key,service_name,port_number,transport_protocol,encryption,purpose
pps-https-portal,HTTPS,443,TCP,TLS 1.2,Inbound agency user and REST API access terminating at the public AWS application load balancer
pps-https-admin,HTTPS,443,TCP,TLS 1.2,Inbound administrative access to the admin portal via Azure Application Gateway with WAF v2 and Entra-enforced MFA
pps-http-webapp,HTTPS,8443,TCP,TLS 1.2,Web tier to application tier across the private subnet boundary
pps-https-inference,HTTPS,8443,TCP,TLS 1.2,Application tier to the EKS GPU inference tier for model serving requests
pps-pgsql-app,PostgreSQL,5432,TCP,TLS 1.2,Application tier to the primary application database (RDS PostgreSQL 15.4)
pps-pgsql-vector,PostgreSQL,5432,TCP,TLS 1.2,Application tier and embedding workers to the Aurora PostgreSQL vector store holding tenant embeddings
pps-mysql-audit,MySQL,3306,TCP,TLS 1.2,Application tier to the audit and inference log database (Aurora MySQL 8.0)
pps-mssql-auth,MS SQL,1433,TCP,TLS 1.2,Entra Connect synchronization host to the Azure SQL authentication metadata database
pps-ldaps,LDAPS,636,TCP,TLS 1.2,Domain-joined compute hosts to AWS Managed Microsoft AD for directory authentication and lookup
pps-kerberos,Kerberos,88,TCP,Kerberos (AES),Domain authentication for hosts joined to AWS Managed Microsoft AD
pps-dns,DNS,53,UDP,None,"Name resolution within the VPC; internal only, no inbound path from the internet"
pps-ipsec-ike,IPsec IKE,500,UDP,IPsec ESP (AES-256),Inter-cloud site-to-site VPN key exchange between the AWS Transit Gateway VPN attachment and the Azure VPN Gateway
pps-ipsec-natt,IPsec NAT-T,4500,UDP,IPsec ESP (AES-256),Inter-cloud site-to-site VPN encapsulated tunnel traffic between AWS GovCloud and Azure Government
pps-https-halogrc,HTTPS,443,TCP,TLS 1.2,Outbound to the external Stratus GRC-ITSM (HALOGRC) API carrying operational metadata only; the single outbound boundary crossing
pps-https-azuregov,HTTPS,443,TCP,TLS 1.2,"Outbound to Microsoft Azure Government service endpoints for Entra ID, Defender for Cloud, and Sentinel"
pps-https-ssm,HTTPS,443,TCP,TLS 1.2,"Administrative session traffic via AWS Systems Manager Session Manager; replaces inbound SSH 22 and RDP 3389, neither of which is open"
pps-https-feeds,HTTPS,443,TCP,TLS 1.2,"Outbound to read-only vulnerability intelligence feeds (CISA KEV, EPSS) through the NAT Gateway FQDN allowlist"
