Architecture Reference

System topology

index.ts is the entry point. It reads Pulumi config and instantiates one or more ComponentResource modules. Everything lands in AWS us-east-1 under the sandbox or agency stack you select.

flowchart TB
    subgraph Entry["Pulumi entry: index.ts"]
        MODE[mode config]
    end
    subgraph Demos["Product demos"]
        SOAR[FinancialSystemLogPlatform]
        NAVY[NavyDemoPlatform]
        TECOM[TecomDemoPlatform]
        ADCD[AdcdDemoPlatform]
    end
    subgraph Development["Development"]
        SANDBOX[AISandboxPlatform]
        MON[SandboxSecurityMonitoring]
    end
    subgraph AWS["AWS us-east-1"]
        SVC[Managed services]
    end
    MODE -->|sandbox or full| SANDBOX
    SANDBOX --> MON
    SANDBOX --> SOAR
    SANDBOX --> NAVY
    SANDBOX --> TECOM
    SANDBOX --> ADCD
    SANDBOX --> SVC
        

Repo modules

github.com/clthomps/Kearney-Pulumi (branch main). Click a file to open it on GitHub.

Deployment modes

Sandbox components

Product demos

Four demos on the same footing. Each is synthetic or fixture data only, not a production client deployment.

flowchart TB
    USER[User] --> CF[CloudFront]
    CF --> S3[S3 static site]
    CF --> APIGW[API Gateway HTTP]
    APIGW --> JWT[Cognito JWT]
    JWT --> LAMBDA[Demo runner Lambda]
    LAMBDA --> TR[S3 traces / fixtures]
        

SOAR demo data flow

flowchart LR
    SRC[Source systems] --> S3[S3 raw/]
    S3 --> LP[Lambda parser]
    LP --> PQ[Parquet + Athena]
    LP --> SNS[SNS MSSP]
    SNS --> SNOW[ServiceNow]
    DECOY[Honeybucket decoy] --> P1[P1 SNS alert]
        

SOAR also provisions VAULT EC2 hosts (SSM-only), EventBridge scheduled scans, Glue crawler, CloudTrail, VPC flow logs, and a ServiceNow webhook via API Gateway HTTP.

Navy and TECOM need their application repos checked out locally before pulumi up.

AI sandbox

Synthetic data only until post-ATO. Approved sources include USASpending.gov public records, GPT-generated PBIS/STARS-FL fixtures, and public policy documents.

flowchart LR
    S3S[S3 synthetic data] --> HAR[Inference harness]
    HAR --> S3A[S3 model artifacts]
    SM[SageMaker Studio] --> NB[Notebooks]
    BR[Bedrock IAM] --> HAR
    SITE[kearneysandbox.com] --> CF[CloudFront + Cognito]
    CF --> PP[Prompt proxy API]
        

Auth on this site uses Cognito Hosted UI (implicit grant). The ID token sits in sessionStorage and gates pages including this one. The prompt proxy validates the same JWT on POST /refine.

AskSage (IL5) is required for DoD-scoped work. Bedrock covers Nova, Titan, Llama, Mistral, and Cohere for internal use. Anthropic/Claude ARNs were removed from Bedrock IAM per FASCSA guidance.

Security monitoring

flowchart LR
    ACT[API + S3 activity] --> CT[CloudTrail]
    ACT --> GD[GuardDuty]
    CT --> S3T[Trail bucket]
    S3T --> GLUE[Glue catalog]
    GLUE --> ATH[Athena]
    GD --> EB[EventBridge]
    EB --> SNS[SNS alerts]
    CT --> MF[Metric filters]
    MF --> CW[CloudWatch alarms]
    CW --> SNS
        

Viewers need the Cognito group sandbox-monitoring-viewers on pool kearney-ai-sandbox-users. That portal uses authorization-code + PKCE, separate from the implicit flow on the main site, same user pool.

Pulumi stacks

Stack names stay generic. Never put client or agency names in the stack ID.

Deploy steps

npm install, npm run build, pulumi stack select <name>, pulumi preview --diff, pulumi up. Package the SOAR Lambda layer before the first SOAR deploy (see repo README).

AWS service matrix

Not used in this codebase: DynamoDB, ECS/Fargate, RDS, ElastiCache, CDK.

Compliance and data

Frameworks

FedRAMP High (target), FISCAM, CMMC Level 2, NIST SP 800-53 Rev 5, DoD Zero Trust.

Data boundaries

All demos, including the SOAR log analytics stack, use synthetic or fixture data only. The AI sandbox is the same: no PII, no real client records, nothing classified or CUI until we have an ATO for a given workload.

OPSEC

• Never export or log the honeybucket/decoy bucket name.
• Store ServiceNow URLs with pulumi config set --secret.
• Keep stack and CI output free of client identifiers where possible.
• Do not commit notebooks with real system IDs or client names.

Software bill of materials

CycloneDX 1.5 SBOM for this codebase, Lambda layers, and Pulumi dependencies: SBOM inventory and downloads.

External dependencies

Navy packages code from navy-readiness-tool at deploy time (sibling checkout; see navy-demo-platform.ts). TECOM packages code from tecom-budget-tool. AD/CD is self-contained under adcd-demo/lambda/.

Source files

github.com/clthomps/Kearney-Pulumi