mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
misc: removed unnecessary section in security architecture
This commit is contained in:
@@ -131,74 +131,3 @@ The architecture provides tenant isolation through multiple certificate authorit
|
||||
- Each organization's traffic flows through isolated certificate-authenticated channels
|
||||
- Relay servers route traffic based on certificate validation without content access
|
||||
- Gateway validates all incoming connections against Organization Gateway Client CA
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
### Gateway Security
|
||||
|
||||
- **One identity per gateway** - Create a unique machine identity for each gateway
|
||||
- **Minimal permissions** - Assign only the permissions each gateway actually needs
|
||||
- **Rotate credentials** - Set up regular credential rotation (quarterly recommended)
|
||||
- **Monitor authentication** - Watch for unusual authentication activity
|
||||
- **Deploy close to resources** - Place gateways as close as possible to your private resources
|
||||
- **Use multiple gateways** - Deploy multiple gateways for redundancy and load distribution
|
||||
|
||||
### Relay Security
|
||||
|
||||
- **Deploy close to gateways** - Minimize latency between gateways and relays
|
||||
- **Use multiple regions** - Deploy relays in multiple regions for redundancy
|
||||
- **Monitor performance** - Track connection counts and throughput
|
||||
- **Regular updates** - Keep relay servers updated and patched
|
||||
- **Network isolation** - Use security groups and network ACLs to restrict access
|
||||
- **Monitor network traffic** - Watch for unusual patterns
|
||||
|
||||
### Network Security
|
||||
|
||||
- **Gateway outbound only** - Gateways only need outbound connections (port 2222 to relays, port 443 to Infisical API)
|
||||
- **Relay inbound** - Relays need inbound SSH (2222) and TCP with TLS (8443)
|
||||
- **No inbound for gateways** - Never open inbound ports for gateways
|
||||
- **Use security groups** in cloud environments to restrict access
|
||||
- **Implement network ACLs** to limit traffic to specific IP ranges
|
||||
- **Monitor network traffic** for unusual patterns
|
||||
- **Regular security updates** for the relay server
|
||||
|
||||
## Compliance Considerations
|
||||
|
||||
### Data Sovereignty
|
||||
|
||||
- **Customer-deployed relays** - Deploy relays in your preferred geographic region
|
||||
- **Air-gapped environments** - Use self-hosted relays for completely isolated deployments
|
||||
- **Custom network policies** - Implement organization-specific security requirements
|
||||
|
||||
### Security Controls
|
||||
|
||||
- **Certificate-based authentication** - No shared secrets, uses SSH certificates
|
||||
- **End-to-end encryption** - All traffic is encrypted in transit
|
||||
- **Tenant isolation** - Each organization's traffic is completely isolated
|
||||
- **No data storage** - Relay servers only route traffic, never store data
|
||||
- **Automatic reconnection** - Handles network interruptions gracefully
|
||||
|
||||
## Troubleshooting Security Issues
|
||||
|
||||
### Common Security Issues
|
||||
|
||||
**Authentication failures:**
|
||||
|
||||
- Verify machine identity credentials are correct
|
||||
- Check token expiration and renewal
|
||||
- Ensure authentication method is properly configured
|
||||
|
||||
**Network security issues:**
|
||||
|
||||
- Verify firewall rules allow required connections
|
||||
- Check for network ACLs blocking traffic
|
||||
- Monitor for unusual network patterns
|
||||
|
||||
### Security Monitoring
|
||||
|
||||
**Key metrics to monitor:**
|
||||
|
||||
- Gateway connection status and health
|
||||
- Authentication success/failure rates
|
||||
- Network connectivity and latency
|
||||
- Unusual traffic patterns or access attempts
|
||||
|
||||
Reference in New Issue
Block a user