myDRE High-Level Architectural Reference
This document details the structural topology and isolation boundaries of the myDRE platform. The architecture enforces a strict decoupling of the customer-controlled environment from the anDREa orchestration layer. This secure design satisfies A.08.22 - Segregation of networks, A.08.23 - Web filtering and NIS 2 (Supply Chain Security, Infrastructure Resilience) framework requirements.
1. Subscription Topology & Boundary Model
The platform deployment model mandates a multi-subscription design split across clear legal, billing, and operational boundaries. At a minimum, a standard deployment spans three separate Microsoft Azure subscriptions:
- High Level
- Detailed
┌────────────────────────────────────────────────────────────────────────┐
│ anDREa CORE CENTRAL ENTRA ID │
└───────────────────────────────────┬────────────────────────────────────┘
│ (Central Governance, Policy & RBAC)
▼
┌────────────────────────────────────────────────────────────────────────┐
│ TENANT BOUNDARY (Customer Billed) │
├───────────────────────────────────┬────────────────────────────────────┤
│ 📂 Workspace Subscription(s) │ 🛠️ Shared Services Subscription │
│ • Up to 100 Isolated Workspaces │ • Centralized Azure Bastion │
│ • Up to 11 VMs per Workspace │ • Shared File Repositories │
│ • Regional Storage & Compute │ • Common Structural Tooling │
└───────────────────────────────────┼────────────────────────────────────┘
│
▼
┌────────────────────────────────────────────────────────────────────────┐
│ anDREa BOUNDARY (anDREa Billed) │
├────────────────────────────────────────────────────────────────────────┤
│ 🎮 Platform & Control Plane Subscription │
│ • Core APIs & Provisioning Orchestration Logic │
│ • Central Security Telemetry & Log Ingestion │
│ • **Zero Customer Research Data Hosted Here** │
└────────────────────────────────────────────────────────────────────────┘
2. Segmented Architectural Layers
A. Workspace Infrastructure (Customer-Owned & Billed)
This subscription encapsulates the live research execution environments. While owned directly by the Tenant for financial and legal sovereignty, the infrastructure is programmatically bound to the central anDREa identity plane.
- Workspace Scaling Caps: Each subscription supports up to 100 independent Workspaces, with each Workspace containing up to 11 Virtual Machines (VMs) alongside localized file shares and storage disks.
- Central Governance Hooks: anDREa maintains administrative control over these customer-owned subscriptions, centrally enforcing hard-coded Azure Policies, Role-Based Access Controls (RBAC), security baselines, and network boundaries.
- Connectivity & Extensions: Subscriptions can be anchored to distinct regional data centers and tunnel directly into the Tenant's on-premises systems (e.g., volume license servers or legacy storage arrays).
- Network Isolation & Malware Containment:
- Every individual Workspace is network-isolated from adjacent Workspaces.
- If a user introduces malware (via dependencies or external data imports), Microsoft Defender for Cloud flags and isolates the threat vector.
- If the localized security tool fails, the blast radius is physically constrained to that single Workspace. External exposure is strictly limited to pre-approved, allowlisted domains.
B. Shared Services Infrastructure (Customer-Owned & Billed)
This intermediate subscription pools infrastructure assets utilized across multiple research Workspaces belonging to the same Tenant.
- Resource Consolidation: Hosts shared gateway utilities like Azure Bastion for secure administrative access and universal staging file repositories.
- Architectural Purpose: Eliminates expensive resource duplication across individual Workspaces, keeps child subscriptions unencumbered, and maintains rigid blast-radius containment lines.
C. Platform Control Plane (anDREa-Owned & Billed)
This isolated, core subscription houses the administrative logic, platform-wide metrics, and automation engines that power myDRE.
- Operational Components: Hosts the primary myDRE APIs, automated backend orchestration workflows, master configuration tables, metadata repositories, and central security log management engines.
- Zero-Knowledge Data Posture: No customer research data ever crosses into or resides within this subscription. It functions exclusively as a control and governance plane.
- Codebase Lifecycle Integrity: * The myDRE application core is built out of immutable code blocks.
- Every software package passes through strict automated CI/CD pipelines embedded with Dependabot (dependency vulnerability tracking) and SonarCloud (static code analysis) before deployment. Once compiled, the environment is entirely static.
- Virtual Network (VNet) integration blocks the platform codebase from unverified outbound connections, preventing data exfiltration or unauthorized phone-home scripts.
3. Security, Governance, & User Exposure
- Autonomy & Control: Customers maintain total data ownership and billing management, while anDREa provides automated operational compliance and architecture consistency.
- Multi-Tenant User Visibility: The UI translates this high-level architecture into an intuitive interface. Researchers logging into the platform see a consolidated view of all individual Workspaces they are explicitly assigned to, even if those Workspaces belong to completely separate legal organizations.
- Self-Service Configuration Rights: Depending on assigned roles (e.g., Accountable or Privileged Member), users can safely reconfigure allocated infrastructure via a friendly dashboard. This includes rightsizing VMs, adjusting automated shutdown/de-allocation timers, executing data ingress/egress requests, managing workspace invitations, and tweaking outbound domain allowlists.