Appearance
AWS DR Infrastructure Overview
Purpose
This document describes the AWS disaster recovery environment. AWS serves as the DR target for the primary Azure environment. In the event of a failure in Azure, operations can be shifted to AWS to maintain business continuity.
Key Characteristics
| Attribute | Value |
|---|---|
| Provider | AWS |
| Region | US West 2 |
| Repository | aws-infra |
| DR Strategy | Warm standby (infrastructure ready, Veeam nightly replication active) |
| Failover Type | Manual |
| Primary Environment | Azure (US West 2) |
Current DR State
The AWS environment has infrastructure provisioned and ready to receive workloads. Veeam nightly replication from Azure to AWS S3 is validated and operational, providing an RPO of approximately 24 hours. Real-time or near-real-time data replication is not configured — failover requires restoring from the most recent nightly backup.
DR Maturity Progression
| Capability | Status |
|---|---|
| Infrastructure provisioned | ✅ Complete |
| Network / VPC configured | ✅ Complete |
| DR failover procedure documented | ✅ Complete |
| Nightly backup replication (Veeam) | ✅ Complete — validated March 4, 2026 |
| Palo Alto firewall deployed and connected to Panorama | ✅ Complete |
| Arctic Wolf MDR coverage (VLC active) | ✅ Complete |
| Syslog VM deployed and archiving to S3 | ✅ Complete |
| Real-time data replication | ❌ Not yet in place |
| DR test executed | 📅 Planned (June 2026) |
| Failback procedure documented | 📅 Placeholder — full doc after June DR test |
AWS Organization Structure
The AWS environment runs within AWS Organizations with 7 accounts. Each account serves a specific function with cross-account IAM roles configured for scoped access.
| Account | Account ID | Purpose |
|---|---|---|
| Cirius Group (Management) | 206820231356 | AWS Organizations root, billing, OIDC trust for GitHub Actions |
| Logging | 038901680748 | CloudTrail, Security Hub delegated admin, Audit Manager, GuardDuty, centralized log storage |
| Networking | 238342914131 | Palo Alto VM-Series firewall, Panorama, Transit Gateway, Twingate |
| Production | 807267566999 | DR production workloads, EC2 instances |
| Development | 040067931468 | Development and test workloads |
| Identity | 414134953818 | Active Directory, identity services |
| Backup | 863609217450 | Veeam backup storage, S3 backup targets |
GitHub Actions authenticates to AWS via OIDC federated identity, using the management account's IAM role and cross-account role assumption for operations in other accounts. No long-lived AWS access keys are stored in GitHub secrets.
Core Components
Palo Alto Firewall and Panorama
The AWS DR environment has a fully rebuilt Palo Alto firewall and Panorama instance as of March 2026.
Panorama:
| Configuration | Value |
|---|---|
| PAN-OS Version | 12.1.2 (Marketplace AMI) |
| System disk | 81 GB |
| Log disk | 100 GB (separate EBS volume) |
| max-num-images | 2 |
| max-num-config-backups | 10 |
| Termination protection | ✅ Enabled |
| Firewall connected | ✅ AWS DR firewall active |
Known issue: FQDN object cortex-xdr.paloaltonetworks.com resolves in Azure but not AWS, causing Cortex XDR traffic to hit the Containment deny rule. Fix: apply VPC resolver 10.99.0.2 via Panorama device template. Pending.
See Palo Alto Firewall Overview for full firewall details.
Syslog Infrastructure
A dedicated syslog receiver VM ships firewall logs to S3 archive storage:
| Configuration | Value |
|---|---|
| OS | Ubuntu 22.04 LTS |
| Instance type | t3.small |
| Syslog daemon | syslog-ng |
| IAM | Instance profile for S3 writes |
| IMDSv2 | ✅ Enforced |
| Termination protection | ✅ Enabled |
| Log types | Traffic, threat, auth, system, config, HIP match |
| Archive destination | cirius-archive-logs-prod S3 bucket |
Arctic Wolf MDR Coverage
All VLCs in the AWS environment are confirmed active with ingestion verified in the Arctic Wolf portal. Arctic Wolf MDR coverage is complete across all environments.
VPC / Networking
A Transit Gateway-based hub-spoke topology connects all VPCs. The Palo Alto VM-Series firewall handles all north/south traffic inspection. See AWS Network Topology for full architecture.
EC2 Instances
Server infrastructure is provisioned and ready in AWS. In a failover scenario these instances would be started and configured to serve production workloads. Instances are defined in Terraform and deployed via the aws-infra CI/CD pipeline.
Cloud PC (in progress): An Ubuntu 24.04 EC2 instance in the Production account (807267566999) is being deployed as the dedicated Cloud PC for infrastructure operations. This instance runs in a private subnet with Twingate SSH access and SSM break-glass. It is not a DR workload — it is a permanent operations-tooling instance in AWS Prod.
S3 Storage
S3 buckets are provisioned for:
- DR workload data in a failover scenario
- Terraform state storage for the
aws-infrarepository - Lambda function deployment packages
- Veeam backup storage (with lifecycle: Standard-IA 90d → Glacier 365d → 6-year noncurrent expiration)
- Log archive (with Object Lock GOVERNANCE mode, 2190-day retention)
AWS Security Hub
AWS Security Hub is enabled organization-wide across all 7 accounts with the Logging account as delegated administrator. The NIST 800-53 Revision 5 standard is active — this is the AWS-recommended framework for HIPAA-relevant control families. Note: AWS Security Hub has no dedicated HIPAA standard. Use AWS Audit Manager for HIPAA-specific assessment.
AWS Audit Manager
Continuous HIPAA Omnibus assessment (HIPAA-Omnibus-Jan-2013 framework) running against all 7 accounts. Assessment reports stored in a dedicated S3 bucket in the Logging account.
Amazon GuardDuty
GuardDuty detectors enabled across all 7 accounts. Organization-level centralization configured in Terraform. Full org-wide S3 protection is enabled in the logging account.
Veeam Replication — Validation Results (March 4, 2026)
| Metric | Result |
|---|---|
| Hosts replicated | 2/2 (CGIRDPAZP01, BIZARCAZP01) |
| Data processed | 106.4 GB |
| Data transferred | 11.6 GB (2.7× compression) |
| Duration | 5 hours 27 minutes |
| Transfer rate | 462 MB/s |
| Errors | 0 |
RTO / RPO Targets
HIPAA note: HIPAA does not prescribe specific RTO/RPO values, but §164.308(a)(7) requires that contingency plan procedures address data backup, disaster recovery, and emergency mode operations. RTO/RPO targets must be formally defined, tested, and reviewed annually.
Targets
| Metric | Target | Scope |
|---|---|---|
| RTO — critical systems | 4 hours | CGIRDPAZP01, BIZARCAZP01, psql-secops-prod |
| RTO — all systems | 8 hours | All DR-in-scope infrastructure |
| RPO — target | 1 hour | Veeam replication frequency (aspirational; see Current State) |
| RPO — current state | ~24 hours | Veeam nightly replication to S3 (validated March 4, 2026) |
RPO gap: Current Veeam configuration runs nightly — RPO is ~24h. To achieve the 1-hour RPO target, Veeam job frequency must be increased to hourly or near-continuous replication. This is a planned improvement for 2026 DR maturity work.
Tracking Table
Populated after each DR test. Q2 test scheduled June 2026.
| System | RTO Target | RTO Achieved Q2-2026 | RTO Achieved Q4-2026 | Trend |
|---|---|---|---|---|
| CGIRDPAZP01 | 4h | — | — | — |
| BIZARCAZP01 | 4h | — | — | — |
| psql-secops-prod | 4h | — | — | — |
| All other systems | 8h | — | — | — |
| Metric | RPO Target | RPO Achieved Q2-2026 | RPO Achieved Q4-2026 | Notes |
|---|---|---|---|---|
| Data loss window | 1h | — | — | Q2 will measure actual RPO as: (failover timestamp − last Veeam job success timestamp) |
Sign-Off
RTO/RPO targets reviewed and accepted by Greg (T1 Domain Admin, DR escalation path).
Status: PENDING — formal acceptance to be obtained and documented here before the Q2 DR test (June 2026).
Failover Process
Failover from Azure to AWS is a manual process with a documented step-by-step procedure. At a high level:
- Declare DR event and notify stakeholders
- Start EC2 instances in AWS DR environment
- Restore data from most recent Veeam backup to AWS
- Validate critical systems are operational
- Update DNS / routing to point to AWS environment
- Confirm services are accessible and functioning
A formal DR test is scheduled for June 2026. See DR Failover Procedure for the full procedure.
Compliance Posture
The AWS DR environment is in scope for SOC2, HIPAA, and HITRUST compliance. Key controls:
- Infrastructure-as-code via Terraform ensuring auditable, consistent configuration
- OIDC authentication — no long-lived credentials
- Cross-account IAM roles scoped to least privilege
- AWS Security Hub (NIST 800-53 R5) and Audit Manager (HIPAA Omnibus) for compliance monitoring
- Checkov scanning on all PRs to prevent non-compliant resources being deployed
- S3 encryption at rest with customer-managed KMS keys
- Arctic Wolf MDR coverage with active VLC ingestion
Known Gaps
| Gap | Risk | Plan | Target |
|---|---|---|---|
| No real-time data replication | Higher RTO in failover (RPO ~24h) | Address in 2026 DR maturity work | 2026 |
| DR not yet tested | Unknown gaps in failover capability | Execute DR test | June 2026 |
| AWS firewall FQDN/DNS | Cortex XDR traffic hitting Containment rule | Apply VPC resolver 10.99.0.2 via Panorama device template | Immediate |
Document History
| Date | Change | Author |
|---|---|---|
| April 2026 | Added Cloud PC note in EC2 Instances section (Ubuntu 24.04, AWS Prod, Twingate SSH, SSM break-glass — operations tooling, not DR workload) | Kobe |
| March 2026 | Added Panorama rebuild details (PAN-OS 12.1.2, 100GB log disk, termination protection, firewall connected); added syslog VM infrastructure; added VLC/Arctic Wolf coverage confirmation; added Veeam March 4 validation results; added S3 lifecycle details; updated GuardDuty status; added AWS FQDN known gap | Rory |
| March 2, 2026 | Updated DR maturity table, corrected GuardDuty description, updated Known Gaps | Rory |
| March 2026 | Expanded AWS organization structure to all 7 accounts, updated Security Hub/Audit Manager/GuardDuty status | Rory |
| February 2026 | Initial draft | Rory |