Statement of Compliance Cloud Platform

Transcription

1 Bidder Name Statement of Compliance Cloud Platform S. No. Functional Requirements of Virtual Private Cloud and Hybrid Cloud Platform Cloud services 1 Cloud services for both Windows hyper-v and Vmware vshpere platform. 2 Infra admin service portal. 3 Infrastructure as a Service (IaaS) 4 Platform as a Service (PaaS) 4.1 Compute Nodes - Virtual Machine Requirements 4.2 Network 4.3 Storage 4.4 Security 5 End user services Portal 6 Cloud Migration 7 Cloud Market Place - (Apps Store/ Market Place for multiple service offering) 8 Legal Compliance Requirements Particulars 1 Cloud services for both Windows hyper-v and Vmware 1.1 Cloud infra should build with Vmware vsphere clusters 1.2 Cloud infra should build with Microsoft Hyper-V clusters 1.3 Cloud infra self service portal should provide self service VM provisioning and decommissioning for compute 1.4 Cloud infra user portal should have the capability to create Virtual Machines with required number of vcpus and Ram 1.5 Cloud infra should support provisioning 3rd party cloud virtual appliances. 1.6 Cloud infra user portal should have the capability to modify Virtual Machines with required number of vcpus and Ram 1.7 Cloud infra hypervisor should be build with High availability for failure of hardware 1.8 Cloud infra should be configured with a public and private network. 1.9 Cloud infra should support provisioning Windows\Linux OS level availability cluster Cloud infra should support VMs with different Windows server and desktop OS versions Cloud infra should support VMs of different Linux OS versions Cloud infra should support deploying VMs from the user uploaded data and software's images Cloud infra should support Live migration of VMs and storage Compliance statement Compliant Remarks 2 Infrastructure Administration Service Portal. 2.1 Cloud infra should have an admin portal for the cloud management, metering and show back reports. 2.2 Portal should support multiple user Roles. Admin should be able to configure Roles and Permissions associated with it. 2.3 admin portal should have the complete visibility for different layers of the cloud Infrastructure and all provisioned services. 2.4 Admin user should be able to create projects, users and manage quota for projects. 2.5 All Cloud infra management portals and its components must be deployed in both hardware and application level high-

2 2.6 All Cloud infra management portals and its components must be deployed in a scalable architecture to support up to 15,000 virtual machines at a time. 2.7 Cloud user portal also should provide a market place for various VM appliances and applications for PaaS 2.8 Solution should have capabilities around Configuration and Change Management workflows 2.9 Solution should have customer specific Customer Purchase Order values in meetering. Chargeback should be per each customer Purchase order values Ability to analyze usage data, forecast for each teneants and custom reports. Capabilities around exporting of reports to multiple formats All Cloud infra management portals should support Browserbased user interface which can coordinates application deployment, lifecycle management, administration, and governance activities for Each Cluster and cloud environment 2.12 All Cloud infra management portals should be integration with an existing user directory (such as Lightweight Directory Access Protocol [LDAP] or Microsoft Active Directory) All Cloud infra management portals should combines infrastructure automation and application automation layers in a single deployable platform 2.14 All Cloud infra management portals should support multifactor authentication (2FA) All Cloud infra management portals should support multiple tenants and sub tenanats. Resource Quote at Tenant and subtenanats level All Cloud infra management portals shouldsupports containers, such as Docker, that can be easily modeled as part of any tenent profile and then deployed and managed in any cloud environment. Contains single or multiple Docker containers environment which supports composite topologies using containers mixed with other application and cloud services Cloud infra management portals should able to calculate the resource and services and generate the report and download into Individual tenent Cloud infra management portals should support to mentioned and Visiable the Price details of Individaul services to each Tenent, and also summmarize total value. 3 Infrastructure as a Service (IaaS) 3.1 Self provisioning of IaaS CPU, compute and storage and deprovisioning. 3.2 Integrated VM monitoring for server, network, storage 3.3 Integrated with IT helpdesk for end user to create service desk requests. 3.4 The Solution should be able to isolate and allow secure authenticated access to infrastructure services and Integration with Single Sign On tools to integrate with industry standard authentication and authorization technologies such as SAML and the ability handle roles rather than user accounts for access 3.5 The Solution should be able to integrate with other public clouds like AWS, Azure, google, IBM softlayer.

3 3.6 IaaS platform should support API integration with other application like infra monitoring, security or network, backup appliances, Two-Factor Authentication, SSL VPN clients. 3.7 The IaaS platform should support VPN, NLB, firewall and other market place applications. 3.8 Capability of the platform to support following, as defined in -Resource tags -Monitoring and security -Policy based backup 3.9 The IaaS platform should be capable of supporting multitenancy to run cloud services (compute, network, storage) for multiple consumers on a single platform while dynamically and automatically managing the isolation of virtual machines into secure pools via SDN. This functionality should be exposed via API 3.10 The Solution should be able to provide workload migration, orchestration, interoperability between private and public clouds, OR Between two hypervisor Clusters IaaS platform should be build both Windows Hyper-V and Vmware vshpere The Solution should be able to run various operating systems like windows client, windows server, different Linux and Open Solurce OS flavers 3.13 IaaS infra should support Virtualized Resources Catalogue Management operations 3.14 The Solution should have the gold image based deployment for various OS and application stacks VIM should support following formats of Images Qcow2, VMDK, AMI, ISO, OVA, VHD 3.16 The Solution should cater for the fact that if one server fails all the resources running on that server shall be able to migrate to another set of virtual servers as available 3.17 The Solution should provide support for cluster services between Virtual Machines 3.18 The should provide patch management capabilities for the core HW, hypervisor and other applications used in the infra except guest operating system The Solution should manage tenants, with in the tenants subgroups and roles in a multi-company and multi-business Units include at least three user levels for the Platform. Users/Tenants should be able to configure their own cloud credentials and Admin should restrict which cloud/cloud accounts users/groups/tenants can access 3.20 Dashboards must be available to allow different groups of users to control the behavior and consumption of the services 3.21 The Solutions should capabilities and mechanisms to migrate workloads across the different cloud platforms. Vmware to Hyper-V, Hyper-V to Vmware and Vmware, Hyper-v to public AWS, Azure clouds 3.22 Cloud Solutions must provide visibility and show back for all the VM's that are not deployed through Cloud Portal. System must provide management actions like resize, snapshopt, reboot, power on/off etc for existing VM's not deployed through Cloud portal Cloud Solutions must provide support for High Availability and Disaster Recovery capabilty built into the platform

4 4 Platform as a Service (PaaS) Cloud infra should support and provide the following capabilities of 4.1 Compute Nodes - Virtual Machine Requirements CPU details (type of vcpu, number of Cores) Quantity of CPUs Memory details Size of memory Local storage details (type of disks ) Size of local storage Type and Quantity of NICs CPU (Central Processing Unit) - CPU options shall be provided as follows: a. A minimum equivalent CPU processor speed of 2.4GHz shall be provided. b. The CPU shall support 64-bit operations Virtual Machine Block Storage Service Requirements a. Service shall provide scalable, redundant, dynamic Webbased storage b. Service shall provide users with the ability to procure and provision block storage capabilities for cloud virtual machines remotely. c. Service shall provide block storage capabilities on-demand, dynamically scalable per request for virtual machine instances. d. Block Storage Once mounted, the block storage should appear to the virtual machine like any other disk e. Storage Space: Online, on-demand storage volumes of arbitrary size ranging from 50 GB to at least 1 TB Should loaded software installed on virtual machines and any application or product that is deployed / Available in Market place on the Cloud Support a secure administration interface - such as SSL/TLS or SSH - for the designated personnel to remotely administer their virtual instance Provide the capability to dynamically allocate virtual machines based on load, with no service interruption Provide the capability to copy or clone virtual machines for archiving, troubleshooting, and testing Should Support and Implement fine-grained access controls including role based access control, use of SSL certificates, or authentication with a multi-factor authentication Should support IP address management for client VMs with Virtual/Elastic IP address Provide facility to configure virtual machine of required vcpu, RAM and Disk Provide facility to use different types of disk like SAS, SSD based on type of application All cloud solution components like cloud portals should be deployed with hi-availabilty clustering or Load balencers. 4.2 Network All connections between all components of cloud solution should be fully redundant non-fate-sharing paths Solution should guarantee loops prevention in network topology at the networking layer

5 4.2.3 The Solution should allow configuring each Virtual Machine with one or more virtual NICs. Each of those network interfaces can have its own IP address and even its own MAC address Should have functionality to allocate a given max throughput per VM And apply QoS limits on the total bandwidth allocation per node or switch, is within the capacity from the networking Policing of VMs bandwidth usage at Hypervisor The IaaS infra should allow for creating virtual switches for each customers accounts and that connect virtual machines belongs to that accounts The IaaS infra should allow for creating network level segregation for each customers accounts and that connect virtual machines belongs to that accounts using SDN layer or virtual appliances The IaaS infra should support configurations of q VLANs which are compatible with standard VLAN implementations from major vendors at the network/hypervisor layer The IaaS infra should have the capability for moving Virtual Machines from different networks IaaS infra should support VxLAN, Jumbo frames, IPv4, IPv6, Static routing and other network QoS functions IaaS infra should allow VM bandwidth monitoring and QoS services in the Bandwidth at the hypervisor/network SDN layer The IaaS infra should allow deploying virtual firewall for each customers accounts and that connect virtual machines belongs to that accounts The IaaS infra should allow for creating virtual VPN for each customers accounts and that connect virtual machines belongs to that accounts Local Area Network (LAN) shall not impede data transmission Provide a redundant local area network (LAN) infrastructure and static IP addresses from customer IP pool or private noninternet routable addresses from ITI IP Pool Ability to deploy VMs in multiple security zones, as required for the project, defined by network isolation layers in the Customer s local network topology Ability to deploy access to Wide Area Network (WAN) Provide private connectivity between a Customer s network and Data Center Cloud Facilities Network IP Addressing: a. Provide IP address assignment, including Dynamic Host Configuration Protocol (DHCP). b. Provide IP address and IP port assignment on external network interfaces. c. Provide dedicated virtual private network (VPN) connectivity. d. Allow mapping IP addresses to domains owned by the Customer, allowing websites or other applications operating in the cloud to be viewed externally as Customer URLs and services Provide infrastructure that is IPv6 compliant Support network level redundancy through MPLS lines from two different service providers, alternate routing paths facilitated at ISP backbone (MPLS), redundant network devices etc. Redundancy in security and load balancers, in high availability mode, will be provided to facilitate alternate paths in the network

6 4.3 Storage Storage solution should be self provisioned from end user portal IaaS infra should allow adding additional virtual disks of different types and performance IaaS infra should report storage usage and capacity for metering and show back reports Should have an option of selecting different volume types that can be based on performance or cost IaaS infra storage should provide tiered storage for VMs IaaS infra storage should provide flash storage for the VM boot drives. tier storage for VMs IaaS infra storage should provide HDD based storage for VMs for backup and archive kind of workloads IaaS infra storage should provide high performance flash storage for DB and high transactional workload Cloud infra storage should supports RAID/RAIN/Erasure Coding to offer highest level of Availability, Reliability and Survivability Implement industry standard storage strategies and controls for securing data in the Storage Area Network so that clients are restricted to their allocated storage. 4.4 Security Cloud infra, user and admin portals should supports authentication mechanism based on unique identity and role based access All cloud infra user and admin activities must be logged for 180 days Cloud infra should support deploying additional security services to each tenant accounts Cloud setup to Compliance to Cloud Security ISO Standard ISO 27017:2015, Privacy Standard ISO 27018:2015 and ISO 20000: Meet any security requirements published by MeitY or any standards body setup / recognized by Government of India Ability to create non-production environments and segregate (in a different VLAN) non-production environments from the production environment such that the users of the environments are in separate networks Cloud offering should have built-in user-level controls and administrator logs for transparency and audit control Cloud platform should support Provision / Configure with Web Application Filter for OWASP Top 10 protection as a service that can be enabled for Individual Tenent via virtual appliances Access to Customer provisioned servers on the cloud should be through SSL VPN clients Cloud Setup shall allow logs of all administrator activities performed by Customer's Login Accounts Shall provide consolidated view of the availability, integrity and consistency of the Web/App/DB tiers Cloud setup should enforce password policies (complex password, change password in some days etc) 5 End user services Portal 5.1 User should be able to Create/update/delete/reboot/rebuild Virtual Machines

7 5.2 User should be able to add/delete network interfaces. 5.3 User should be able to Create Virtual Machine(s) from OS Image template with selected OS flavor. 5.4 User must be able to Create /delete volumes, attach/detach disk volume to/from VM. 5.5 User must be able to Back-up volume including DBs through Backup integration. 5.6 User must be able to Create/deleteVM snapshots. 5.7 End user services Portal provide a VMs and apps monitoring dash board. 5.8 User should be able to add/delete VMs to Monitoring. 5.9 User portal dashboard should be showing tenant data like no. of vcores, Memory, vcpu, disk usage uptime and other detailed VM data from a 3rd party monitoring tools via API intgration User portal should be able to monitor VM level applications and DBs with a Dash board view and alert notifications User portal should provide helpdesk ticketing and status updates inside the dash board from 3rd party helpdesk tools via API intagration User portal should provide 3rd party backup application integration User should be able to add/delete backup for any VMs and DB with different backup schedules User portal should provide VM/DB/Apps backup status as per the backup schedules User portal should provide each customer account based VMs and other subscribed services metering and show back information's 6 Cloud Migration 6.1 Cloud infra should have options to upload data securely. 6.2 The solution should automatically scan all files uploaded against threats like malware,viruses,trojans etc. 7 Cloud Market Place 7.1 Cloud infra should provide a market place for various cloud services for applications, compute, network, security and storage. 7.2 Cloud market place should be integrated and avilable to end user portal. 7.3 Cloud market place should provide a appliance, applications details and costing in the end user portal. 7.4 Cloud end user should be able to avail the market place services by creating a requested from the user portal. 7.5 Market place should include various brands security firewall/utm virtual appliances. 7.6 Market place should include various brands VPN virtual appliances. 7.7 Market place should include various brands load balancer virtual appliances. 7.8 Market place should include various brands antivirus, malware,trojans virtual appliances/applications 7.9 Market place should include various published appliances and applications from Vmware and azure. 8 Legal Compliance Requirements

8 All cloud deployment should support 1. IT Act 2000 (including 43A) and amendments thereof with required upgrades Cloud infra Meet the ever evolving security requirements as specified by CERT-In with required upgrades. Meet any security requirements published by MeitY or any standards body setup / recognized by Government of India All services acquired under this application document including data will be guaranteed to reside in India only The cloud service offerings Implementation will have to comply with the guidelines & standards as and when such guidelines / standards are published by MeitY within the timeframe given by MeitY.