System Architecture

High-Level Architecture

CloudWrangler is a secure, multi-tenant platform that connects to your AWS infrastructure using industry-standard security practices. The system consists of three main layers:

┌─────────────┐      ┌──────────────┐      ┌────────────┐
│ Web Browser │ ───> │  Application │ ───> │  AWS APIs  │
│   (HTTPS)   │ <─── │    Layer     │ <─── │ (via role) │
└─────────────┘      └──────────────┘      └────────────┘
                             │
                             ▼
                     ┌──────────────┐
                     │ Encrypted    │
                     │  Database    │
                     └──────────────┘

Components

1. Web Application

• Modern, responsive web interface
• Secure authentication and authorization
• Interactive network diagrams
• Real-time resource updates

2. Application Layer

• RESTful API for data access
• Background workers for AWS discovery
• Scheduled periodic tasks
• Secure session management

3. Data Layer

• Encrypted database at rest and in transit
• Multi-tenant data isolation
• Secure credential storage
• Audit logging

4. AWS Integration

• IAM role assumption (no access keys)
• Read-only access to your AWS resources
• Uses AWS Security Token Service (STS)
• Integration with AWS Athena for log analysis

Data Flow

Resource Discovery

1. User adds AWS account with IAM role ARN
2. System assumes role via AWS STS
3. Background workers call AWS APIs to discover resources
4. Results encrypted and saved to database
5. Web application displays resources
6. Data automatically refreshed periodically

Frequency: Every 12 hours (automatic) + on-demand

VPC Flow Logs Analysis

1. AWS writes flow logs to your S3 bucket
2. CloudWrangler queries logs via AWS Athena
3. Traffic data aggregated and analyzed
4. Results enriched with resource information
5. Data encrypted and stored securely
6. Dashboard displays traffic insights

Frequency: Every 6 hours (automatic) + on-demand

Security Model

Data Encryption

CloudWrangler implements multiple layers of encryption to protect your data:

Encryption at Rest

• All database data encrypted using industry-standard AES-256 encryption
• Encrypted backups with secure key management
• Isolated storage per workspace

Encryption in Transit

• All connections use TLS 1.3
• HTTPS-only communication between all components
• Secure API authentication using JWT tokens
• No sensitive data in URLs or logs

Multi-Tenancy & Data Isolation

CloudWrangler enforces strict data isolation between workspaces:

• Workspace Isolation: Each organization's data is completely isolated
• Database-Level Security: Row-level security policies ensure queries only access authorized data
• No Cross-Tenant Access: Users can only see resources in their workspace
• Secure Session Management: Sessions tied to specific workspace access

AWS Access Security

CloudWrangler follows AWS security best practices:

• IAM Role Assumption: No AWS access keys stored anywhere
• External ID Protection: Prevents confused deputy attacks
• Read-Only Access: Uses AWS managed ReadOnlyAccess policy only
• Temporary Credentials: Short-lived session tokens (15-minute expiry)
• Audit Trail: All AWS API calls logged in your CloudTrail
• Principle of Least Privilege: Minimal permissions required

AWS Services Used

CloudWrangler integrates with the following AWS services:

• AWS STS (Security Token Service): Secure role assumption for accessing your AWS accounts
• AWS EC2: Discovering compute instances, security groups, and network interfaces
• AWS VPC: Network topology discovery including subnets, route tables, and gateways
• AWS RDS: Database instance discovery and configuration analysis
• AWS S3: Reading VPC Flow Logs for traffic analysis
• AWS Athena: Querying flow logs efficiently using SQL
• AWS CloudTrail: Audit logging of all API calls made by CloudWrangler

Performance & Reliability

CloudWrangler is designed for performance and reliability:

Scalability

• Horizontal scaling: Application layer can scale to handle multiple accounts
• Efficient querying: Database optimizations for large datasets
• Batch processing: Multiple AWS accounts discovered in parallel
• Partitioned storage: Flow logs partitioned by date for faster queries

Performance

• Caching layer: Frequently accessed data cached for fast retrieval
• Pagination: Large result sets delivered in manageable chunks
• Background processing: Long-running tasks don't block user interface
• Optimized queries: Database indexes on frequently accessed fields

Reliability

• Automated retries: Failed AWS API calls automatically retried
• Health monitoring: System components continuously monitored
• Graceful degradation: Partial failures don't affect entire system
• Audit logging: All operations logged for troubleshooting

Background Tasks

CloudWrangler runs several automated background tasks to keep your data fresh:

Scheduled Tasks

All tasks can also be triggered manually on-demand from the web interface.

Next Steps