NOAA GEO GS SE RFI Attachment 3 GEO Cloud V0.03.pdf
PDF 889 KB Posted
- Solicitation number
- GEO-GS_RFI_Dec_2024
About this file
This file is a system architecture diagram detailing the GEO Ground System Cloud Capabilities targeted for end of 2026. The diagram illustrates the cloud-based infrastructure for NOAA's Geostationary Operational Environmental Satellite (GOES) ground systems, specifically showing the integration between NOAA5065 (NCS), NOAA5050 (GEO Ground System), NOAA0550 (N-Wave), and NOAA0100 (Security Operations Center).
The architecture depicts multiple key components including GEO L1 and L2 Production Generation Services, AWS infrastructure elements, security tools, and data flows between systems. It shows Kubernetes clusters across multiple availability zones, handling both GOES East and West operations. The system includes sophisticated security measures with Fortinet firewalls, AWS Direct Connect, and various IT security artifacts (ArcSight, BigFix, Tenable, FireEye). The diagram also details the GeoCloud subsystem with various VPCs (Virtual Private Clouds) for different functions including Development, Mission Partner Tools, and Role Management, along with a comprehensive list of AWS services and open-source tools being utilized in the system.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
NOAA5065 (NCS)
NCCF
(NOAA5065)
GEO L1 Production Generation Service
EKS
Ancillary Data Collector
Ancillary Data
GEO L1b Product Generation – Green (Pre‐Production)
GEO L1b Product Generation – Blue (Production)
GEO L2 Production Generation Service
GEO L2+ Product Generation – Green (Pre‐Production)
GEO L2+ Product Generation – Blue (Production)
EKS
GOES West L2 Products
GRB Rx
L2 Production
L2+ Products
GOES East L2 Products
NOAA5050 (GEO Ground System)
NOAA0550 (N‐Wave)
NOAA0100 (NOAA Security Operations Center)
IT Security Artifacts (ArcSight, BigFix, Tenable, FireEye)
L0 Telemetry
GeoCloud (subsystem)
Authorized Mission Partners
NCEI
Inspection VPC
IT Security Artifacts (ArcSight, BigFix, Tenable, FireEye)
AWS Direct Connect (x2)
Fortinet firewall(x2)
N‐Wave Network N‐Wave Router
(x2)
L0 TelemetryGCCS High trust Users
NOAA ERAV VPN
GCCS 5065‐02 (East and Central)
ToDo:
1) Identify and depict AZ’s
2) Complete AWS networking, especially inter‐VPC and inter‐Account technologies
3) Decide on strategy for representing multiple connector types 4)Assign default interface from L1b to L2 (GRB)
5) Use of Nwave TIC
6) Add all planned GCCS accounts and VPCs
7) Call out interim PDA interface approach (define default assumption)
8) Include GRB flow to on prem antennas (through IFDS interface)
9) Operator Screen Flow
10) Choose depiction/icon of “on premise”
11) Decide on resolution of GeoCloud R&D account 12 )Complete screen tips
GeoCloud High trust Users
NOAA ERAV VPN
GeoCloud (East and
Central)
AWS Security Hub AWS Directory Service
AWS Managed Microsoft AD
Role
Management VPC
Security Tools
Active DirectoryNetwork
Windows Update Server
GRB
Monitor
Development VPC
Mission Partner Tools VPC
GEO Operators
IT Security Artifacts (ArcSight, BigFix, Tenable, FireEye)
GEO Ground System – Cloud Capabilities (target end of 2026)
Key Flows and Connectivity
Observation Data (Files)
Other Files
Events
Network Connectivity
IT Security Data
Observation Data (Stream)
Groups and containers
FISMA Boundary AWS‐based system/ subsystem
AWS Account
Virtual Private Cloud (VPC)
<<GEO Service>>
PipeManager (x2) eGRESc Service eGRESc egress files
GL0ASc Service
GL0ASc
GL0ASc Subscriptions
L0 Bundles
Bundle Available Notification
GL0ASc S3 Event Topics
GEO Product Access Service
Filterable Subscriptions
Quarantine
Bastion
GeoStream Service
GeoStream
Dev
ABIPLTc
Mission Data Access VPC
L0 Bundles
L0 Files
GL0ASc
GPAS
Subscriptions
GPAS S3
Event Topics
Deep Storage (Glacier)
GeoProducts
(OPS, PLT,
PrePLT)
ABI L0 files
File Available Notification
AWS standard icons
S3 Bucket Data Storage
EC2
Lambda Function Firewall
On Premise
GEO Product Files
VPN Router
DirectConnect
SNS SQS S3 Glacier Data Storage
AWS Security Hub AWS Directory Service
AWS Managed Microsoft AD
Role
EKS
GEO L1b ↑ Products
↑ GEO L2+
Products
Multicast Router
L0 Telemetry
Internet
N‐Wave TIC
AWS Direct Connect (x2)
GEO L1b Service Development
GEO L2+ Service Development
GEO L2+ Algorithm Development
GEO L1b Algorithm Development
Multicast Router (x2)
Inspection
Fortinet (x2) Bastion
Access Security
GEO Mission Data
Infrastructure Development
Development Sandbox
GCCS Event BucketsL0 Packets
GOES East L0
GOES L1b Products →
Ancillary Data
GOES L1b Products →
GOES East GRB
GOES West GRB
InfrastructureConfiguration Management
AZ1
Availability Zone
Kubernetes Cluster – Mon/Control/Utility Kubernetes Cluster – GOES East Kubernetes Cluster – GOES West
AZ2
AZ3
Kubernetes Cluster – Mon/Control/Utility
Kubernetes Cluster – Mon/Control/Utility
EKS
EKS
Kubernetes Cluster – GOES WestKubernetes Cluster – GOES East
Kubernetes Cluster – GOES West Kubernetes Cluster – GOES West
L0 Rx
L0 Rx
GOES West L0
AZ1
AZ2
AZ3
Kubernetes Cluster – GOES WestKubernetes Cluster – GOES EastKubernetes Cluster – Mon/Control/Utility
Kubernetes Cluster – GOES WestKubernetes Cluster – Mon/Control/Utility
Kubernetes Cluster – GOES WestKubernetes Cluster – Mon/Control/Utility Kubernetes Cluster – GOES East
Kubernetes Cluster – GOES East
GRB Rx
GRB Rx
EKS
EKS
← GOES L2+ Products Interim
PDA I/F
GOES West GRB →
GOES East GRB →
AWS Transit Gateway End Point
End points NAT
Gateway
AWS Transit Gateway End point
End point
End point
End point
GeoCloud Operational Tools & Services Last Updated: 7/11/2024
Selected Selected Selected Tool Vendor Source FedRamp High
GovCloud FedRamp Mod Commercial
Tool Vendor Source FedRamp High GovCloud
FedRamp Mod Commercial
Tool Vendor Source FedRamp High GovCloud
FedRamp Mod Commercial
Amazon EventBridge AWS AWS AWS Event Bridge AWS AWS CASB NOAA NOAA
Ansible Ansible Red Hat Open Source
Self hosted Self hosted AWS GuardDuty AWS AWS
Cisco Catalyst 8000v Cisco AWS Marketplace
Ansible AWX Ansible Red Hat Open
Self hosted Self hosted AWS IAM AWS AWS
Coherence Oracle Community Edition Self hosted Self hosted
Antrea CNI Antrea CNCF project Open
Self hosted Self hosted AWS Inspector AWS AWS
ExternalDNS Bitnami Open-Source Self hosted Self hosted
ArcSight HP NOAA Self hosted Self hosted AWS Kinesis Data Streams AWS AWS FireEye Client Trellix NOAA Self hosted Self hosted
Argo CD Community Supported
Apache Open Source License
Self hosted Self hosted AWS KMS AWS AWS
Fortigate Next Gen Firewall Fortinet AWS Marketplace
AWS Backup AWS AWS AWS Lambda AWS AWS Gitlab Git NCCF Self hosted Self hosted
AWS Billing and Budgets AWS AWS FedRamp not required JAB determination
FedRamp not required JAB determination
AWS License Manager AWS AWS
Grafana (enterprise) Grafana Labs AWS Marketplace Self hosted Self hosted
AWS Business Support AWS AWS N/A N/A AWS Parameter store AWS AWS InfluxDB InfluxData InfluxData Self hosted Self hosted
AWS Certificate Manager AWS AWS AWS RDS (Mysql) AWS AWS Jira NOAA5006 NCCF Self hosted Self hosted
AWS Cloud Formation AWS AWS
AWS RDS (Postgres) AWS AWS
Kubecost Kubecost License through Kubecost
Self hosted Self hosted
AWS Cloud Shell AWS AWS
AWS Resource Access Manager
AWS AWS
Kyverno CNCF project Open
Self hosted Self hosted
AWS CloudTrail AWS AWS
AWS Resource Groups and Tag Editor
Loki Grafana Labs AGPLv3 Self hosted Self hosted
AWS CloudWatch AWS AWS AWS Route53 AWS AWS Loki Canary Grafana Labs AGPLv3 Self hosted Self hosted
AWS CloudWatch Logs AWS AWS AWS S3 AWS AWS MySQL Oracle OSS Self hosted Self hosted
AWS Config AWS AWS AWS S3 Glacier AWS AWS NESSUS Tenable NOAA
AWS Control Tower AWS AWS AWS Secrets Manager AWS AWS Nginx Ingress Controller Nginx Nginx Self hosted Self hosted
AWS Cost Explorer AWS AWS FedRamp not required JAB determination
FedRamp not required JAB determination
AWS SecurityHub AWS AWS
Prometheus SoundCloud Open-Source Self hosted Self hosted
AWS Direct Connect AWS AWS AWS Service Catalog AWS AWS Promtail Grafana Labs AGPLv3 Self hosted Self hosted
AWS Directory Service AWS AWS
AWS Single Sign-on / IAM Identity Center
RabbitMQ Broadcom Open-source Self hosted Self hosted
AWS EBS AWS AWS AWS SNS AWS AWS Secure Ingest NCCF NCCF
AWS EBS CSI AWS AWS EKS Add-on Self hosted Self hosted AWS SQS AWS AWS Snyk Snyk AWS Marketplace Self hosted Self hosted
AWS EC2 AWS AWS
AWS SES AWS AWS
Splunk Splunk Splunk, GOES carveout
Self hosted Self hosted
AWS ECR AWS AWS AWS Step Functions AWS AWS Terraform Terraform Terraform Self hosted Self hosted
AWS EFS AWS AWS AWS Systems Manager AWS AWS Thanos Thanos Open-Source Self hosted Self hosted
AWS EFS CSI AWS AWS EKS Add-on Self hosted Self hosted AWS VPC AWS AWS Trend Micro Deep Security Trend Micro AWS Marketplace Self hosted Self hosted
AWS EKS AWS AWS
AWS X-Ray AWS AWS
Tripwire Tripwire Tripwire Self hosted Self hosted
AWS ELB AWS AWS Must run in a
VPC,
encrypted
BigFix NOAA Big Fix Services
NOAA Self hosted Self hosted
Available Available Available
GEO Ground System ‐ Cloud Capabilities (v0.03) Wall Chart ‐ Version History
Version Date Remarks v0.01 7/30/2024 Initial draft for comments v0.02 8/6/2024 Address initial feedback; Add GEO services v0.03 8/13/2024 Address comments; Label sizes, labels, separation of flows; Other FISMA system functions identified
GeoCloud R&D GeoCloud
Mission Data Env
Infrastructure Access Production
Infrastructure Development
Algorithm Development
Service Development
Infrastructure Production Security Tools
Log Archive
L1b Production
L1b Products
PDA (future in Jan 2028)
GOES L2+ Products →
Continuous enterprise monitoring and situational awareness
Risk and compliance management Agency‐level incident response capabilities
TIC Services VPN Services AWS Connections
L0 Rx Ancillary Data
GOES East L1b Products
GOES West L1b Products
GEO Cloud Compute Subsystem (GCCS)
File details come from the government source that posted it. Updated .