SnowOps — Asset Name Glossary (Code → Human-Readable Name)
Purpose: the single canonical map from each asset's short code ID (e.g.
E0, F11, K2) to its human-readable name and a one-line description of
what it does. The code IDs remain the stable cross-reference anchors used across
the repo, machine-state YAML, runbook filenames, and decision log; this file is
what makes them legible.
How to read a reference: anywhere you see a bare code like "wired into C1"
or "consumes E7", look it up here. In prose elsewhere we now write the proper
name with the code as a secondary tag, e.g. Terraform Plan/Apply Pipeline
(C1) .
For full descriptions + test details see 03-asset-catalog.md04-asset-status.md
A — Sales & CRM Automation (HubSpot)
Code
Human-Readable Name
What it does
A1
HubSpot Lead Enrichment
HubSpot private app + Custom Code Action enriching contact properties from Clearbit/Apollo.
A2
ICP Lead Scoring & Routing
Scores inbound leads against the Ideal Customer Profile and routes them to Sagar/Nidhi.
A3
Proposal PDF Generator
Renders a templated proposal PDF when a deal reaches the proposal stage.
A4
Project Kickoff Webhook
On Closed Won, fires the GitHub Onboarder App (B1) plus Notion and Slack setup.
A5
Discovery Trigger Automation
On Qualified, dispatches the Discovery Run Workflow (G4) and sends the offer email.
B — Client Onboarding
Code
Human-Readable Name
What it does
B1
GitHub Onboarder App
snowops-onboarder GitHub App: provisions client repos, branch protection, CODEOWNERS, checks, env vars, and federated OIDC to the client Azure AD.
B2
Azure Client Bootstrap Module
Terraform: Azure AD app + service principal + GitHub-OIDC federated credentials + role assignments (no client secret ever created).
B3
Subscription Baseline Module
Composes the Azure Baseline (F1) + group RBAC + the Microsoft Cloud Security Benchmark initiative, Defender on by default.
B4
Client State Backend Module
Wraps the State Backend (F6) with Blob Data RBAC, optional private endpoint, and network lockdown for client Terraform state.
B5
Azure Resource PIM Module
Privileged Identity Management for Azure resource roles (tiered MFA/justification/approval/time-box).
B6
Client Prerequisite Checker
Self-service tool a prospect runs in their own tenant to validate tooling, auth, and permissions before engagement.
C — CI/CD & Delivery Pipelines
Code
Human-Readable Name
What it does
C1
Terraform Plan/Apply Pipeline
Reusable GitHub Actions workflow: Azure OIDC, plan-on-PR comment, apply-on-merge, env gates, OPA check post-plan. (KEYSTONE)
C2
Container Build & Sign Pipeline
Build → ACR push by digest → Notation v2 sign → Syft SBOM → Grype scan with severity cutoff.
C3
AKS Deploy Pipeline
ArgoCD image override → sync → wait Healthy → smoke probe → optional rollback drill.
C4
GitOps Branching Standard
Branching standard doc + client-repo template + branch-protection rules.
C5
Azure DevOps Pipeline Templates
ADO mirrors of the plan/apply, build/sign, deploy, and quality-gate pipelines.
D — Quality & Security Gates (PR-time)
Code
Human-Readable Name
What it does
D1
Pre-Commit Quality Hooks
.pre-commit-config.yaml: tflint, fmt, checkov, tfsec, gitleaks, trivy fs, conftest verify.
D2
PR Quality-Gate Workflow
PR-blocking GitHub Actions mirroring the pre-commit hooks (D1).
D3
Terraform OPA Policy Bundle
Conftest/OPA policies over terraform plan JSON (encryption, tags, no public network, allowed regions, cost caps).
D4
Kyverno AKS Policy Bundle
Five enforce-mode Kyverno ClusterPolicies for AKS.
D5
Policy Waiver Engine
Time-boxed OPA exception records (waivers/) with CI expiry enforcement.
E — Automated Evidence Collection
Code
Human-Readable Name
What it does
E0
Compliance Snapshot Collector
Read-only tool capturing Azure Policy compliance + Defender secure score into a versioned JSON snapshot; diffs are the regression signal.
E1
Evidence Platform Interface
TypeScript interface abstracting the compliance evidence platform.
E2
Vanta Adapter
EvidencePlatform adapter for Vanta.
E3
Drata Adapter
EvidencePlatform adapter stub for Drata.
E4
Resource Graph Query Library
Azure Resource Graph queries mapped to SOC 2 CC + ISO 27001 controls.
E5
Defender→Vanta Sync
Scheduled sync of Defender for Cloud posture into Vanta.
E6
Access Review Automation
Quarterly access review automation → CSV → ticket via the Ticket Platform (E7).
E7
Ticket Platform Library
Platform-neutral TicketPlatform interface + GitHub/Jira/Linear/ADO adapters + snowops-ticket CLI; idempotent marker-based upsert.
F — SnowOps Module Library (Azure-first, cloud-agnostic contracts)
Code
Human-Readable Name
What it does
F0
Cloud-Agnostic Module Contracts
Seven typed, provider-free interface contracts (network, identity, cluster, registry, kv, observability, object_store).
F1
Azure Baseline Module
Management group, subscriptions, Policy, Defender, Log Analytics, Activity Log; emits identity + observability contracts.
F2
Network Hub Module
Hub-spoke vNets, optional Azure Firewall, Private DNS, NSG flow logs, forced-tunnel routing.
F3
Secure AKS Module
Private AKS with Workload Identity, AAD-RBAC, CNI Overlay + Calico, Defender for Containers.
F4
Container Registry Module
Premium ACR with private endpoint, AAD-only auth, optional geo-replication.
F5
Key Vault Module
Premium Key Vault: RBAC mode, purge protection, default-deny network, private endpoint.
F6
State Backend Module
RA-GZRS Terraform state storage account + per-env containers with blob-lease locking.
F7
Terragrunt Live-Infra Reference
live/ per-env/per-region Terragrunt wiring with the real dependency DAG.
F8
ArgoCD GitOps Bundle
gitops/ app-of-apps K8s reference manifests (cert-manager, Kyverno, ESO, ingress-nginx, policies).
F9
AWS Module Parity
AWS implementations of the F0 contracts (deferred).
F10
GCP Module Parity
GCP implementations of the F0 contracts (deferred).
F11
Module Registry & Versioning
Module version manifest validator + private (monorepo) registry + pin audit + release workflow.
F12
Brownfield Import Library
Config-driven Terraform import {} blocks adopting pre-existing Azure resources into the F-modules.
G — Pre-Sales Discovery & Audit Automation
Code
Human-Readable Name
What it does
G0
Discovery SP Bootstrap
Client-side scoped Reader + Security Reader service-principal bootstrap (time-boxed, no secrets leave tenant).
G1
Discovery Auditor Collectors
apps/discovery-auditor/ collectors: Resource Graph, Defender, Policy, AAD audit, Cost Management.
G2
Discovery Rule Pack
YAML rule pack mapped to SOC 2 CC + ISO 27001 + CIS Azure with severity/evidence/remediation.
G3
Discovery Report Renderer
Markdown → branded PDF report (cover, exec summary, control table, roadmap).
G4
Discovery Run Workflow
discovery-run.yml manual-dispatch workflow with artifact upload + Slack notify.
G5
Discovery HubSpot Integration
Writes the discovery report URL back to the HubSpot deal.
G6
Discovery Audit Log
Immutable WORM run log with a SHA-256 hash chain.
G7
AWS Discovery Mode
AWS variant of the discovery auditor (postponed).
H — Identity & Access Management
Code
Human-Readable Name
What it does
H1
Entra ID Baseline Module
Named locations, phishing-resistant auth-strength policy, password protection, tenant branding.
H2
Conditional Access Module
Six SnowOps Conditional Access policies (all excluding the break-glass group).
H3
Entra PIM Templates Module
Tier-0/tier-1 Entra role eligibility + activation rules via Graph PATCH.
H4
SCIM Provisioning
modules/azure/scim-provisioning/: Entra automatic user provisioning to a SaaS app over SCIM (gallery app + sync secret/endpoint + sync job).
H5
Service Principal Inventory
Read-only Graph inventory of app-registration credentials; flags aged/expiring and opens a rotation PR.
H6
Access Review Automation
modules/azure/access-reviews/: recurring Entra access reviews via entitlement-management access packages (assignment-policy review settings). Native-config counterpart to E6 (evidence app).
H7
Break-Glass Account Module
Break-glass group + permanent Global Admin + severity-0 sign-in alert; producer consumed by H2/B3/B5.
I — Vulnerability & Patch Management
Code
Human-Readable Name
What it does
I1
Container Image Scan
Reusable Trivy image scan; fails on High/Critical CVEs, SARIF → Code Scanning.
I2
Dependency Scanning
Dependabot + PR-blocking dependency-review gate + weekly alert digest.
I3
CodeQL SAST
CodeQL static analysis over the TypeScript apps and Go terratest.
I4
DAST (OWASP ZAP)
Dynamic application security testing — reusable dast-scan.yml ZAP gate + .zap/ rules tuning.
I5
Defender Ticketer
apps/defender-ticketer/: Defender for Cloud alerts → tickets via the Ticket Platform CLI (E7).
I6
Azure Update Manager Report
apps/patch-compliance/: Azure Update Manager assessment → patch-compliance report (coverage %, missing critical/security updates, SLA aging).
I7
CVE Triage Runbook
CVE triage runbook (docs/runbooks/vuln/cve-triage.md) + SLA aging Grafana dashboard (snowops-vuln-triage.json). Finishes the I vuln series.
J — Logging, Monitoring & SIEM
Code
Human-Readable Name
What it does
J1
Log Analytics Module
Standalone hardened Log Analytics workspace with per-table retention, RBAC, and self-audit.
J2
Policy Diagnostics Module
GUID-agnostic DeployIfNotExists initiative bundling built-in diagnostic policies.
J3
Microsoft Sentinel Deployment
Sentinel SIEM onboarding over the J1 workspace + data connectors + analytics rules → incidents.
J4
Alert Rule Pack
Curated scheduled-query alert rules across identity/network/privilege/data-exfil.
J5
Managed Grafana Dashboards
Azure Managed Grafana + dashboards-as-code (internal ops tier) over the J1 workspace.
J6
Audit Log Archive Module
RA-GZRS WORM-immutable archive for the subscription Activity Log.
J7
Cost-Controlled Log Strategy
Basic-Logs-tier cost-control strategy for logging — modules/azure/log-analytics-cost/ (per-table Basic/Analytics plan + retention over a J1 workspace).
J8
Client Overview Dashboard
Client-facing, read-only Grafana dashboard tier (extends J5) — posture by deliverable, granted to the client via Grafana Viewer + a folder-scoped client dashboard.
K — Incident Response & SecOps
Code
Human-Readable Name
What it does
K1
Incident Response Runbooks
IR runbook library (compromise, ransomware, data leak, DDoS, vendor breach).
K2
On-Call Integration Module
PagerDuty/Opsgenie + Slack wiring for Sentinel incidents → on-call.
K3
Sentinel SOAR Playbooks
Active-IR containment playbooks (isolate account / disable SP / quarantine VM) — structural dry-run/enforce Logic Apps.
K4
Post-Incident Review
Closed incidents → blameless PIR docs + tracking issue via the Ticket Platform (E7).
K5
Tabletop Exercise Pack
Incident-response tabletop exercise pack — docs/runbooks/tabletop/ (five facilitated scenarios mapped 1:1 to the K1 runbooks, feeding K4).
L — Backup & Disaster Recovery
Code
Human-Readable Name
What it does
L1
Azure Backup Policy Module
Recovery Services + Data Protection vaults and per-env backup policies (VM, Files, SQL-in-VM, AKS).
L2
Cross-Region Replication Module
Blob object replication + geo-redundant SQL failover group wiring (the active-replication half of DR).
L3
DR Runbook Templates
Disaster-recovery runbook templates (postponed).
L4
Automated Restore Drill
Restores a backup / fails over SQL into an ephemeral sandbox, validates, tears down, and reports; feeds the dashboard DR panel.
L5
RTO/RPO Doc Generator
Merges L1 retention + L2 replication posture + L4 drill evidence into a versioned, evidence-backed RTO/RPO objectives document (apps/rto-rpo-doc-generator/).
M — Data Protection & Privacy
Code
Human-Readable Name
What it does
M1
Encryption Policy Module
Deny initiative for encryption-at-rest built-ins (storage/SQL CMK, double-encryption).
M2
Customer-Managed Key Module
HSM-backed Key Vault key + auto-rotation + Crypto-role grants in an existing Premium vault.
M3
TLS Policy Module
Deny initiative for secure-transport built-ins (secure transfer, min-TLS, HTTPS-only).
M4
Microsoft Purview Baseline
modules/azure/purview-baseline/: Purview account + identity + J1 diagnostics + scan-scope RBAC; scan/classification config is the data-plane Part C.
M5
DLP Policies
policy/dlp/: committed M365 DLP policy definitions (PII/financial/PHI) + offline gate + idempotent Security & Compliance PowerShell deploy; Azure-storage half enforced by N5/M1/M3/M6.
M6
Data Residency Policy Module
Allowed-locations Deny initiative enforcing data residency.
M7
GDPR/CCPA Evidence
compliance/data-inventory/ (RoPA register + gate) + docs/runbooks/privacy/ DSAR workflow + per-request records in compliance/dsar/. Finishes the M series.
N — Network Security
Code
Human-Readable Name
What it does
N1
Landing-Zone Connectivity
modules/azure/landing-zone-connectivity/: connectivity edge F2 lacks — Azure Bastion + optional VPN/ER gateway + optional Private DNS Resolver, attached to the existing F2 hub vNet.
N2
Azure Firewall Premium
modules/azure/firewall-premium-policy/: Premium azurerm_firewall_policy with IDPS (intrusion detection) + optional TLS inspection + rule collection groups.
N3
WAF Policy Module
modules/azure/waf-policy/ — WAF policy for AppGw WAF v2 / Front Door: OWASP 3.2 managed rules, custom block/rate-limit rules, per-rule overrides + exclusions.
N4
DDoS Protection
modules/azure/ddos-protection/ — Azure DDoS Network Protection plan; callers associate their VNets via the exported plan_id.
N5
Private Endpoint Policy Module
Deny initiative disabling public network access on storage/KV/Cosmos/SQL.
N6
NSG Baseline Module
Hardened network security group + optional flow logs + Traffic Analytics.
N7
Zero-Trust Reference Architecture
docs/architecture/zero-trust-reference.md: maps the zero-trust pillars/principles to SnowOps assets with a maturity/gap table. Finishes the N series.
O / P / Q — Endpoint, Vendor Risk, HR Security (all postponed to M4)
Code
Human-Readable Name
O1–O4
Endpoint & Workforce Security (Intune / compliant-device CA / Defender for Endpoint / phishing sim)
P1–P4
Vendor & Third-Party Risk (inventory / SOC 2 tracker / DPA workflow / vendor offboarding)
Q1–Q5
HR Security & Training (onboarding / offboarding / training / background check / AUP)
R — Change Management
Code
Human-Readable Name
What it does
R1
PR Template Enforcement
PR template + required-fields validation workflow.
R2
Production Change Log
Merged PRs/squash commits → categorized changelog + optional change-record ticket via E7.
R3
Emergency Change Workflow
Break-glass-label emergency change workflow — .github/workflows/emergency-change.yml drives R4's CAB automation in emergency mode + mandates a retrospective review.
R4
CAB Automation
Change Advisory Board automation — high-impact changes → CAB review ticket via E7.
S — Continuous Compliance Monitoring & Drift
Code
Human-Readable Name
What it does
S1
Drift Detector
Scheduled terraform plan → classified DriftReport → ticket per stack (never applies).
S2
Compliance Dashboard
Offline renderer turning compliance-snapshot history into an HTML/markdown dashboard with trend + regression delta.
S3
Auto-Remediation Playbooks
Curated Logic App pack turning posture findings into remediation: structural dry-run (intent record only) vs. enforce (real ARM REST write via managed identity), decided by Terraform at plan time.
S4
Compliance Scorecard Generator
Offline adapt → render turning one E0 snapshot (+ optional S2 dashboard) into a versioned, branded one-page markdown/HTML/PDF scorecard with a transparent A–F grading band — the sales/client-facing counterpart to S2's technical dashboard.
T — Trust Center & Customer-Facing (all postponed to M4)
Code
Human-Readable Name
T1–T4
Trust center / status page / subprocessor list / security-questionnaire library
U — Cost Governance
Code
Human-Readable Name
What it does
U1
Budget Alert Module
Subscription budget with actual + forecasted notifications and optional action group.
U2
Tag Policy Module
Mandatory-tag Deny initiative over the standard tag set.
U3
Idle Resource Cleanup
Scheduled Function App that cleans up idle resources (postponed scaffold).
U4
FinOps Dashboard
FinOps Grafana dashboard (snowops-finops.json, extends J5) — log-ingestion cost + tag-governance/cost-allocation signals.
U5
Cost Anomaly Detection
modules/azure/cost-anomaly-alert/: Azure Cost Management anomaly alerts (azurerm_cost_anomaly_alert) → email recipients.
V — Documentation & Policy Management
Code
Human-Readable Name
What it does
V1
Policy Repo Template
templates/policies/: ratifiable InfoSec/AUP/IR/BCP-DR/Change/Vendor policy templates, each cross-referencing the SnowOps assets that operationalize it + an offline gate.
V2
Diagram Generator
terraform output -json → F0 contracts → cloud-neutral model → d2lang architecture diagram.
V3
Runbook Generator
terraform output -json → per-domain operational runbooks with key facts + posture digest.
V4
Compliance Manual Generator
apps/compliance-manual/: composes a manual spec (framework + per-control implementation/evidence/policy) + optional E0 snapshot into a branded framework compliance manual (md/HTML/PDF). Finishes the V series.
V5
Client Cloud Posture Report
apps/posture-report/ — offline composer bundling E0/S2/S4/L5/V2 (+ optional K4) into one branded, deliverable-organized client posture report (HTML/PDF) for QBRs/retention.
W — Multi-Tenant Client Management (all postponed, D35)
Code
Human-Readable Name
What it does
W1
Client Repo Template
Multi-tenant client repo template + provisioning (extends B1).
W2
Per-Client State Backend
Per-client Terraform state backend (extends F6).
W3
Per-Client Secret Scoping
Per-client secret scoping via GitHub environments.
W4
Client Offboarding Playbook
Client offboarding playbook.
W5
Internal Client Dashboard
SnowOps internal client dashboard.
X — Testing Framework & Sandbox
Code
Human-Readable Name
What it does
X1
Azure Sandbox Subscription
Terraform-managed, budget-capped, auto-cleanup sandbox subscription — the target for all cloud tests.
X2
Terratest Harness
Go-based, parallel-safe, sandbox-scoped Terratest harness (mandatory per F-module).
X3
Conftest Test Suite
Conftest test suite for the Terraform OPA bundle (D3).
X4
Kyverno Test Framework
kyverno test framework for the AKS policy bundle (D4).
X5
Pipeline Integration Tests
Reusable-workflow contract gate + live test consumers for the CI pipelines.
X6
Manual Test Runbooks
The per-asset manual test runbooks under docs/runbooks/test/ (ongoing).
X7
Sandbox Cleanup
Nightly cleanup of ephemeral=true resource groups with three safety guards.
X8
Synthetic Monitoring
App Insights standard availability tests + per-test alerts.
Y — Go-To-Market & Sales Engine
Code
Human-Readable Name
Y0
GTM Operating Doc
Y1
Positioning & Messaging House
Y2
Pricing & Packaging Sheet
Y3
ICP & Target-Account Playbook
Y4
Cold-Outreach Kit
Y5
Discovery Call Script
Y6
Proposal & SOW Template Library
Y7
Compliance Coverage Matrix
Y8
Capabilities Deck & One-Pagers
Y9
Proof & Case-Study Kit
Y10
Nurture & Follow-Up Sequences
Y11
Customer Success & Expansion Playbook
Y12
Contract & Legal Pack
Y13
Sales Pipeline & CRM Config
Z — Reference Architectures
Code
Human-Readable Name
Z0
Reference-Architecture Framework
Z1
SaaS Startup Reference Platform
Z2
FinTech Reference Platform
Z3
Healthcare / HealthTech Reference Platform