API Key Structure:
- Prefix: idgen_
- Environment: prod/staging/dev
- Random: 32 bytes (base64)
- Example: idgen_prod_a8f3k2m9x7c4v1b6n5h8j2k9

Key Rotation:
- Automatic: Every 90 days
- Manual: On-demand via API
- Grace period: 7 days for old keys
- Notification: Email 14 days before expiration

Supported Flows:
- Client Credentials (service-to-service)
- Authorization Code (user-facing apps)
- JWT Bearer tokens

Token Validation:
- Signature verification
- Expiration check
- Scope validation
- Rate limit enforcement

Layer 1: Edge (CloudFlare/AWS WAF)
- 10,000 requests/sec per IP
- Geographic blocking
- Bot detection

Layer 2: Load Balancer
- 1,000 requests/sec per client
- Connection limits
- Request size limits

Layer 3: Application
- Per API key limits
- Per user limits
- Burst allowance

Request Validation:
- Batch size: 1-10,000
- API key format
- Request size limits
- Parameter sanitization

Response Validation:
- ID format verification
- Range checks
- Duplicate detection

TLS Configuration:
- TLS 1.3 required
- Strong cipher suites only
- Perfect forward secrecy
- Certificate pinning (mobile apps)

Cipher Suites (Recommended):
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
- TLS_AES_128_GCM_SHA256

from cryptography.fernet import Fernet

class EncryptedIDGenerator:
    def __init__(self, key):
        self.cipher = Fernet(key)
        self.generator = SnowflakeIDGenerator()
    
    def generate_encrypted_id(self):
        # Generate Snowflake ID
        id = self.generator.generate_id()
        
        # Encrypt ID
        encrypted = self.cipher.encrypt(str(id).encode())
        
        # Return base64-encoded encrypted ID
        return encrypted.decode()
    
    def decrypt_id(self, encrypted_id):
        # Decrypt
        decrypted = self.cipher.decrypt(encrypted_id.encode())
        
        # Return original ID
        return int(decrypted.decode())

DO NOT Include:
- User personal information
- Email addresses
- Phone numbers
- Geographic location (precise)
- IP addresses

SAFE to Include:
- Datacenter ID (region-level)
- Worker ID (internal identifier)
- Timestamp (public information)
- Sequence number

Right to Erasure:
- IDs themselves are not PII
- Mapping to user data can be deleted
- IDs can remain in system
- No personal data in ID structure

Data Minimization:
- Only necessary metadata in IDs
- No user-identifiable information
- Aggregate metrics only
- Anonymized audit logs

Data Portability:
- IDs are portable
- No vendor lock-in
- Standard format
- Easy migration

{
  "event_id": "evt_123456",
  "timestamp": "2024-01-03T19:30:00Z",
  "event_type": "id_generated",
  "severity": "info",
  "actor": {
    "api_key_id": "key_abc123",
    "ip_address": "192.168.1.100",
    "user_agent": "MyApp/1.0"
  },
  "action": {
    "type": "generate_id",
    "count": 1,
    "success": true
  },
  "resource": {
    "id": 1234567890123456789,
    "datacenter_id": 0,
    "worker_id": 5
  },
  "metadata": {
    "latency_ms": 0.5,
    "request_id": "req_xyz789"
  }
}

Security Events: 7 years
Access Logs: 1 year
Performance Metrics: 90 days
Debug Logs: 30 days

Storage:
- Hot: S3 Standard (30 days)
- Warm: S3 IA (31-365 days)
- Cold: S3 Glacier (1-7 years)

- Use UUIDs for public-facing IDs
- Encrypt Snowflake IDs
- Implement authorization checks
- Rate limit ID validation requests
- Monitor for sequential access patterns

- Constant-time comparisons
- Add random jitter to responses
- Rate limiting
- Monitor for timing analysis patterns

- Idempotency keys
- Request timestamps
- Nonce validation
- Short-lived tokens

- Multi-layer rate limiting
- Geographic filtering
- Bot detection
- Auto-scaling
- Circuit breakers

Security Controls:
- Access control (authentication/authorization)
- Encryption (TLS, at-rest)
- Monitoring (logging, alerting)
- Incident response (runbooks, escalation)
- Change management (version control, testing)

Audit Requirements:
- Annual security audit
- Penetration testing
- Vulnerability scanning
- Compliance reporting

Requirements:
- Encrypted transmission
- Access logging
- Audit trails
- Business associate agreements
- Breach notification procedures

Implementation:
- TLS 1.3 for all communications
- Comprehensive audit logging
- Access control lists
- Regular security assessments

1. Detection (0-15 minutes):
   - Automated alerts
   - Anomaly detection
   - Manual reports

2. Assessment (15-30 minutes):
   - Determine severity
   - Identify affected systems
   - Estimate impact

3. Containment (30-60 minutes):
   - Isolate affected nodes
   - Revoke compromised credentials
   - Enable additional monitoring

4. Eradication (1-4 hours):
   - Remove threat
   - Patch vulnerabilities
   - Update security controls

5. Recovery (4-24 hours):
   - Restore services
   - Verify integrity
   - Monitor for recurrence

6. Post-Incident (1-7 days):
   - Root cause analysis
   - Update procedures
   - Communicate with stakeholders
   - Implement preventive measures

Timeline:
- Internal notification: Immediate
- Management notification: 1 hour
- Customer notification: 72 hours (GDPR)
- Regulatory notification: As required

Communication:
- What happened
- What data was affected
- What we're doing
- What customers should do
- Contact information

Code Review:
- Security-focused reviews
- Automated security scanning
- Dependency vulnerability checks
- Static analysis tools

Testing:
- Security unit tests
- Penetration testing
- Fuzzing
- Chaos engineering

Deployment:
- Immutable infrastructure
- Secrets management
- Least privilege access
- Network segmentation

Access Control:
- Multi-factor authentication
- Role-based access control
- Principle of least privilege
- Regular access reviews

Monitoring:
- Real-time security monitoring
- Anomaly detection
- Threat intelligence
- Security information and event management (SIEM)

Maintenance:
- Regular security updates
- Vulnerability patching
- Security training
- Incident drills