TradAI Final Architecture - Security¶

Version: 10.0.0 | Date: 2026-03-28 | Source: infra/persistent/modules/, infra/compute/modules/iam.py, infra/edge/modules/waf.py, infra/shared/tradai_infra_shared/core/policy_builder.py

TL;DR: 5-layer defense: WAF (rate limiting + OWASP rules) at API Gateway, Cognito JWT auth (MFA required, TOTP), security groups per service tier, SSE-S3 encryption at rest with SSL-enforced RDS, and CloudTrail audit logging with S3 data events. IAM follows least-privilege via PolicyBuilder.

Security Architecture¶

flowchart TD
    Internet[Internet Traffic]
    Internet --> WAF["1. WAF<br/>Rate Limit · OWASP · SQLi"]
    WAF --> Cognito["2. Cognito JWT Auth<br/>MFA Required · TOTP"]
    Cognito --> SGs["3. Security Groups<br/>ALB → ECS → RDS"]
    SGs --> Encryption["4. Encryption<br/>SSE-S3 · RDS SSL · Secrets Manager"]
    Encryption --> Audit["5. CloudTrail<br/>Management + S3 Data Events"]

    style WAF fill:#f9f,stroke:#333
    style Cognito fill:#bbf,stroke:#333
    style SGs fill:#bfb,stroke:#333
    style Encryption fill:#ffb,stroke:#333
    style Audit fill:#fbb,stroke:#333

1. Authentication (Cognito)¶

User Pool Configuration¶

No custom attributes (custom:org, custom:role) are defined. No advanced security mode is enabled.

Public Client (Web/CLI)¶

Note: Development-only callback URL. Production user pool should have only HTTPS callback URLs.

Machine-to-Machine Client (CI/CD)¶

Resource Server¶

User Pool Domain¶

Cognito hosted UI at tradai-{env}.auth.eu-central-1.amazoncognito.com.

Source: infra/persistent/modules/cognito.py

2. IAM Roles¶

All roles use PolicyBuilder for DRY policy creation (infra/shared/tradai_infra_shared/core/policy_builder.py). The builder provides fluent methods like .with_dynamodb_crud(), .with_s3_readwrite(), .with_secrets_read() that generate least-privilege statements with resource patterns scoped to tradai-*.

Role Inventory¶

Lambda Role Design¶

Lambda functions share a single execution role (tradai-lambda-role-{env}), not per-function roles. The role includes managed policies (AWSLambdaBasicExecutionRole, AWSLambdaVPCAccessExecutionRole) plus an inline policy granting ECS RunTask, SQS, DynamoDB (scoped to specific table names that are actually provisioned), S3, Secrets Manager, SNS, and CloudWatch access.

Consolidated Role (dev/staging only)¶

Only created when is_consolidated_mode() returns True. Combines ECS task role permissions with EC2-specific access (ECR read-only, SSM for Session Manager, SQS for backtest queue, Service Discovery registration, ASG lifecycle hooks). Uses PolicyBuilder to eliminate ~80 lines of duplicate JSON.

Source: infra/compute/modules/iam.py, infra/foundation/modules/nat_instance.py

3. Encryption¶

S3 Buckets¶

All buckets (configs, results, arcticdb, logs, mlflow) use:

Lifecycle rules are configured per bucket where applicable: - results: Glacier transition at 30 days - logs: Delete at 90 days - configs, arcticdb, mlflow: No lifecycle rules

RDS PostgreSQL¶

DynamoDB¶

DynamoDB tables use AWS default encryption (AWS owned keys). No customer-managed KMS keys are configured.

Source: infra/persistent/modules/s3.py, infra/foundation/modules/rds.py

4. WAF (Web Application Firewall)¶

The WAF WebACL is created with scope REGIONAL and is intended for API Gateway association.

Rules¶

Default action: Allow (only matched rules block/count).

WAF Logging¶

CloudWatch Metrics¶

All rules have CloudWatch metrics enabled with sampled requests. Metric names: RateLimitRule, CommonRuleSet, KnownBadInputs, SQLiRuleSet, plus overall tradai-waf-metrics.

Source: infra/edge/modules/waf.py

5. CloudTrail¶

Trail Configuration¶

Event Selectors¶

No DynamoDB data events are configured. The code comment notes: "DynamoDB data events removed -- wildcards not supported by CloudTrail. Management events already track DynamoDB API calls. For item-level auditing, use DynamoDB Streams instead."

Insight Selectors¶

S3 Bucket Policy¶

CloudTrail has a dedicated S3 bucket policy allowing s3:GetBucketAcl and s3:PutObject (with bucket-owner-full-control ACL condition) from the cloudtrail.amazonaws.com service principal, scoped to the specific trail ARN.

Source: infra/persistent/modules/cloudtrail.py

6. Network Security¶

Network security is covered in detail in 03-VPC-NETWORKING.md. Key points:

• Security groups enforce stateful rules: ALB -> ECS/Consolidated (ports 8000-8003, 5000), Lambda -> ECS/Consolidated (same ports), ECS/Lambda -> RDS (5432), NAT accepts ALL TCP from private subnets
• NACLs provide stateless defense-in-depth at the subnet boundary; database tier only allows PostgreSQL from private subnets
• VPC endpoints keep S3, DynamoDB, ECR, STS, Secrets Manager, CloudWatch, SSM, and SQS traffic within the AWS network
• VPC Flow Logs capture all traffic to CloudWatch Logs with 7-day retention

7. What's NOT Implemented¶

The following security features are documented as planned but are not present in the current infrastructure code:

Changelog¶

Dependencies¶