# umer-r/cloud-compliance-automation architecture

> Architecture diagram of the GitHub repository umer-r/cloud-compliance-automation, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/umer-r/cloud-compliance-automation
- Repository: https://github.com/umer-r/cloud-compliance-automation

## Overview

This repository currently contains one AWS security automation: a Lambda reconciles Cloudflare’s published IPv4/IPv6 ranges with customer-managed AWS prefix lists, avoiding changes on unsafe or empty input and notifying through SNS after successful modifications. The graph follows the documented event-driven workflow and the sampled Lambda calls; Terraform provisions the automation, but its wiring details were not sampled.

Main entry points: [`aws/cf-whitelisting-reconciliation/lambda_function.py`](https://github.com/umer-r/cloud-compliance-automation/blob/main/aws/cf-whitelisting-reconciliation/lambda_function.py) (Reconciliation Lambda), [`aws/cf-whitelisting-reconciliation/terraform`](https://github.com/umer-r/cloud-compliance-automation/tree/main/aws/cf-whitelisting-reconciliation/terraform) (Terraform deployment)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_deploy["AWS deployment"]
  node_terraform["Terraform deployment"]
end

subgraph group_reconcile["Range reconciliation"]
  node_lambda["Reconciliation Lambda<br/>[lambda_function.py]"]
  node_cloudflare["Cloudflare IP API"]
  node_ec2[("EC2 prefix lists")]
end

subgraph group_notify["Change alerting"]
  node_sns["Amazon SNS"]
end

node_operator(("Automation operator"))

node_operator -->|"deploys"| node_terraform
node_terraform -->|"provisions"| node_lambda
node_lambda -->|"fetches ranges"| node_cloudflare
node_lambda -->|"reads state"| node_ec2
node_lambda -->|"updates entries"| node_ec2
node_lambda -->|"tags changes"| node_ec2
node_lambda -.->|"publishes alert"| node_sns

click node_terraform "https://github.com/umer-r/cloud-compliance-automation/tree/main/aws/cf-whitelisting-reconciliation/terraform"
click node_lambda "https://github.com/umer-r/cloud-compliance-automation/blob/main/aws/cf-whitelisting-reconciliation/lambda_function.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_terraform toneBlue
class node_lambda,node_cloudflare,node_ec2 toneAmber
class node_sns toneMint
class node_operator toneIndigo
```

## Components

### AWS deployment

- [Terraform deployment](https://github.com/umer-r/cloud-compliance-automation/tree/main/aws/cf-whitelisting-reconciliation/terraform): `aws/cf-whitelisting-reconciliation/terraform`

### Range reconciliation

- [Reconciliation Lambda](https://github.com/umer-r/cloud-compliance-automation/blob/main/aws/cf-whitelisting-reconciliation/lambda_function.py): `aws/cf-whitelisting-reconciliation/lambda_function.py`
- **Cloudflare IP API**
- **EC2 prefix lists**

### Change alerting

- **Amazon SNS**

### Other components

- **Automation operator**

## Connections

- Automation operator → Terraform deployment: deploys
- Terraform deployment → Reconciliation Lambda: provisions
- Reconciliation Lambda → Cloudflare IP API: fetches ranges
- Reconciliation Lambda → EC2 prefix lists: reads state
- Reconciliation Lambda → EC2 prefix lists: updates entries
- Reconciliation Lambda → EC2 prefix lists: tags changes
- Reconciliation Lambda → Amazon SNS: publishes alert