CoreDirective reference architecture

three planes, three vendors, split by blast radius, sanitized, no accounts, regions, or bucket names

Multi-cloud planesBack to portfolioClick a box for what it is, the controls it holds, and the file that proves it.
Edge Cloudflare identity, ingress, state Terraform: cd-cloudflare-edge Runtime Oracle Cloud compute, data, keys Terraform: cd-oci-infrastructure Security AWS what must survive the other two Terraform: cd-aws-security-plane users, operators SIEM GitHub Actions operator, Telegram AccessOTP, service tokens tunnel edgehost dials out to it WAF, rate limitsmanaged and custom rules DNS proxyno origin address webhook carve-outTelegram ranges, one path state bucketTerraform state, versioned hardened hostcompose, 19 services VCN, one portSSH, allowlisted sources identity domainJWT to token, minutes backup bucketretention rule, 30 days KMS vault + keyCMK, envelope block storageencrypted, provider key instance identitywrites, cannot delete timed restoremonthly, logged OIDC federationrepo and main, 1h max break-glass secretsealed runtime credential evidence vaultObject Lock, CMK, 30d alert on readtrail to Lambda to Telegram account trailmulti-region, validated region guarddeny outside one region evidence uploaderwrite-only, no delete one-time PIN, service tokens signed JWT, main only same JWT, role pinned nightly evidence, one way, write-only logs, alerts, metrics pages in 2 min caller named emergency read only any read If this account falls the front door and its policies fall, not the host; revoke the tunnel token and the host goes dark with its data intact If this account falls data and keys live here; the host cannot delete its own backups, and the evidence copy and the break-glass credential sit with another vendor If this account falls no automation here reaches the runtime; the uploader can only add, Object Lock refuses deletes even for root, and every access lands on a validated trail request and tunnel path pipeline identity, short-lived evidence and alerts, one way break-glass, alerted on read external service
Edgeidentity → filter → tunnel, host dials out, no origin address anywhere
Identityone GitHub JWT → two clouds, pinned to main, short-lived, read-only, no stored cloud key in CI
Evidencenightly, one way, write-only, Object Lock, survives the runtime cloud
Break-glasssealed credential in the other cloud, any read → page in 2 min