GCP-Startup-Example/ARCHITECTURE_REPORT.json at main · Merlin-Studio/GCP-Startup-Example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
{
  "_license": "Generated by Merlin Studio (https://site.merlin-studio.cloud). Licensed under CC BY-ND 4.0.",
  "data": [
    {
      "category": "IP Planning",
      "check": "Hub subnet sizing",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "Not using hub-spoke architecture; check not applicable."
    },
    {
      "category": "IP Planning",
      "check": "CIDR overlap",
      "status": "PASS",
      "score_impact": 0,
      "weight": 20,
      "explanation": "No hybrid connectivity or no subnets; overlap check not applicable."
    },
    {
      "category": "IP Planning",
      "check": "GKE secondary ranges",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "GKE not enabled; check not applicable."
    },
    {
      "category": "Multi-Region",
      "check": "DR region configured",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "Multi-region not required; check not applicable."
    },
    {
      "category": "Multi-Region",
      "check": "DR data sovereignty",
      "status": "PASS",
      "score_impact": 0,
      "weight": 20,
      "explanation": "Not a government org or multi-region not required; check not applicable."
    },
    {
      "category": "Multi-Region",
      "check": "DR subnet coverage",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "Multi-region not required; check not applicable."
    },
    {
      "category": "GKE",
      "check": "Network refs valid",
      "status": "PASS",
      "score_impact": 0,
      "weight": 20,
      "explanation": "GKE not enabled; check not applicable."
    },
    {
      "category": "GKE",
      "check": "Private cluster",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "No GKE clusters defined; check not applicable."
    },
    {
      "category": "Hybrid",
      "check": "Interconnect redundancy",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "Not using Interconnect; check not applicable."
    },
    {
      "category": "Hybrid",
      "check": "VLAN region",
      "status": "PASS",
      "score_impact": 0,
      "weight": 5,
      "explanation": "Not using Interconnect; check not applicable."
    },
    {
      "category": "Naming",
      "check": "Cross-section consistency",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "Cross-section resource name references are consistent."
    },
    {
      "category": "Identity",
      "check": "SA least privilege",
      "status": "PASS",
      "score_impact": 0,
      "weight": 15,
      "explanation": "All service accounts use purpose-specific predefined roles."
    },
    {
      "category": "Security",
      "check": "CMEK Encryption",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "CMEK enabled. Key rings will be auto-generated from workload services."
    },
    {
      "category": "Security",
      "check": "DLP Configuration",
      "status": "PASS",
      "score_impact": 0,
      "weight": 0,
      "explanation": "DLP check skipped \u2014 Advanced Security section not applicable for this profile/compliance."
    },
    {
      "category": "Security",
      "check": "Cloud Armor WAF",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "Cloud Armor enabled with 1 WAF policy(ies)."
    },
    {
      "category": "Identity",
      "check": "Service accounts",
      "status": "PASS",
      "score_impact": 0,
      "weight": 10,
      "explanation": "Custom service accounts defined."
    },
    {
      "category": "Hierarchy",
      "check": "Hierarchy type",
      "status": "PASS",
      "score_impact": 0,
      "weight": 20,
      "explanation": "Using environment_based hierarchy."
    },
    {
      "category": "Security",
      "check": "Org policies",
      "status": "PASS",
      "score_impact": 0,
      "weight": 50,
      "explanation": "8 organization policies enforced."
    },
    {
      "category": "Logging",
      "check": "Log retention",
      "status": "PASS",
      "score_impact": 0,
      "weight": 5,
      "explanation": "Audit logging configured with adequate retention."
    }
  ]
}