threagile_version: "1.0.0"
title: "Tiny Coverage 1"

data_assets:
  Customer Accounts:
    confidentiality: strictly-confidential
    integrity: critical
    availability: critical
  Internal Logs:
    confidentiality: restricted
    integrity: archive
    availability: archive
  Public Content:
    confidentiality: public
    integrity: important
    availability: important
  ERP Config:
    confidentiality: internal
    integrity: critical
    availability: operational
  DB Dumps:
    confidentiality: confidential
    integrity: important
    availability: operational

technical_assets:
  Internet User:
    type: external-entity
    internet: true
    communication_links:
      to-lb:
        target: Load Balancer
        protocol: https
        data_assets_sent: [Customer Accounts]

  Load Balancer:
    type: process
    tags: [aws:alb]
    communication_links:
      web-traffic:
        target: Web App
        protocol: http
        authentication: session-id
        data_assets_sent: [Customer Accounts, Public Content]

  Web App:
    type: process
    internet: false
    encryption: none
    tags: [web, no-hsts, no-csrf, cors-allow-all, credentials, builds-sql, no-secret-rotation, debug]
    data_assets_processed: [Customer Accounts, Public Content, ERP Config]
    communication_links:
      to-idp:
        target: Identity Provider
        protocol: https
        authentication: token
        data_assets_sent: [Customer Accounts]
      to-ldap-plain:
        target: LDAP Auth Server
        protocol: ldap
        authentication: credentials
        readonly: true
        data_assets_sent: [Customer Accounts]
      to-sql-jdbc:
        target: SQL Database
        protocol: jdbc
        data_assets_sent: [Customer Accounts, ERP Config]
      to-files-nfs:
        target: Contract Fileserver
        protocol: nfs
        readonly: true
        data_assets_received: [Public Content]
      to-third-party:
        target: Third-Party API
        protocol: https
        data_assets_sent: [Public Content]
      to-broker:
        target: Message Broker
        protocol: amqp

  Identity Provider:
    type: process
    tags: [keycloak]

  LDAP Auth Server:
    type: datastore
    encryption: transparent
    tags: [linux]
    data_assets_stored: [Customer Accounts]

  SQL Database:
    type: datastore
    encryption: none
    tags: [object-storage, public]
    data_assets_stored: [Customer Accounts, ERP Config, DB Dumps]

  Contract Fileserver:
    type: datastore
    encryption: none
    tags: [aws:s3, object-storage, public]
    data_assets_stored: [Public Content, DB Dumps]

  ERP System:
    type: process
    data_assets_processed: [ERP Config, Customer Accounts]
    communication_links:
      db-jdbc:
        target: SQL Database
        protocol: jdbc
        data_assets_sent: [ERP Config, Customer Accounts]
      files-nfs:
        target: Contract Fileserver
        protocol: nfs
        data_assets_sent: [DB Dumps]
      auth-idp:
        target: Identity Provider
        protocol: https
        authentication: token

  Backoffice Client:
    type: external-entity
    communication_links:
      erp-ui:
        target: ERP System
        protocol: https

  Third-Party API:
    type: external-entity

  Message Broker:
    type: process

trust_boundaries:
  Application Network:
    type: network-cloud-provider
    technical_assets_inside: [Load Balancer]
    trust_boundaries_nested: [Web DMZ, ERP Zone, Auth Env]

  Web DMZ:
    type: network-cloud-security-group
    technical_assets_inside: [Web App]

  ERP Zone:
    type: network-cloud-security-group
    technical_assets_inside: [ERP System, SQL Database, Contract Fileserver]

  Auth Env:
    type: execution-environment
    technical_assets_inside: [Identity Provider, LDAP Auth Server]
