GPLink Platform — infrastructure

GPLink Platform — infrastructure An architecture diagram generated by Archify. GPLink operators · console · replay · payout approval · Architecture component GPLink operators console · replay · payout approval Vendors & partners · FEV3R · Commerce · gateway · courier · Architecture component Vendors & partners FEV3R · Commerce · gateway · courier CloudFront · AWS WAF · Application Load Balancer · TLS · managed rules · per-partner rate rules · the only public address · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones CloudFront · AWS WAF · Application Load Balancer TLS · managed rules · per-partner rate rules · the only public address Gateway task · auth · quota · schema · idempotency · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones › Private subnets · no public address · egress through NAT · 2 vCPU / 4 GB Gateway task auth · quota · schema · idempotency 2 vCPU / 4 GB Identity task · 3-ID map · OIDC · consent · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones › Private subnets · no public address · egress through NAT Identity task 3-ID map · OIDC · consent Master-data task · drug ↔ SKU · Rx guardrail · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones › Private subnets · no public address · egress through NAT Master-data task drug ↔ SKU · Rx guardrail Orchestrator task · saga · split rules · ledger · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones › Private subnets · no public address · egress through NAT Orchestrator task saga · split rules · ledger RDS PostgreSQL 16 · Multi-AZ · ledger, episodes · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones › Private subnets · no public address · egress through NAT RDS PostgreSQL 16 Multi-AZ · ledger, episodes ElastiCache Redis · idempotency keys · sessions · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones › Private subnets · no public address · egress through NAT ElastiCache Redis idempotency keys · sessions SQS FIFO · group = episode · DLQ · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones › Private subnets · no public address · egress through NAT SQS FIFO group = episode · DLQ S3 · audit archive · payout files · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones › Private subnets · no public address · egress through NAT S3 audit archive · payout files Secrets Manager · KMS · one secret per integration, per environment · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones Secrets Manager · KMS one secret per integration, per environment CloudWatch · logs · metrics · alarms · one correlation id · AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones CloudWatch logs · metrics · alarms · one correlation id signed vendor calls authenticated identity master data orchestration envelope stored first sessions publish audit archive AWS ap-southeast-5 · Kuala Lumpur · 3 Availability Zones Private subnets · no public address · egress through NAT Legend Frontend Backend Database Cloud Security Message bus External

Sized, not guessed

  • • 4 app tasks at 2 vCPU / 4 GB
  • • 1 database 2 vCPU / 8 GB + 200 GB, Multi-AZ
  • • 1 cache node 2 GB · 1 queue · 1 bucket at 500 GB

What has a public address

  • • The load balancer, and nothing else
  • • Application and data tiers egress through NAT
  • • Per-partner IP allow-lists on top of credentials

Evidence

  • • One secret per integration, per environment
  • • Object Lock on the audit prefix
  • • One correlation id across all three companies