TradAI Final Architecture - Security¶

Version: 10.0.0 | Date: 2026-03-28 | Source: infra/persistent/modules/, infra/compute/modules/iam.py, infra/edge/modules/waf.py, infra/shared/tradai_infra_shared/core/policy_builder.py

TL;DR: 5-layer defense: WAF (rate limiting + OWASP rules) at API Gateway, Cognito JWT auth (MFA required, TOTP), security groups per service tier, SSE-S3 encryption at rest with SSL-enforced RDS, and CloudTrail audit logging with S3 data events. IAM follows least-privilege via PolicyBuilder.

Security Architecture¶

flowchart TD
    Internet[Internet Traffic]
    Internet --> WAF["1. WAF<br/>Rate Limit · OWASP · SQLi"]
    WAF --> Cognito["2. Cognito JWT Auth<br/>MFA Required · TOTP"]
    Cognito --> SGs["3. Security Groups<br/>ALB → ECS → RDS"]
    SGs --> Encryption["4. Encryption<br/>SSE-S3 · RDS SSL · Secrets Manager"]
    Encryption --> Audit["5. CloudTrail<br/>Management + S3 Data Events"]

    style WAF fill:#f9f,stroke:#333
    style Cognito fill:#bbf,stroke:#333
    style SGs fill:#bfb,stroke:#333
    style Encryption fill:#ffb,stroke:#333
    style Audit fill:#fbb,stroke:#333

1. Authentication (Cognito)¶

User Pool Configuration¶

No custom attributes (custom:org, custom:role) are defined. No advanced security mode is enabled.

Public Client (Web/CLI)¶

Note: Development-only callback URL. Production user pool should have only HTTPS callback URLs.

Machine-to-Machine Client (CI/CD)¶

Resource Server¶

User Pool Domain¶

Cognito hosted UI at tradai-{env}.auth.eu-central-1.amazoncognito.com.

Source: infra/persistent/modules/cognito.py

2. IAM Roles¶

All roles use PolicyBuilder for DRY policy creation (infra/shared/tradai_infra_shared/core/policy_builder.py). The builder provides fluent methods like .with_dynamodb_crud(), .with_s3_readwrite(), .with_secrets_read() that generate least-privilege statements with resource patterns scoped to tradai-*.

Role Inventory¶

GitHub Actions authentication¶

The publishing workflows hold no AWS access keys. They assume tradai-gha-publish-* by OIDC (Pulumi appends an auto-name suffix; read the real ARN with pulumi stack output github_actions_publish_role_arn, which is what the CODEARTIFACT_PUBLISH_ROLE_ARN repository variable carries), and its trust policy admits exactly one subject:

repo:tradai-bot/tradai:environment:publish-dev

Why the subject is scoped to an environment rather than a branch. workflow_dispatch runs the workflow file as it exists at the dispatched ref, so anyone with write access can push a branch with any in-file guard deleted and dispatch from it. No condition inside the workflow can prevent that. What survives is that GitHub mints the environment: subject only for a job that references an environment: strip the line on a hostile ref and the run presents ref:refs/heads/<branch>, which the trust policy rejects, so no AWS credentials are ever issued. The enforcement lives in AWS, not in the workflow.

That closes the AWS vector only. DASHBOARD_DISPATCH_PAT, consumed by publish-npm-types, is still a repository-level secret, so a hostile ref that strips environment: is handed a token with write access to tradai-bot/tradai-dashboard regardless. Moving it into the environment is outstanding (#1343).

Two consequences worth knowing before changing any of this:

• GitHub auto-creates a referenced environment with zero protection rules on first use. The publish-dev deployment-branch policy (branch type, dev only) was configured by hand and is not reproduced by any code in this repo. Nothing detects it being widened — tracked as #1355.

• The policy must never contain a tag entry. A deployment-branch policy is evaluated against the run's github.ref, which on workflow_dispatch is the operator-chosen ref; this repo has no tag ruleset, so any write-access user could create v9.9.9 on a branch whose copy of the workflow has its validation removed and dispatch from that tag.

• publish-dev is the only protected environment. dev and infra-pr-preview have zero protection rules and no branch policy, and the repo has no v* tag ruleset — so tradai-gha-deploy-* (AdministratorAccess) and tradai-gha-infra-preview-* are assumable today by any write-access contributor, from any branch, by declaring the matching environment: and id-token: write. The reasoning above protects publishing only; it does not extend to these two roles.

The three deploy workflows (docker-build, deploy-infra, deploy-lambdas) still use static AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY secrets and carry the same hostile-dispatch exposure. Migrating them is #582.

Lambda Role Design¶

Lambda functions share a single execution role (tradai-lambda-role-{env}), not per-function roles. The role includes managed policies (AWSLambdaBasicExecutionRole, AWSLambdaVPCAccessExecutionRole) plus an inline policy granting ECS RunTask, SQS, DynamoDB (scoped to specific table names that are actually provisioned), S3, Secrets Manager, SNS, and CloudWatch access.

Consolidated Role (dev/staging only)¶

Only created when is_consolidated_mode() returns True. Combines ECS task role permissions with EC2-specific access (ECR read-only, SSM for Session Manager, SQS for backtest queue, Service Discovery registration, ASG lifecycle hooks). Uses PolicyBuilder to eliminate ~80 lines of duplicate JSON.

Source: infra/compute/modules/iam.py, infra/foundation/modules/nat_instance.py

3. Encryption¶

S3 Buckets¶

All buckets (configs, results, arcticdb, logs, mlflow) use:

Lifecycle rules are configured per bucket where applicable: - results: Glacier transition at 30 days - logs: Delete at 90 days - configs, arcticdb, mlflow: No lifecycle rules

RDS PostgreSQL¶

DynamoDB¶

DynamoDB tables use AWS default encryption (AWS owned keys). No customer-managed KMS keys are configured.

Source: infra/persistent/modules/s3.py, infra/foundation/modules/rds.py

4. WAF (Web Application Firewall)¶

The WAF WebACL is created with scope REGIONAL and is intended for API Gateway association.

Rules¶

Default action: Allow (only matched rules block/count).

WAF Logging¶

CloudWatch Metrics¶

All rules have CloudWatch metrics enabled with sampled requests. Metric names: RateLimitRule, CommonRuleSet, KnownBadInputs, SQLiRuleSet, plus overall tradai-waf-metrics.

Source: infra/edge/modules/waf.py

5. CloudTrail¶

Trail Configuration¶

Event Selectors¶

No DynamoDB data events are configured. The code comment notes: "DynamoDB data events removed -- wildcards not supported by CloudTrail. Management events already track DynamoDB API calls. For item-level auditing, use DynamoDB Streams instead."

Insight Selectors¶

S3 Bucket Policy¶

CloudTrail has a dedicated S3 bucket policy allowing s3:GetBucketAcl and s3:PutObject (with bucket-owner-full-control ACL condition) from the cloudtrail.amazonaws.com service principal, scoped to the specific trail ARN.

Source: infra/persistent/modules/cloudtrail.py

6. Network Security¶

Network security is covered in detail in 03-VPC-NETWORKING.md. Key points:

• Security groups enforce stateful rules: ALB -> ECS/Consolidated (ports 8000-8003, 5000), Lambda -> ECS/Consolidated (same ports), ECS/Lambda -> RDS (5432), NAT accepts ALL TCP from private subnets
• NACLs provide stateless defense-in-depth at the subnet boundary; database tier only allows PostgreSQL from private subnets
• VPC endpoints keep S3, DynamoDB, ECR, STS, Secrets Manager, CloudWatch, SSM, and SQS traffic within the AWS network
• VPC Flow Logs capture all traffic to CloudWatch Logs with 7-day retention

7. What's NOT Implemented¶

The following security features are documented as planned but are not present in the current infrastructure code:

Changelog¶

Dependencies¶