Infrastructure requirements

This document describes the system infrastructure requirements that help mitigate security risks for Spryker Marketplace projects. When you host your Spryker application in SCCOS, these requirements are configured for you out of the box. If your system infrastructure (cloud PaaS or on-premise) is managed, you must ensure these security requirements are met.

Applications resources visibility

The following table illustrates the visibility of the resources in the network:

The following diagram shows how visibility of resources relates to private and public network relationships:

Merchant Portal endpoints allowlisting

Merchant Portal is exposed to WAN and MUST NOT provide any Gateway or Back Office facilities.

In the web server configuration (AWS WAF can also be used), only HTTP endpoints of the MerchantPortalGui should be allowed. Their prefix is all the same—/domain-merchant-portal-gui.

Merchant Portal network

For the Merchant Portal to function properly, it should be in a dedicated public network, not the same network where Yves/Glue runs, with access to a network Database and QueueBroker. For details, see the diagram).

Firewall rules for the Merchant Portal (NACLs or Security groups)

To properly configure Merchant Portal firewall, use these rules:

Note the following:

• Security groups and host-based firewalls must also implement “allow” rules for the Merchant Portal on Redis, RDS, Rabbit MQ, and Nginx sides.
• Depending on the monitoring system used, you need to implement the “allow” rules as well.

Database (MariaDB/Mysql/Postgres)

Each database user must have dedicated user credentials:

Storage and search

Each application must have the following user rights: