|
| 1 | +--- |
| 2 | + |
| 3 | +copyright: |
| 4 | + years: 2023 |
| 5 | +lastupdated: "2023-12-15" |
| 6 | + |
| 7 | +keywords: |
| 8 | + |
| 9 | +subcollection: deployable-reference-architectures |
| 10 | + |
| 11 | +authors: |
| 12 | + - name: "Vincent Burckhardt" |
| 13 | + |
| 14 | +# The release that the reference architecture describes |
| 15 | +version: 5.3.1 |
| 16 | + |
| 17 | +# Whether the reference architecture is published to Cloud Docs production. |
| 18 | +# When set to false, the file is available only in staging. Default is false. |
| 19 | +production: true |
| 20 | + |
| 21 | +# Use if the reference architecture has deployable code. |
| 22 | +# Value is the URL to land the user in the IBM Cloud catalog details page |
| 23 | +# for the deployable architecture. |
| 24 | +# See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button |
| 25 | +deployment-url: https://cloud.ibm.com/catalog/architecture/deploy-arch-ibm-slz-vpc-9fc0fa64-27af-4fed-9dce-47b3640ba739-global |
| 26 | + |
| 27 | +docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc |
| 28 | + |
| 29 | +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/vsi-extension.drawio.svg |
| 30 | + |
| 31 | +related_links: |
| 32 | + - title: "VPC landing zone - Standard variation" |
| 33 | + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-vsi-ra" |
| 34 | + description: "A deployable architecture that is based on the IBM Cloud for Financial Services reference and that provides virtual servers in a secure VPC for your workloads." |
| 35 | + - title: "Red Hat OpenShift Container Platform on VPC landing zone" |
| 36 | + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-ocp-ra" |
| 37 | + description: "A deployable architecture that provides virtual servers in a secure VPC for your workloads." |
| 38 | + |
| 39 | +use-case: Cybersecurity |
| 40 | +industry: Banking,FinancialSector |
| 41 | +compliance: FedRAMP |
| 42 | + |
| 43 | +content-type: reference-architecture |
| 44 | + |
| 45 | +--- |
| 46 | + |
| 47 | +{{site.data.keyword.attribute-definition-list}} |
| 48 | + |
| 49 | +# VSI on existing VPC landing zone - Extension |
| 50 | +{: #vsi-ext-ra} |
| 51 | +{: toc-content-type="reference-architecture"} |
| 52 | +{: toc-industry="Banking,FinancialSector"} |
| 53 | +{: toc-use-case="Cybersecurity"} |
| 54 | +{: toc-compliance="FedRAMP"} |
| 55 | +{: toc-version="5.3.1"} |
| 56 | + |
| 57 | +This deployable architecture extends an existing VPC deployable architecture by creating virtual server instances (VSI) in some or all of the subnets of any existing landing zone VPC deployable architecture. The architecture is based on the IBM Cloud for Financial Services reference architecture. |
| 58 | + |
| 59 | +## Architecture diagram |
| 60 | +{: #ra-vsi-ext-architecture-diagram} |
| 61 | + |
| 62 | +{: caption="Figure 1. VSI on existing landing zone - Extension" caption-side="bottom"}{: external download="vsi-extension.drawio.svg"} |
| 63 | + |
| 64 | +## Design requirements |
| 65 | +{: #ra-vsi-ext-design-requirements} |
| 66 | + |
| 67 | +{: caption="Figure 2. Scope of the design requirements" caption-side="bottom"} |
| 68 | + |
| 69 | +<!-- |
| 70 | +TODO: Add the typical use case for the architecture. |
| 71 | +The use case might include the motivation for the architecture composition, |
| 72 | +business challenge, or target cloud environments. |
| 73 | +--> |
| 74 | + |
| 75 | +## Components |
| 76 | +{: #ra-vsi-ext-components} |
| 77 | + |
| 78 | +### VPC architecture decisions |
| 79 | +{: #ra-vsi-ext-components-arch} |
| 80 | + |
| 81 | +| Requirement | Component | Reasons for choice | Alternative choice | |
| 82 | +|-------------|-----------|--------------------|--------------------| |
| 83 | +| Create virtual server instances to support management | Management virtual server instances | Create a VPC virtual server instance that can be used for management and maintenance of your hosted application. Configure ACL and security group rules to allow access to IBM Cloud services, and workload and management VPCs. | | |
| 84 | +| * Demonstrate compliance with control requirements of the IBM Cloud Framework for Financial Services \n * Set up network for all created services \n * Isolate network for all created services \n * Ensure all created services are interconnected | Secure landing zone components | Create a minimum set of required components for a secure landing zone | Create a modified set of required components for a secure landing zone in preset | |
| 85 | +{: caption="Table 1. Architecture decisions" caption-side="bottom"} |
| 86 | + |
| 87 | +### Key and password management architecture decisions |
| 88 | +{: #ra-vsi-ext-components-arch-key-pw} |
| 89 | + |
| 90 | +| Requirement | Component | Reasons for choice | Alternative choice | |
| 91 | +|-------------|-----------|--------------------|--------------------| |
| 92 | +| * Use public SSH key to access virtual server instances by using SSH | Public SSH key provided by customer | Ask customer to specify the key. Accept the input as secure parameter. | | |
| 93 | +{: caption="Table 3. Key and password management architecture decisions" caption-side="bottom"} |
| 94 | + |
| 95 | +<!-- |
| 96 | +## Compliance |
| 97 | +{: #ra-vsi-ext-compliance} |
| 98 | +
|
| 99 | +_Optional section._ Feedback from users implies that architects want only the high-level compliance items and links off to control details that team members can review. Include the list of control profiles or compliance audits that this architecture meets. For controls, provide "learn more" links to the control library that is published in the IBM Cloud Docs. For audits, provide information about the compliance item. |
| 100 | +--> |
| 101 | + |
| 102 | +## Next steps |
| 103 | +{: #ra-vsi-ext-next-steps} |
| 104 | + |
| 105 | +- See the landing zone [deployment guide](https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-overview). |
| 106 | +- Read about [IBM Cloud for Financial Services](/docs/framework-financial-services?topic=framework-financial-services-about) |
0 commit comments