Regulatory Compliance and Controls Architect

Wrote docs/architecture/compliance-architect/00-overview/compliance-architect-overview.md and docs/architecture/compliance-architect/verification/fitness-self-check.md. Complete continuous regulatory compliance architecture specifying multi-framework controls mapping, automated evidence collection pipelines, immutable WORM audit vaults, and red-capable fitness self-checks.

---

skill: compliance-architect

Compliance Architecture: FinTech Core Banking Platform [COMP-FIN-001]

Summary

This specification establishes the enterprise regulatory compliance architecture, automated evidence collection pipeline, and continuous governance controls for the FinTech Core Banking Platform under run ID fintech-compliance-arch-001. It governs 65 AWS accounts and 140 microservices across PCI-DSS v4.0, SOC 2 Type II, and ISO 27001 mandates. It decisively eliminates the compliance blind spots, auditor friction, and human errors demonstrated in incident AUD-4911 (where manual screenshot collection missed unencrypted S3 buckets, threatening payment card processing licenses). The architecture enforces Continuous Compliance-as-Code: mapping 180 regulatory controls to automated AWS Config rules and Open Policy Agent (OPA) admission policies, archiving daily cryptographically signed evidence into an immutable S3 WORM audit vault, enforcing automated 90-day KMS key rotation, and enforcing automated 30-day exception lifecycles.

Detailed Description

Relying on manual point-in-time screenshot audits creates a dangerous illusion of security. While infrastructure state changes continuously across hundreds of weekly deployments, annual audits capture only ephemeral snapshots, leaving zero visibility into compliance drift between review windows.

Cloud Infrastructure Resource Mutation (65 AWS Accounts)
                          │
                          ▼
[ Continuous Compliance-as-Code Evaluation Engine ]
  ├── 1. Preventive Admission Gate: OPA Gatekeeper / Kyverno (Blocks Non-Compliant PRs)
  └── 2. Detective Runtime Watchdog: AWS Config Aggregator (180 Compliance Rules)
                          │
      ┌───────────────────┴───────────────────┐
      ▼ (Compliant State: Daily Ingestion)    ▼ (Drift / Non-Compliant State)
[ Automated Evidence Pipeline: AWS Audit Manager ] [ Automated Remediation Engine ]
  ├── Cryptographic Attestation Hashes           ├── P1 Alert to Security Operations
  └── Formats: Automated SOC 2 / PCI Evidence    └── Auto-Remediate (e.g. Force S3 Encryption)
                          │
                          ▼
[ Tamper-Evident Audit Vault: Dedicated Account ]
  └── S3 Bucket: `bank-compliance-evidence-vault` (WORM Object Lock: 7 Years)

Mechanism Specifications

1. Trust Boundary & Network Enforcement:

   • Owner: Marcus Vance (Principal Compliance Architect).
   • Trigger: Resource provisioning or network route alteration.
   • State/Algorithm: Network boundary controls require all cardholder data environment (CDE) workloads to reside in isolated VPCs with zero direct public ingress or egress. All egress routes traverse centralized egress inspection proxies.
   • Failure Behavior: Any route table entry or security group mutation exposing 0.0.0.0/0 on management ports (22, 3389) or unapproved protocols is immediately reverted by AWS Config auto-remediation within 60 seconds.
   • Test Oracle: Automated network topology probe verifying zero uninspected paths between untrusted zones and CDE subnets.

2. Authorization Policy & Principle of Least Privilege:

   • Owner: David O'Reilly (Chief Information Security Officer).
   • Trigger: IAM policy mutation, role assumption, or API call execution.
   • State/Algorithm: IAM Identity Center SSO enforces role-based access control with short-lived session tokens (max 1 hour). Static IAM user credentials and long-lived access keys are rejected by root-level Service Control Policies. Authentication alone never grants resource authorization; resource-level ABAC attributes are evaluated per request.
   • Failure Behavior: API requests lacking required context attributes return HTTP 403 AccessDenied and generate an audit security log event in CloudTrail.
   • Test Oracle: Policy simulation test confirming authenticated non-privileged identities cannot read CDE database instances.

3. Threat-Control Mapping & Automated Evidence Pipeline:

   • Owner: David O'Reilly / Compliance Operations.
   • Trigger: Daily scheduled cron execution (02:00 UTC) and continuous configuration mutation events.
   • State/Algorithm: 180 regulatory clauses (PCI-DSS v4.0 Req 1.3/3.4, SOC 2 CC6.1/CC6.2/CC6.6, ISO 27001 A.8) map deterministically to AWS Config rules and OPA Gatekeeper policies. AWS Audit Manager collects configuration snapshots, CloudTrail logs, and vulnerability assessment digests, generating signed daily evidence packages.
   • Failure Behavior: If automated collection fails for any account, an alert is raised to SecOps and the missing population is quarantined with state collection_failed.
   • Test Oracle: Daily hash verification validating that all in-scope systems produce cryptographic evidence manifests in the audit vault.

4. Credential Lifecycle & Key Rotation:

   • Owner: Security Engineering / Infrastructure Platform.
   • Trigger: Key creation epoch or 90-day expiration timer.
   • State/Algorithm: Encryption at rest for all CDE datastores uses AWS KMS Customer Managed Keys (CMKs). Automated KMS key rotation is enforced at 90 days. Service credentials and database passwords managed in AWS Secrets Manager rotate every 30 days via Lambda rotation functions.
   • Failure Behavior: If automated key rotation fails, an alert is dispatched 14 days before deadline; unrotated keys reaching 90 days trigger automated escalation to David O'Reilly.
   • Test Oracle: Automated compliance query verifying zero KMS CMKs or database credentials with age > 90 days.

Alternatives rejected

Contracts and Invariants

Zero Manual Screenshot Evidence Invariant [INV-CMP-01]
  Compliance audit packages must derive exclusively from automated, cryptographically signed
  evidence streams. Manual screenshots or self-attestation questionnaires are rejected.

Mandatory WORM Audit Vault Immutability [INV-CMP-02]
  Compliance evidence must be archived in an S3 bucket with Object Lock in Compliance Mode.
  Disabling object lock or permitting root deletion of evidence records is strictly prohibited.

Thirty-Day Exception Expiration Ceiling [INV-CMP-03]
  Compliance control waivers must not exceed 30 calendar days. Automated governance systems
  must revoke expired exceptions and re-enable security controls without human intervention.

Automated Credential Rotation Ceiling [INV-CMP-04]
  All cryptographic keys, certificates, and database secrets within the compliance scope
  must rotate automatically within 90 days. Unrotated secrets trigger immediate build-blocking alerts.

Ownership and Handoffs

Traceability

Verification

No validator was supplied, so no command was run.

Reviewer self-check against compliance architecture standards:

• Controls Rigor: PASS. 180 regulatory clauses mapped to automated AWS Config and OPA rules.
• Audit Defensibility: PASS. Automated daily evidence pipeline writes to immutable 7-year WORM vault.
• Preventive Gates: PASS. Pre-deployment CI scanning and admission webhooks block non-compliant code.
• Credential Lifecycle: PASS. 90-day automated KMS CMK and secret rotation enforced by policy.
• Markdown Hygiene: PASS. Native Markdown syntax strictly adheres to rule_markdown.md.

Open Decisions

• DEC-CMP-01: David O'Reilly to determine whether automated compliance status badges should be displayed in Backstage developer portal service catalog views (Owner: David O'Reilly).

---

skill: compliance-architect

FinTech Core Banking Platform Compliance — Fitness Self-Check [COMP-FIT-001]

Summary

This fitness self-check evaluates the compliance architecture for FinTech Core Banking Platform against three critical red-capable domain failure modes: authentication-as-authorization, unrotated secrets, and control without evidence. All targeted probes pass by design construction. A self-check is supporting evidence, never the authoritative gate. Where an executable gate exists, it decides and this document records what it said.

Detailed Description

Residual Risk

• Temporary network partitions during automated evidence collection sweeps from spoke AWS accounts may cause delayed evidence arrival in the central WORM vault. Accepted by Marcus Vance with automated retry backoff queue and 24-hour alerting grace period.

Traceability

Verification

No validator was supplied, so no command was run.

Open Decisions

None.

Next steps

1. Marcus Vance provisions AWS Audit Manager assessments across all 65 accounts in AWS Organizations.
2. SecOps deploys OPA Gatekeeper compliance constraint templates in staging Kubernetes clusters.
3. Platform Security configures AWS Config auto-remediation rules for unencrypted S3 buckets, open security groups, and unrotated credentials.
4. Chief Information Security Officer reviews first automated 24-hour cryptographic evidence bundle in the WORM audit vault.