%%title: High Level Overview

flowchart TD

%%style
classDef govAcctStyle stroke:#167CC5,stroke-width:4px
classDef comAcctStyle stroke:#ea8d02,stroke-width:4px
classDef govOrgStyle stroke:#bc0061,stroke-width:4px
classDef comOrgStyle stroke:#010daf,stroke-width:4px
classDef vpcStyle stroke:#616363,stroke-width:3px,stroke-dasharray: 3 1
classDef regionStyle stroke:#616363,stroke-width:3px,stroke-dasharray: 10 1
classDef subnetStyle stroke:#616363,stroke-width:3px,stroke-dasharray: 1 1

%%External entities or services
appconsumer{App Consumer<br>Customers}
appdeveloper{App Developer<br>Customers}
operators((GSA Cloud.gov<br>Operators))
zscaler[Zscaler GSA Network Routing]
subgraph gsaauth [GSA Auth]
  gsaokta{Okta}
end
subgraph Other Fed Auth
  extauth{External Auth}
end

%%Accreditation boundary
subgraph cgAccd [Cloud.gov]
  subgraph awsComOrg [AWS Commercial Org]

    subgraph cnapAcct [CNAP Account]
      transit[AWS Transit Gateway]
      advfirewall[AWS Network Firewall]
      identitycentercom["AWS Identity Center<br>(auth within AWS)"]
    end
    class cnapAcct comAcctStyle

    subgraph cusAccAcct [Customer Access Account]
      route53[Route53 DNS]
      cloudfront[Cloudfront CDNs]
      wafShield[AWS WAF and Shield Advanced]
      webNetFirewall[AWS Network Firewall]
    end
    class cusAccAcct comAcctStyle

    subgraph govLogCollAcct [Monitoring and Logging Account]
      kinesisfirehose[Kinesis Firehose]
      logollectioncom[OpenSearch Log Collection]
      comContTwr[AWS Control Tower]
      comSecHub[Security Hub]
    end
    class govLogCollAcct comAcctStyle

  end
  class awsComOrg comOrgStyle

  subgraph awsGovOrg [AWS GovCloud Org]
      subgraph priPlatAcct [Primary Platform Account]
        subgraph usGovWestRegion[US Gov West Region]

          subgraph vpcProd1 [VPC Prod]

              subgraph pubSubnet1 [Public Subnet]
                appalbs[ALBs for App Access]
                devalbs[ALBs for Dev Access]
                sshproxy[App Dev SSH Proxy]
              end
              class pubSubnet1 subnetStyle

              subgraph cfAppSubnet [CloudFroudry App Subnet]
              gorouter[CloudFoundry Gorouters]
              prodUaa[Production UAA]
                subgraph diego[Container Management]
                  diegoCell(Web App UI)
                  customerApp1{Customer App<br>Containers}
                end
              end
              class cfAppSubnet subnetStyle

          end
          class vpcProd1 vpcStyle

        end
      class usGovWestRegion regionStyle


    end
    class priPlatAcct govAcctStyle

    subgraph drDataAcct [DR Data Account]
        subgraph usGovEastRegion[US Gov East Region]
          replicatedRDS[RDS DB Copy]
          replicatedS3[S3 Data copy]
        end
        class usGovEastRegion regionStyle
    end
    class drDataAcct govAcctStyle

    subgraph govStageAcct [Staging Account]
        preprod[Near Mirror of Primary Prod account]
    end
    class govStageAcct govAcctStyle

    subgraph govDevAcct [Development Account]
        dev[Sufficient resources for Platform Development]
    end
    class govDevAcct govAcctStyle

    subgraph govToolAcct [Tooling Account<br>aka Hub]
      subgraph toolVPC [Tooling VPC]
              subgraph cfOpsSubnet [CloudFoundry Ops Subnet]
              privalb[ALB for Privileged Users]
              uaa["UAAs<br>(auth within CloudFoundry)"]
              jumpbox[Jumpbox]
              concourse[Concourse CI/CD]
              BOSH[BOSH Director]
              boshDB[BOSH Director DB in RDS]
              s3CritData[Critical Data in S3]
              end
              class cfOpsSubnet subnetStyle
      end
      class toolVPC vpcStyle
    end
    class govToolAcct govAcctStyle

    subgraph govMonAcct [Monitoring and Logging Account]
      logollectiongov[OpenSearch Log Collection]
      vulndetect[Vulnerability Detection Tools]
      logviz[Log Visualization and Query]
      govContTwr[AWS Control Tower]
      govSecHub[Security Hub]
    end
    class govMonAcct govAcctStyle

  end
  class awsGovOrg govOrgStyle

end

%%Connections
wafShield <-.Multiple ACLs.-> cloudfront
cloudfront -- Web HTTPS 443 --> appalbs
appconsumer -- Web HTTPS 443 --> cloudfront
jumpbox -.auth.-> uaa
concourse -.auth.-> uaa
privalb -- Ops CLI --> jumpbox
privalb -- Ops Web HTTPS 443 --> concourse
transit -- Dev CLI SSH --> devalbs
devalbs -- Dev CLI SSH --> sshproxy
sshproxy-.auth.-> prodUaa
prodUaa -.auth.- extauth & gsaokta
sshproxy -- CLI SSH --> gorouter
operators -- Web or CLI HTTPS 443 --> zscaler --> advfirewall
advfirewall -- Web or CLI HTTPS 443 --> transit
transit -- Web or CLI HTTPS 443 --> privalb
appdeveloper -- Web or CLI HTTPS 443 --> advfirewall
appalbs -- Web HTTPS 443 --> gorouter
gorouter -- Web HTTPS 443 --> diegoCell
gorouter -- CLI SSH 22 --> customerApp1
kinesisfirehose -.Encrypted Log Transfer.-> logollectiongov
uaa -.auth.-> gsaokta
logollectioncom -.Log Transfer.->kinesisfirehose
operators -.auth.-> identitycentercom
identitycentercom -.auth.-> gsaokta
BOSH --> boshDB
boshDB -.RDS Replication.-> replicatedRDS
s3CritData -.S3 Cross Region Replication.-> replicatedS3
%%Connections below commented until later, maybe needs dedicated diagram
%%Messes up the entire digram if shown currently
%%govToolAcct .-> govDevAcct & govStageAcct & priPlatAcct

%%Legend
  subgraph Legend
    direction TB
    legend_CommOrg[AWS Commercial Organization]:::comOrgStyle
    legend_GovOrg[AWS GovCloud Organization]:::govOrgStyle
    legend_CommAcct[AWS Commercial Account]:::comAcctStyle
    legend_GovAcct[AWS GovCloud Account]:::govAcctStyle
    legend_region[AWS Region]:::regionStyle
    legend_vpc[AWS VPC]:::vpcStyle
    legend_subnet[AWS Subnet]:::subnetStyle
  end

%%Goals
  subgraph Architecture Draft 1 Diagram Goals
    textbox[Facilitate discussion<br>SCCA/CNAP inclusion<br>Multi-account<br>Separation of Prod and Non-Prod<br>Centralized Logging<br>DR data replicas]
  end
  
