Security Segmentation | Wicked Spooky Ops

Current delivery remains static and unrestricted for testing. These diagrams document future controls only. Google sign-in is the initial identity source for external website users; it does not create IAM users, issue AWS credentials, or grant WSAI staff membership. No Cognito identity pool is proposed.

Identity & application access

Download Mermaid source

View source

flowchart TB
 VISITOR["Anonymous visitor"] --> EDGE["Route 53 + CloudFront + ACM<br/>HTTPS site endpoints"]
 USER["All other users: Google web identity<br/>Customers and WSAI web-only staff<br/>No IAM user or AWS credentials"] --> GOOGLE["Google sign-in<br/>OIDC identity; MFA at identity provider"]
 SAMWEB["Sam — Google account<br/>sam@wickedspooky.org<br/>Explicit application roles required"] --> GOOGLE
 SAMWEB -.- SEPARATE["Same email, separate authorization<br/>Google web login grants no AWS roles<br/>AWS admin access grants no website roles"]
 GOOGLE --> COG["Proposed Cognito user pool<br/>Google federation; no identity pool"]
 COG --> AUTH["ALB authentication<br/>Application session"]
 EDGE -->|"Public paths only"| PUBLIC["S3 public-site content<br/>Private bucket + OAC<br/>AI / IT sites + Ops splash"]
 EDGE -->|"Private and dynamic paths"| AUTH
 AUTH --> APP["EC2 application authorization<br/>Verify identity; map subject to membership<br/>Deny by default"]
 APP --> CUSTOMER["Customer / creator / business roles<br/>Tenant and object-level checks"]
 APP --> STAFF["Explicit WSAI membership<br/>No automatic staff access from Google sign-in"]
 STAFF --> ROLES["operators / developers / creators<br/>documentation-readers / evidence-readers<br/>governance-readers / access-admins"]
 CUSTOMER --> WEB["Authorized website / account features"]
 ROLES --> OPS["Authorized Ops workbenches<br/>Internal docs and architecture"]
 OPS --> FILES["EC2 retrieves permitted object<br/>Using scoped workload IAM role"]
 FILES --> PRIVATE["Separate S3 private documents<br/>Block public access<br/>No anonymous CloudFront origin path"]
 ADMIN["Day-to-day AWS administrator<br/>sam@wickedspooky.org"] --> SSO["IAM Identity Center<br/>MFA + permission sets / temporary roles<br/>No shared credentials"]
 SSO --> CONSOLE["AWS Console / administrative APIs"]
 ROOT["AWS account root<br/>admin@wickedspooky.org<br/>MFA; root-only tasks and recovery<br/>Not an IAM user; not daily administration"] -.-> CONSOLE
 WORKLOAD["EC2 / automation IAM roles<br/>Temporary machine credentials<br/>Never web-user credentials"] --> FILES

Network security groups

Download Mermaid source

View source

flowchart TB
 CF["CloudFront<br/>Public HTTPS entry"] -->|"HTTPS 443"| ALB
 subgraph V1["VPC 1 — PUBLIC DMZ — AZ A / B"]
 ALB["ALB — SG Edge ALB<br/>CloudFront origin-facing sources only<br/>Origin secret header checked by listener"]
 end
 ALB -->|"Private IP targets / HTTPS 443<br/>health checks on agreed port"| TGW["Transit Gateway<br/>Explicit forward and return routes"]
 subgraph V2["VPC 2 — PRIVATE DMZ — AZ A / B"]
 EC2["Web EC2 A / B — SG Web<br/>No public IP / no public SSH<br/>ALB authentication + application authorization"]
 MAIL["Mail EC2 — SG Mail<br/>Separate mail ingress policy<br/>Not opened by browser sign-in"]
 VPCE["SSM interface endpoints — SG Endpoints<br/>HTTPS 443 from managed hosts"]
 end
 TGW --> EC2
 EC2 -->|"SQL 3306 via routed private path"| DB
 MAIL -->|"SQL only when application requires it"| DB
 subgraph V3["VPC 3 — INTERNAL / SUPER TRUSTED — AZ A / B"]
 DB["RDS MariaDB — SG Database<br/>3306 only from approved Web / Mail sources<br/>No public access"]
 end
 EC2 -->|"HTTPS 443"| VPCE
 EC2 -->|"Scoped IAM role + HTTPS<br/>S3 gateway endpoint / approved path"| S3["S3 outside VPC<br/>Bucket and IAM policies<br/>No S3 security group"]
 EC2 -->|"Controlled outbound HTTPS"| IDP["Identity / signing-key endpoints<br/>Approved egress required"]
 SSM["AWS operator via IAM role + SSM<br/>No inbound TCP 22"] -.-> VPCE

Future inventory feed

Download Mermaid source

View source

flowchart LR
 TIMER["Scheduled collection<br/>or operator-approved refresh"] --> COLLECT["Lambda / EC2 collector<br/>Read-only workload IAM role"]
 COLLECT --> API["AWS Config + service APIs<br/>EC2 / ELBv2 / S3 / CloudFront / RDS"]
 API --> NORMAL["Normalize observed resources<br/>Timestamp + account / region coverage<br/>Separate observed from proposed"]
 NORMAL --> SNAP["Private inventory JSON<br/>Redacted and versioned"]
 SNAP --> AUTH["Authenticated application endpoint<br/>Group authorization + no shared cache"]
 AUTH --> UI["Mermaid view in browser<br/>No AWS keys or IAM account for web user"]
 POLICY["Approved application access policy<br/>Not inferred from AWS network inventory"] --> UI

Cost-aware growth phases

Download Mermaid source

View source

flowchart LR
 A["Now: public static pages<br/>S3 + CloudFront + TLS<br/>No EC2 / ALB / database just for static content"] --> B["Gate: private content needed<br/>Budget + recovery objectives agreed"]
 B --> C["Established three-VPC plan<br/>ALB + Google/Cognito + private Web EC2<br/>TGW + explicit routes + scoped IAM roles"]
 C --> D["Measure demand and failure tolerance<br/>Latency / errors / CPU / memory / cost"]
 D --> E["Scale Web tier with ALB + Auto Scaling<br/>Stateless app; shared durable state<br/>Two AZs when availability requires it"]
 E --> F["Scale database by measured bottleneck<br/>Multi-AZ for availability<br/>Read replicas only for compatible read workloads"]
 B -.-> REVIEW["Optional cost-design review only<br/>One VPC with subnet / SG segmentation<br/>Not equivalent to three VPCs; not adopted"]

Proposed web endpoints

Hostnames follow the named sites; paths below are routing proposals, not deployed resources. Exact S3 bucket names, ALB names, target IPs, certificate IDs and security-group IDs remain unassigned.

Endpoint / path	Origin	Access at deployment
WickedSpooky.AI and WickedSpookyIT.com — public pages	S3 REST origin through CloudFront OAC	Anonymous reading; any account or tenant features route to authenticated EC2 paths.
WickedSpooky.org / and public assets	Public-content S3 bucket through OAC	Anonymous splash; public assets contain no internal data.
WickedSpooky.org /internal/*	CloudFront → ALB authentication → Web EC2	Google federation for external users; explicit WSAI membership and application group required for staff areas. WSAI web-only staff also use Google; membership is explicitly approved.
/internal/architecture/* and /internal/docs/*	Authorized EC2 handler → separate private S3 bucket	Check role, tenant where relevant, and object permission on every request. Protect HTML, .mmd, SVG, JSON and all downloads. No public S3 fallback.
/oauth2/idpresponse and identity sign-in endpoints	ALB / Cognito / Google authorization flow	Register exact HTTPS callbacks. These are protocol endpoints, not a bypass to private content.
Direct S3 or EC2/ALB origin URL	Origin access only	Block public S3 access and prevent ALB origin bypass. Private EC2 has no public web endpoint.

Proposed network rules

Group	Permitted traffic
SG Edge ALB	Inbound TCP 443 from CloudFront origin-facing managed prefix list; listener also checks a private origin header. Outbound only to Web target and health-check ports. Configure outbound HTTPS needed for identity-provider calls.
SG Web	Inbound app/health-check port only from ALB sources across the routed VPC boundary. Outbound database 3306, S3 HTTPS, SSM HTTPS and approved identity/service egress. No public SSH.
SG Database	Inbound 3306 only from approved Web and, where justified, Mail sources. No Internet path.
SG Endpoints	Inbound 443 from managed Web/Mail hosts for SSM interface endpoints. S3 gateway endpoints use endpoint and bucket policies, not security groups.
SG Mail	Retains separate SMTP/IMAP ingress design from the production architecture. Mail ports and authentication are not defined or enabled by this web-access proposal.

Across the Transit Gateway, validate supported inbound security-group references with the feature enabled on both gateway and attachments. Otherwise use tightly scoped private source CIDRs. Outbound TGW rules do not support group references. Register cross-VPC ALB targets by private IP and validate routes, return paths and health checks. Security groups filter network traffic; application groups authorize people.

Deployment decisions and safeguards

Cognito user pool with Google federation is a proposed integration, not an existing configuration. Use ALB authentication for private routes and verify signed ALB identity claims and expected signer at the backend.
Map a validated issuer/subject identity to approved memberships. Do not infer staff/admin access from successful Google login, an email suffix, a request header or browser-supplied group values. Apply tenant isolation independently of role names.
Configure CloudFront to forward required auth cookies, query strings and headers for ALB authentication. Disable caching on authenticated/private paths; use no-store on private responses. Public-content caching remains separate.
OAC protects the S3 origin, not user authorization. The proposed private-document flow is through the EC2 authorization handler, not an anonymous CloudFront S3 behavior. Use scoped instance roles for S3 reads.
AWS account root is admin@wickedspooky.org: MFA, root-only tasks and recovery, no daily use or root access keys. Root is not an IAM user. Day-to-day administrator sam@wickedspooky.org uses IAM Identity Center, MFA and temporary permission-set roles. Sam also has the Google account sam@wickedspooky.org and uses that separate application sign-in path for websites and workbenches. Matching email addresses do not link permissions: approve his application memberships explicitly. The web session cannot assume his AWS administrative roles. Other people use Google application sign-in without AWS account assignments. Workload IAM roles remain separate.
On deployment, move existing Ops links and page mappings into the protected path boundary. This ZIP does not rewrite the current unrestricted preview routes or apply authentication.

Can AWS populate the diagram?

Yes. A server-side collector can query AWS Config (where recording is enabled) and service APIs for actual VPCs, subnets, security groups, load balancers, targets, buckets and distributions. Publish a timestamped private JSON snapshot and render it through the authenticated application. AWS inventory will not infer Google memberships, WordPress authorization or business intent; combine observed infrastructure with a separately governed access policy. Show missing regions, failed collection and stale results explicitly. No collector or AWS connection is implemented here.

References

Rendering proposed security diagrams…