Business Rules - Cloud Infrastructure

This document lists the fundamental business rules of the Cloud Infrastructure domain, each identified by a unique BR-NNN code. Every rule is technology-independent (valid on AWS, Azure, GCP or private cloud) and describes an invariant constraint on the infrastructure system's behavior.

---

BR-001 - All infrastructure is described as versioned code

Code: BR-001 Name: No cloud resource provisioned outside Infrastructure as Code Description: Every cloud resource (network, compute, storage, IAM) must be defined in a versioned IaCModule and applied through the provisioning flow. Manual console changes ("click-ops") are forbidden because they create untracked drift. Rationale: Reproducibility, audit, rollback and prevention of drift between desired and real state. Priority: HIGH Actors: Platform Engineer, Provisioning Engine Violation: the DriftDetected event opens a reconciliation task; the out-of-code resource is re-imported or destroyed. Traceability: HashiCorp Terraform docs; AWS Well-Architected OPS; provision-infrastructure.md.

---

BR-002 - Idempotent provisioning

Code: BR-002 Name: Applying the same plan multiple times produces the same state Description: An apply by the Provisioning Engine of the same IaCModule with the same input must converge to the same InfrastructureState without creating duplicate resources. A retry after a network timeout must not double the resources. Rationale: Retry safety in the presence of network failures; deterministic convergence. Priority: HIGH Actors: Provisioning Engine Traceability: Idempotency (glossary); 12factor.net; provision-infrastructure.md.

---

BR-003 - Mandatory multi-zone redundancy for production workloads

Code: BR-003 Name: Every production workload is spread across at least two Availability Zones Description: A Workload with production tier must have replicas spread across ≥2 AvailabilityZone of the same Region. A single zonal point of failure must not cause total service unavailability. Rationale: High availability; tolerance to the failure of a single zone. Priority: HIGH Actors: Platform Engineer, Load Balancer Violation: deploy blocked if policy detects a single-AZ production workload. Traceability: AWS Well-Architected REL; failover-recovery.md.

---

BR-004 - Least privilege on every identity

Code: BR-004 Name: Every IAMPolicy grants only strictly necessary permissions Description: No identity (user, role, service account) may have broader permissions than its function requires. Wildcard permissions (:) on production resources are forbidden. Rationale: Reduce the attack surface; contain the blast radius of a compromised credential (zero trust). Priority: CRITICAL Actors: Security Engineer, Identity Provider Violation: the policy-scan pipeline rejects the merge; security audit. Traceability: NIST SP 800-207 (Zero Trust); CIS Benchmarks; OWASP Cloud-Native Top 10.

---

BR-005 - Secrets never reside in code or images

Code: BR-005 Name: Every secret is held in a Secrets Manager and injected at runtime Description: Credentials, API keys, certificates and passwords must never appear in IaC repositories, container images, plaintext environment variables in manifests, or logs. They must be retrieved at runtime from an audited secrets manager. Rationale: Prevent credential disclosure; enable rotation without redeploy. Priority: CRITICAL Actors: Security Engineer, Provisioning Engine Violation: the supply-chain scan blocks the commit; immediate rotation of the exposed secret. Traceability: CIS Benchmarks; AWS Well-Architected SEC; best-practices.md.

---

BR-006 - Encryption in transit and at rest by default

Code: BR-006 Name: All data is encrypted in transit (TLS 1.2+) and at rest Description: Communication between components happens over TLS 1.2 minimum (1.3 preferable); storage volumes and backups are encrypted at rest with managed keys. No endpoint accepts cleartext traffic over untrusted networks. Rationale: Data confidentiality and integrity; compliance. Priority: CRITICAL Actors: Security Engineer, Load Balancer Traceability: RFC 8446 (TLS 1.3); NIST SP 800-145; AWS Well-Architected SEC.

---

BR-007 - Verified backups and defined RTO/RPO

Code: BR-007 Name: Every stateful workload has a disaster recovery plan with stated RTO/RPO Description: Every Workload that persists data must have periodic backups, a RecoveryPointObjective (maximum tolerable data loss) and a RecoveryTimeObjective (maximum recovery time) documented. Restore procedures must be periodically tested, not merely configured. Rationale: Ensure real recoverability; an untested backup is not a backup. Priority: HIGH Actors: Platform Engineer, SRE Traceability: AWS Well-Architected REL; failover-recovery.md; BR-003.

---

BR-008 - Backend resources isolated in private subnets

Code: BR-008 Name: Databases and internal services are not reachable from the public internet Description: Every resource that must not be publicly exposed (database, cache, internal services) resides in a PrivateSubnet without a public IP. External access happens only through controlled LoadBalancer/Ingress or bastion/VPN. Rationale: Reduce the exposed surface; defense in depth. Priority: HIGH Actors: Network Engineer, Platform Engineer Traceability: Virtual Private Cloud (glossary); NIST SP 800-207; best-practices.md.

---

BR-009 - Continuous cost governance

Code: BR-009 Name: Every resource has an owner and cost tags; waste is recovered Description: Every provisioned resource must have attribution tags (owner, environment, cost center). Orphaned, oversized or unused resources must be identified and decommissioned or rightsized. The cloud budget is monitored with threshold alerts. Rationale: Avoid economic waste; make teams accountable for consumption. Priority: MEDIUM Actors: FinOps Analyst, Platform Engineer Traceability: AWS Well-Architected COST; cost-governance.md.