Infrastructure architecture
BuildAzure IaaS Skynome connector
Customer-owned read-only collector with Managed Identity. Durable outbound evidence. Never authenticates to SAP.
Architecture diagram
Default route: ADLS control + Resource Graph → Connector → POST /api/ingest → GRS
Data or evidenceIdentity or control
Callout 1
FILE / DRF landing
Control files only
Upstream extract patterns land data and manifests. The connector never opens a route into SAP.
Need this architecture for your internal review?
Request an editable .drawio source stencil for internal architecture validation.
Detail
No SAP credentials, libraries, or RFC endpoints in the connector. SaaS never pulls customer Azure as the primary model.
- Reader baseline for inventory/policy
- Storage Blob Data Reader on control container only
- Contributor only on checkpoint/outbox
- Key Vault Secrets User scoped if needed
| Scenario | Status | Note |
|---|---|---|
| Customer-deployed Function + MI | Documented | Default Option A+E design. |
| Skynome SaaS multi-tenant pull of Azure | Excluded | Hardest security sale — avoid as primary. |
| Connector RFC into SAP | Excluded | Non-negotiable trust boundary. |