Deployment shapes¶
audit installs as three independent parts: writer, notary, and observe with query (0058). One installation serves one application (0053). A shape is where the parts run.
Choose a shape¶
| Services in the cluster | AWS serverless | |
|---|---|---|
| Runs | writer, receiver, notary job, observe and query as chart pods | writer and notary as Lambda functions from the Pulumi library |
| Carries the stream | NATS | SQS |
| Holds secrets | Kubernetes Secrets | SSM Parameter Store |
| Deduplicates in | PostgreSQL | DynamoDB |
| Signs seals with | AWS KMS or OpenBao transit | AWS KMS |
| Start at | services in the cluster | AWS Lambda |
Both shapes share the archive layout (bucket contract), the catalogue rules, the record and audit verify.
Variations¶
| Variation | Start at |
|---|---|
| Chart in the cluster, bucket, key and workload identity on AWS | Kubernetes |
| Receiver publishing to a stream, N consumers | Run stream mode |
| Writer on Lambda, observe and query as pods | Run readers in Kubernetes |
| Beside sluis (a connection, not a shape) | sluis-connected |
What stays outside the cluster¶
The chart does not create these. Supply them in both shapes:
- A key: AWS KMS, or OpenBao transit in the cluster shape.
- An S3 store: AWS S3 or Cloudflare R2. The
attestedpreset (Object Lock compliance mode) needs AWS S3; R2 and other S3-compatible stores takeoperationalandstandard. - A PostgreSQL database in the cluster shape, with an owner and a role each for the writer, observe and query.
The archive has one store per preset, each with its own bucket, prefix, region, endpoint and credentials (0068, profiles).
Explanations: deployment shapes, direct mode, stream mode, AWS Lambda, levels.
Planned¶
0041 moves keys and State to the shared adapter block. The chart and the Pulumi library do not take the block yet. Key custody describes today's behaviour.