repeated tests establish the real values.

Elapsed targetRecovery stageEvidence required
0-5 minDeclare, isolate and selectAuthorised event, compromise boundary and valid artifact
5-15 minApply and verify foundationPlan reviewed; routing and controls pass
15-35 minRedeploy ECS/EKS capacityHealthy targets, placement, scaling and discovery
35-45 minAttach or restore data pathEligible timestamp, encryption and reachability
45-55 minRun three-tier smoke testsNetwork, data and application tests pass
55-60 minApprove and switch trafficTechnical and business sign-off

Free initial consultation

Architecture is only credible when it is exercised.

Turn the reference design into a scoped pilot with a timer, evidence pack and explicit go/no-go gates.

Send us a message