網站營運的使用者故事（User stories for web operations）

瞭解基礎架構範疇的有用起始點

This document outlines the typical scope of infrastructure and web operations (sometimes erroneously referred to as hosting) work on a large service redesign project.
本文概述了基礎設施和網路營運（有時誤稱為主機託管）上重新設計服務的大型專案工作的典型範圍。

The sample list of user stories provided is not intended to be a complete list of all areas of interest nor are you likely to need to do all of this for every service. The idea is for this list to be a good starting place from where to you can write additional stories, delete ones you do not require and split stories into smaller ones. Importantly you also need to provide your own acceptance criteria specific to the needs of your service.
以下所提供的使用者故事範例清單並不是所有領域的完整使用者故事清單，也不是每個服務都需要以下所列全部的使用者故事清單。我們的想法是這個清單是個很好的起點，你可以寫更多的故事、刪除那些你不需要的故事和將故事分離成較小的故事。重要的是你需對要針對你的服務的需求，提供自己的驗收標準。

Remember these stories are a placeholder for a conversation. For some contexts, that conversation will be ‘this does not apply to my service’ — that is fine. But there will almost certainly be other stories not listed here which do apply.
請記住這些故事是對話的樣式(a placeholder for a conversation)。在一些脈絡下，該對話將是’這並不適用於我的服務’ – 也沒關係。但幾乎可以肯定的是有其他未列出故事適用。

問題 The problem

An issue we have observed on a number of projects is a lack of understanding early on in a project about the work required to run a large online service. Often this is placed under hosting and is investigated too late in the process.
我們在一些専案中發現了一個問題，那就是對於執行一個大型的線上即時服務所需的工作，在専案的初期缺乏認識。通常這被歸類為 主機託管(hosting) ，在過程中才被深入探討為時已晚。

目標讀者 Intended audience

The hosting of a complex and sensitive software application requires a team of people with specialist skills to design, setup and operate. Because this work is generally not user facing and can be highly technical it is sometimes easy to leave until later — with potentially dire consequences for launching safely and on time.
複雜而敏感的應用軟體的主機維運是需要由各種專業技能人才所組成的團隊來設計、安裝和操作。由於這種工作通常不需要面對使用者而且可以是高度技術性的工作，有時候容易被保留，直到 — 對於安全準時上線具有潛在嚴重影響時。

服務管理者 Service managers

Does your team have people who deeply understand this topic? If you are not an expert then it is important to involve people permanently in the team who are. They can explain the technical trade offs and decisions which may affect your service.
您的團隊是否有人深刻瞭解這個主題？如果你不是這方面的專家，那麼團隊中需要有這方面的専家永久參與是非常重要的。他們可以解釋可能會影響您的服務的技術權衡和決定。

交付管理者 Delivery managers

As well as understanding the potentially large scope of work, many of the areas discussed here have lead times associated with third parties. The earlier stories related to these topics are brought into project backlogs the sooner estimates can be made and deadlines understood.
除了了解工作的潛在大範圍之外，這裡所討論的許多領域的完成時間都與第三方有關。與這些主題相關的故事愈早被帶進専案待處理項目清單中 (project backlog)，則時程可以愈早被估計以及理解它的期限。

故事 Stories

The following stories are intended to provide a starting point for any project, rather than be a complete set. Individual projects would be expected to take and modify stories as needed and importantly to apply their own acceptance criteria specific to their requirements.
下列的故事，旨在為任何専案提供一個起點，而不是一個完整的故事集合。個別専案可以使用這些故事並根據需要進行修改，重要的是針對他們的需求採用他們自己的驗收標準。

The majority of these stories are from the point of view of developers, web operations engineers and the responsible service manager. Although not ideal, for this particular technical topic this works reasonably well. Feel free to change the focus when using them in your backlog.
大多數這些故事都是從開發者、網路維運工程師和負責該服務的服務管理者的觀點來編寫。雖然不盡理想，但對於這個特殊的技術主題來說這還算不錯。當你使用它們作為你的待處理項目清單時，你可以隨意修改。

流程 Process

開發流程 Development process
As a developer working on the service
So that we can ensure a high level of quality
And so we can maximise the integrity of the source code
I want a well documented and understood development process
作為　一名服務的開發人員
為了　保證高水準的品質
並且　最大化程式碼的完整性
我要　一個記錄完整並易於了解的開發流程

非工作時間的支援 Out-of-hours support
As the service manager responsible for the service
So that we can ensure a suitable level of availability and integrity
I want to understand the requirement for Out-of-hours support
作為　一名對服務負責的服務管理者
為了　確保可用性和完整性的適當水準
我要　了解非工作時間的支援的需求

災害恢復 Disaster recovery
As the service manager responsible for the service
So that in the event of a disaster everyone doesn’t panic and make things up
I want a clear disaster recovery plan in place to deal with different types of catastrophic event

作為　對服務負責的服務管理者
為了　在災難事件中，每個人不會慌亂並且克服它
我要　明確的災難恢復計劃被制定完成，以應付不同類型的災難性事件

釋放過程 Release process
As the service manager responsible for the service
So that the service can be changed on a very frequent basis
And so that changes do not cause problems for users
I want a well documented and understood release process
作為　對服務負責的服務管理者
為了　該服務可以非常頻繁地被修改
而且　這樣的變化不會引起使用者的問題
我要　一個記錄完整並易於了解的釋出或發佈流程

安全對策 Security response
As the service manager responsible for the service
So that security incidents are handled with extra care
And so that the service meets its wider Government obligation to GovCert
I want a well documented and understood security incident process
作為　對服務負責的服務管理者
為了　安全事故被特別小心處理
並且　該服務滿足GovCert更廣泛的政府責任
我要　一個記錄完整並易於了解的安全事故處理流程

服務台 Helpdesk
As the service manager responsible for the service
So that communication with users is done in a joined up way
I want a central helpdesk function to deal with events, incidents and requests
作為　對服務負責的服務管理者
為了　以聯合的方式完成與使用者的溝通
我要　一個集中式的服務支援功能來處理事件、事故和要求

需求管理 Request Management
As the service manager responsible for the service
So that questions from users can be dealt with efficiently
I want a clear information request management policy
作為　對服務負責的服務管理者
為了　有效地處理由使用者提出的問題
我要　一個明確的資訊要求管理政策

事件管理 Event Management
As the service manager responsible for the service
So that likely events that could affect the running of the service can be dealt with smoothly
I want a clear event management policy
作為　對服務負責的服務管理者
為了　可能影響服務的運作的事件，有可能順利地被處理
我要　一個明確的事件管理政策

事故管理 Incident Management
As the service manager responsible for the service
So that problems that arise with that service can be dealt with efficiently
I want a clear incident management policy
作為　對服務負責的服務管理者
為了　由該服務發生的問題可以有效地被處理
我要　一個明確的明確的事故管理政策

操作手冊 Operations manual
As the service manager responsible for the service
So that information about the running of the service is not kept in individuals’ heads
And so information is readily available to people running the service
I want a single place to store content for a service operations manual
作為　對服務負責的服務管理者
為了　關於執行該服務的資訊不會保存在個人的心中
並且　該資訊可以隨時地供執行該服務的人使用
我要　有一個單一的地方來存儲的服務操作手冊的內容

共享服務 Shared service

程式碼託管服務 Source code hosting
As a developer working on the service
So we have somewhere to securely store our source code
I want access to a central source code hosting service or repository
作為　服務的開發人員
為了　能有地方安全地存儲我們的程式碼
我要　獲得一個集中的程式碼託管服務或資料庫

持續整合 Continuous Integration
As a developer working on the service
So we can ensure a high level of quality in the code
And so we can minimise the time needed for regression testings
I want a Continuous Integration environment which automatically runs tests against every commit
作為　服務的開發人員
為了　保證程式碼的高品質
並且　可以減少進行回歸測試的時間
我要　一個持續整合的環境，它可以在每次遞交程式碼時自動執行測試

外部DNS External DNS
As a web operations engineer
So that visitors to the service don’t need to remember an IP address that will change
I want a process and supplier relationship to manage external DNS addresses
作為　一個網站營運工程師
為了　讓訪客進入該服務時，不需要記住常常變動的 IP 位址
我要　一個流程以及供應商關係來管理外部DNS地址

政策 Policy

程式碼的機密程度 Sensitivity of source code
As a developer working on the service
So that I understand the controls that need to be in place
And so that I know who and how I may share it
I want a clear policy around the sensitivity of source code
作為　一名服務的開發人員
為了　明白那些管制必需完備
並且　知道可以跟誰分享以及如何分享程式碼
我要　關於程式碼機密性的明確政策

第三方程式碼 Third party code
As a developer working on the service
I want a clear policy around use of third party source code libraries
So that I do not introduce unknown security problems
作為　一名服務的開發人員
為了　不會遇到未知的安全問題
我要　關於第三方程式碼函式庫使用上的明確政策

變更評估 Change evaluation
As the service manager responsible for the service
So that I can release changes to production quickly
And so that we can meet our obligation to the Digital by Default Service Standard
I want a documented process for evaluating and deciding on a change to the production service
作為　對服務負責的服務管理者
為了　可以迅速將變更發行到正式環境
並且　可以滿足我們Digital by Default Service的義務
我要　記錄完整的，針對變更的服務釋出到正式環境的評估以及決定的流程

存取控制 Access control
As the service manager responsible for the service
So that the confidentiality, integrity and availability of the service isn’t compromised
And so that suitable technical controls can be put in place to enforce it
I want a clear policy on who has access to what on the production system
作為　對服務負責的服務管理者
為了　服務的保密性、完整性和可用性不受損害
並且　讓合適的技術控制可以到位，以便於執行
我要　誰可以存取正式環境以及什麼可以被存取的的明確政策

職能分工 Separation of duties
As the service manager responsible for the service
So that we can ensure the service has enough people in the right roles
I want to understand any required separation of duties (whether driven by legislation or security concerns)
作為　對服務負責的服務管理者
為了　確保服務有足夠多的工作人員
並且　處於正確的角色
我要　了解任何必需的職能分工（不論是因為法律規定或安全問題而產生的）

許可 Clearances
As the service manager responsible for the service
So that security clearances can be arranged early in the project to avoid access restrictions later on
I want to know what level of clearances are required for different roles (including third parties)
作為　對服務負責的服務管理者
為了　安全許可可以在専案中及早被安排，以避免日後的存取限制
我要　知道不同的角色需要什麼程度的安全許可（包括第三方）

發布開源碼 Releasing open source
As a developer working on the service
So that I do not introduce unknown security problems
And so that we can meet our obligation to the Digital by Default Service Standard
I want a clear policy around releasing code as open source
作為　一名服務的開發人員
為了　不會遇到未知的安全問題
並且　滿足我們Digital by Default Service的義務
我要　一個針對開源程式碼釋出的明確政策

設計 Design

政府網路 Government networks
As a technical architect
So that the right suppliers are contracted
And so that long lead times are factored into the project plan early
I want to know whether the service requires access to a Government network like the PSN or GSI
作為　一個技術架構師
為了　與適當的供應商簽約
並且　長交付周期可以及早被納入専案計劃
我要　知道這個服務是否需要存取政府網路，如PSN或GSI

多基礎設施供應商 Multiple infrastructure providers
As the service manager for this service
So that I understand the intended availability constraints
I want to know whether multiple suppliers of Infrastructure are required
作為　這個服務的服務管理者
為了　明白預期的可用性限制
我要　知道是否需要多個基礎設施的供應商

容量規劃 Capacity planning
As a web operations engineer
So that we can estimate the number and size of infrastructure components (instances, firewalls, load balancers etc.)
And so that resource based costs can be estimated
I want to carry out some capacity planning activities
作為　一個網站營運工程師
為了　可以估算基礎設施組件（實例、防火牆、負載均衡器等）的數量和大小
並且　資源成本可以被估計
我要　展開一些容量規劃的活動

網路架構 Network architecture
As a technical architect
So that I can build out a production environment to an agreed specification
I want a network architecture design
作為　一個技術架構師 為了達到，可以建立符合規格的正式環境
我要　網路架構設計

組件 Components

Web伺服器 Web servers
As a web operations engineer working on the service
So that we can serve HTTP request
And so we can proxy requests to application servers
I want to install and configure a web server
作為　一個服務的網站營運工程師
為了　我們可以服務HTTP的請求
並且　我們可以proxy請求到應用伺服器
我要　安裝和配置Web伺服器

資料庫 Databases
As a web operations engineer working on the service
So that data can be stored in a manner befitting its structure
And so the stored data can be queried as quickly as required
I want to install and configure a suitable database server
作為　一個服務的網站營運工程師
為了　使數據能夠被存儲在一個適合它結構的方式
並且　所存儲存的數據可被快速地根據需要所查詢
我要　安裝和配置一個合適的資料庫伺服器

As a web operations engineer working on the service
So that data can still be read even during a failure of a single database server
I want to configure some failover or other redundancy mechanism for the database
作為　一個服務的網站營運工程師
為了　數據在單一資料庫伺服器發生故障時仍然可以被讀取
我要　配置資料庫中的一些故障或其他備援機制

As a web operations engineer working on the service
So that data can still be written even during a failure of a single database server
I want to configure some failover or other redundancy mechanism for the database
作為　一個服務的網站營運工程師
為了　數據在單一資料庫伺服器發生故障時仍然可以被寫入儲存
我要　配置資料庫中的一些故障或其他備援機制

負載均衡 Load balancers
As a web operations engineer working on the service
So that web requests can still be served even with the failure of one or more web servers
I want to install and/or configure a load balancer
作為　一個服務的網站營運工程師
為了　使Web請求在單一或多個web伺服器損壞時仍然可以被執行
我要　安裝和/或配置負載平衡器

內部DNS Internal DNS
As a web operations engineer working on the service
So that we can easily address our services and instances
I want to install and/or configure a mechanism to manage internal DNS
作為　一個服務的網站營運工程師
為了　可以很容易地解決我們的服務和實例
我要　安裝和/或配置機制來管理內部DNS

資料庫備份 Database backups
As the service manager for the service
So that we can recover from a large failure of our database infrastructure
I want regular automated backups to be taken of the data stored in the database
作為　這個服務的服務管理者
為了　可以從資料庫基礎設施的嚴重損毁中恢復
我要　對儲存在資料庫中的數據作定期地自動備份

As the service manager for the service
So that we can recover from a large failure of a single suppliers infrastructure
I want regular automated backups to be stored off site
作為　這個服務的服務管理者
為了　可以從單一供應商提供所基礎設施的嚴重損毁中恢復
我要　定期地自動異地備份

HTTP緩存 HTTP cache
As a web operations engineer working on the service
So that the service remains fast when serving identical content
And so load is minimised on the application servers
I want to install an HTTP cache
作為　一名服務的網站營運工程師
為了　當服務提供一致的內容時，仍能保持快速
並且　達到在應用程式伺服器上負載的最小化
我要　安裝一個HTTP緩存

電子郵件閘道 Email gateway
As a developer working on the service
So that the service can send email to administrators or end users
I want to setup and configure a suitable email gateway
作為　一名服務的開發人員
為了　該服務可以發送電子郵件給管理員或最終使用者
我要　設置和配置適當的電子郵件閘道

應用伺服器 Application servers
As a developer working on the service
So that the code I write can be run on server instances
I want to install and configure a suitable application server
作為　一名服務的開發人員
為了　所寫的程式可以在伺服器執行個體上執行
我要　安裝和配置一個合適的應用伺服器

內部套件庫 Internal package repository
As a web operations engineer working on the service
So that we can use software not available in our operating system repositories
And so that we can use the security, dependency management and versioning features
I want to install and configure an internal package repository
作為　一名服務的網站營運工程師
為了　我們可以使用不在我們作業系統套件庫裡能找到的軟體
並且　可以使用安控、相依性管理和版控的功能
我要　安裝和配置一個內部套件庫

成品庫 Artifact repository
As a developer working on the service
So that we can share and version individual code components that need it
I want to install and configure an artifact repository
作為　一名服務的開發人員
為了　我們可以對有需要的個別代碼元件進行分享和版本控制
我要　安裝並配置一個成品庫

訊息佇列 Message queue
As a developer working on the service
So that I can easily and efficiently process work asynchronously
I want to install and configure a suitable message queue or work queue system
作為　一名服務的開發人員
為了　可以方便、高效地非同步處理步工作
我要　安裝和配置合適的訊息佇列或工作佇列系統

搜尋伺服器 Search server
As a developer working on the service
So that I can quickly and efficiently search through large amounts of data
I want to install and configure a suitable search engine
作為　一名服務的開發人員
為了　可以快速、高效地搜尋大量的數據
我要　安裝和配置一個合適的搜尋引擎

物件暫存 Object cache
As a developer working on the service
So that I can minimise the number of queries to the database
And so that I can keep the service fast and responsive to users
I want to install and configure a object caching system
作為　一名服務的開發人員
為了　可以對資料庫最少的查詢次數
並且　可以保持服務快速回應使用者
我要　安裝和配置物件暫存系統

監控 Monitoring

量測數據收集服務 Metric collection service
As a web operations engineer working on the service
So that we can collect large numbers of time series metrics from the running service
I want to install and configure a metric collection system
作為　一名服務的網站營運工程師
為了　可以從正在執行的服務收集大量依時序所採得的數據量測
我要　安裝和配置量測數據收集系統

執行中應用程式的監控檢查 Application running monitoring checks
As a web operations engineer working on the service
So that we can run checks against metrics from the metrics system
And so that we can run active checks based on arbitrary code
I want to install and configure a monitoring system
作為　一名服務的網站營運工程師
為了　可以對從量測系統來的數據進行檢查
並且　讓我們可以基於任意程式碼進行積極檢查
我要　安裝和配置監測系統

煙霧測試 Smoke tests
As a developer working on the service
So that I know that I haven’t broken anything when deploying my application
I want a series of smoke tests to be run after all deployments
作為　一名服務的開發人員
為了　確認在部署應用程式時沒有破壞任何東西
我要　在所有的部署之後，進行一系列的煙霧測試

應用程式數據量測 Application metrics
As a developer working on the service
So that I can gain visibility of how my application is running in production
And so we can find and fix problems with it quickly
I want a simple way of instrumenting my application to feed metrics to the metrics system
作為　一名服務的開發人員
為了　可以清楚看到應用程式在正式環境中如何執行
並且　可以發現並迅速解決問題
我要　一個簡單的方法在我的應用程式加裝量測工具，來將量測數據傳入量測系統

系統數據量測 System metrics
As a web operations engineer working on the service
So that we can identify and fix problems with the system, ideally before they occur
I want to set up collection of low level system metrics like load, disk, network io, etc.
作為　一名服務的網站營運工程師
為了　在問題發生前，可以發現並解決系統問題
我要　設定一系列，如負載、磁碟、網絡IO等低階的系統數據量測

資安監控 Security monitoring
As a web operations engineer working on the service
So that we notice quickly and are alerted to any incidents with a security flavour
I want to configure suitable security monitoring tools
作為　一名服務的網站營運工程師
為了　我們能快速留意並警覺到任何與資安有關的事故
我要　配置合適的資安監控工具

通知 Notifications
As a web operations engineer or developer supporting the service
So that I know about any issues as they happen
I want to set up suitable notifications from the monitoring system
作為　一名支援服務的網站營運工程師或開發人員
為了　任何問題發生時我能夠知道
我要　從監控系統建立適當的通知

交易監控 Transactional monitoring
As a developer working on a transactional service
So that we can block fraudulent or otherwise suspect transactions
I want to install and configure a transactional monitoring system with suitable rules
作為　一名交易式服務的開發人員
為了　可以阻止欺詐或其他可疑的交易
我要　安裝並配置具有合適規則的交易監控系統

外部監控 External monitoring
As the service manager for the service
So that in the event of a failure of the monitoring system
And so that the service is monitoring from outside our local network
I want an external monitoring capability with basic checks to monitoring service uptime
作為　這個服務的服務管理者
為了　在監控系統故障的情況下
並且　該服務是從我們本地網路之外監控
我要　有一個具備基本檢查以監測服務正常運行時間的外部監控能力

來自基礎設施提供商的監測數據源 Monitoring data feed from infrastructure provider
As a web operations engineer working on the service
So that I am aware of problems in the hypervisor, physical or network infrastructure
I want a feed of monitoring data from the Infrastructure supplier
作為　一名服務的網站運營工程師
為了　在虛擬機管理程序、實體或網路基礎設施有問題時我能夠知道
我要　來自基礎設施供應商的監測數據源

日誌 Logging

日誌收集 Log collection
As a web operations engineer working on the service
So that I can easily see everything that is happening in specific applications
I want to collect all the logs from applications running on the same host in one place
作為　一名服務的網站營運工程師
為了　可以很容易地看到正發生在特定應用程式裡的一切事件
我要　將在同一主機上運行之應用程式的所有日誌收集在同一個地方

日誌聚合 Log aggregation
As a web operations engineer working on the service
So that I don’t have to go to an individual machine to view its logs
I want all logs from all machines to be aggregated together
作為　一名服務的網站運營工程師
為了　我不用到各別的機器上去查看其日誌
我要　將所有機器的所有日誌聚合在一起

日誌存儲 Log storage
As a web operations engineer working on the service
So that logs can be kept for a suitable period of time
I want to provision enough storage for log archiving
作為　一名服務的網站營運工程師
為了　能夠將日誌留存一段合適的時間
我要　開通足夠的存儲空間做為日誌歸檔用

日誌查看 Log viewing
As a web operations engineer working on the service
So that I can see what is happening across the infrastructure
I want a mechanism for viewing and searching logs in as near real time as possible
作為　一名服務的網站營運工程師
為了　可以看到正發生在整個基礎架構上的事情
我要　盡可能地即時查看和搜索和日誌的機制

As a developer working on the service
So that I can extract information from logs to aid with improving the service
I want a mechanism to run queries across the aggregated logs
作為　一名服務的開發人員
為了　可以從日誌中萃取資訊，以幫助改善服務
我要　可以在聚合起來的日誌中進行查詢的機制

組態管理 Configuration management

組態管理客戶端 Configuration management client
As a web operations engineer working on the service
So that changes to server configuration can be made safely and quickly
I want to install software to manage configuration managemen
作為　一名服務的網站營運工程師
為了　使伺服器組態的改變能夠安全且迅速地進行
我要　安裝軟體來管理組態管理

組態管理資料庫 Configuration management database
As a web operations engineer working on the service
So that configuration changes are tracked over time
And so that current state of available to query
I want to install software to manage a configuration management database
作為　一名服務的網站營運工程師
為了　使組態的變更可以隨著時間被追踪
並且　讓當前的狀態可供查詢
我要　安裝軟體來管理組態管理資料庫

組態管理伺服器 Configuration management server
As a web operations engineer working on the service
So that all nodes do not have all configuration information
I want to install software to allow centralised management of Configuration management code
作為　一名服務的網站營運工程師
為了　讓所有節點不具有所有的組態資訊
我要　安裝的軟體，達到組態管理代碼的集中管理

佈署 Deployment

組態管理代碼佈署機制 Configuration management code deployment mechanism
As a web operations engineer working on the service
So that configuration changes can be made safely and in an auditable manner
I want a deployment process and tooling for configuration management code
作為　一名服務的網站營運工程師
為了　使組態的變更可以安全地和可審計的方式進行
我要　有一套用於組態管理之代碼的佈署流程和工具組合

應用程式佈署機制 Application deployment mechanism
As a developer working on the service
So that changes to applications can be made available to users
And so that changes are made in a safe and auditable manner
I want a deployment process and tooling for application code
作為　一名服務的開發人員
為了　讓應用程式的變更可供使用者取得
並且　這些變更可以一個安全和可被稽核的方式進行
我要　有一套用於應用程式代碼的佈署流程和工具組合

發行追踪 Release tracking
As the service manager for the service
So that we have an auditable log of what was changed when by whom
I want an up-to-date list of releases to be maintained
作為　服務的服務管理者
為了　有個可以被稽核的日誌，紀錄什麼改變是何時由誰造成的
我要　有一份最新的發行清單能被維護更新

包裝 Packaging
As a web operations engineer working on the service
So that we don’t have to compile customised applications from source before using them
And so we can take advantage of dependency and version management capabilities of the OS
I want a process and tooling for creating our own system packages
作為　一名服務的網站營運工程師
為了　在使用客製化的應用程式之前不需要把它從源碼進行編譯
並且　我們可以利用作業系統的相依性和版本管理功能
我要　一套用來製作我們自己系統之套件的流程和工具組合

協作調控 Orchestration
As a web operations engineer working on the service
So that I can run commands across multiple instances quickly
I want tooling in place which allows some orchestration based on the current instances
作為　一名服務的網站營運工程師
為了　可以快速地在多個伺服器實例上執行指令
我要　到位的工具組合，可對現有的伺服器實例進行某些協作調控

資料庫遷移 Database migrations
As a web operations engineer working on the service
So that I can have confidence that database migration scripts will work when applied to production
I want database migrations to be deployed through the same sequence of environments as code changes
作為　一名服務的網站營運工程師
為了　可以確信當資料庫遷移指令腳本套用在 production 環境時將正常運作
我要　讓資料庫遷移的佈署要經過與代碼變更所同樣要經歷的那一連串環境

機密資訊管理 Management of secrets
As a web operations engineer working on the service
So that I can ensure confidential communication between particular parts of the system
I want a process or tool for managing secrets such as keys and passwords
作為　一名服務的網站營運工程師
為了　能保證系統的特定部分之間的保密通信
我要　有管理機密資料 (如密鑰和密碼) 的流程或工具

存取控制 Access control

終端使用者設備 End user devices
As the service manager responsible for the service
So that management access to the infrastructure can be locked down to prevent unauthorised access
I want to know what kind of protection the management end user devices require
作為　為服務負責的服務管理者
為了　可以鎖定對基礎設施的管理功能存取，以防止未經授權的存取
我要　知道執行管理功能的終端使用者設備要求什麼樣的保護

使用者目錄 User directory
As a web operations engineer
So that we do not have to maintain multiple lists of privileged users
And so that users can be added and removed once in a central fashion
I want to install and configure something to provide a single user directory
作為　一名網站營運工程師
為了　不用維護許多份特權使用者的名單
並且　可以集中性地一次新增和刪除使用者
我要　安裝和配置某些東西，以提供一個單一的使用者目錄

金鑰為基礎的認證機制 Key based authentication
As a web operations engineer
So that we are not vulnerable to password based login attempts to individual servers
I want to set-up public key based authentication
作為　一名網站營運工程師
為了　各別的伺服器不會被人以密碼嘗試登入的方式侵入
我要　建立以公鑰為基礎的認證機制

單點登入 Single sign-on
As a web operations engineer
So that any third party web interfaces we use can be accessed via a single login
I want to install and configure a single sign-on systems
作為　一名網站營運工程師
為了　所使用的任何第三方的 Web 界面可以通過單一的認證登入而得到存取權
我要　安裝和配置一個單點登入系統

網路/VPN組態 Network/VPN configuration
As a web operations engineer
So that management functions can not be accessed via the public internet
And so that we reduce the surface area for attack
I want to restrict management access to a VPN and/or non-public restricted network
作為　一名網站營運工程師
為了　使管理功能無法通過公共網路存取到
並且　使我們減少可被攻擊的接觸面積
我要　將管理功能的存取限制在 VPN 和/或 非公開的受限網路下

服務開通 Provisioning

其他環境 Other environments
As the service manager for the service
So that I can see the very latest working version of the service at any time
And so I can share that with people in and outside the team
I want a preview environment to be provisioned which is similar to production
作為　這個服務的服務管理者
為了　可以在任何時候看到服務的最新可行版本
並且　我可以分享給工作團隊裡或外的人
我要　有一個預覽環境能被開通，而它要類似 production 環境

As a web operations engineer working on the service
So that the we have a clean environment in which to test production deployments
And so that we have a secure environment to test with production-like data
I want to provision a staging environment which mimics production as closely as possible
作為　一名服務的網站營運工程師
為了　有一個乾淨的環境，以在其中進行 production 環境佈署的測試
並且　讓我們有一個安全的環境去以近似 production 環境的資料進行測試
我要　開通一個臨時的環境，它要盡可能地對 production 環境進行效仿

Production 環境 Production environment
As a web operations engineer working on the service
So that the service can launch to the public
I want to provision a production environment
作為　一名服務的網站營運工程師
為了　該服務可以啟動給公眾使用
我要　開通一個 production 環境

基礎映像檔 Base image(s)
As a web operations engineer working on the service
So that all server instances start out with sensible security settings
I want to create a base image running the chosen operating system with hardened configuration
作為　一名服務的網站營運工程師
為了　使所有伺服器實例都以合理的安全性設定值來啟動
我要　建立一個以強化過的組態來運行所選擇之作業系統的基礎映像檔

公共網路介面 Public network interfaces
As a web operations engineer working on the service
So that the application only receives wanted traffic from the internet
And so that we don’t accidentally expose sensitive or insecure components of the system
I want to configure and test the public network interfaces for the system
作為　一名服務的網站營運工程師
為了　讓應用程式只接收想要的網路流量
並且　不會不小心暴露敏感或不安全的系統元件
我要　為系統配置和測試公共網路介面

私人網路配置 Private network configuration
As a web operations engineer working on the service
So that individual internal components can only talk with known parts of the system
And so we limit the extent of any security breach
I want to configure and test the private network interfaces for the system
作為　一名服務的網站營運工程師
為了　各別的內部元件只能與系統裡已知的部份對話
並且　能限制安全漏洞的波及範圍
我要　為系統配置和測試私人網路介面

連結的網路規範 Network codes of connection
As a web operations engineer working on the service
Given I need to communicate with a system only available on a Government network
So that the two systems can talk with each other
I want to meet the code of connection requirements and configure access to the network
作為　一名服務的網站營運工程師
為了　需要與一個只有在政府網路上能存取到的系統溝通、使這兩個系統能相互對話
我要　滿足連結條件的規範，並配置對該網路的存取

管理用的網路 Management network
As a web operations engineer working on the service
So that network traffic used to manage the infrastructure is separate from public traffic
And so we can monitor irregularities in network traffic separately
I want to configure a separate management network
作為　一名服務的網站營運工程師
為了　把用來管理基礎設施的網路流量與公共網路流量區隔開
並且　可以單獨監控網路流量的異常狀況
我要　配置一個獨立的管理用的網路

平台的負載平衡器 Platform load balancers
As a web operations engineer working on the service
So that we can reduce the number of single points of failure
And so that we can scale out to deal with a large amount of traffic
I want to provision load balancers to distribute traffic between multiple instances
作為　一名服務的網站營運工程師
為了　可以減少單點故障的數量
並且　可以擴展到處理大量的流量
我要　開通負載平衡器來將流量分配到多個伺服器實例

平台的防火牆 Platform firewalls
As a web operations engineer working on the service
So that unwanted traffic can be filtered before it enters our virtual infrastructure
I want to configure the external facing IaaS firewalls to only allow certain traffic
作為　一名服務的網站營運工程師
為了　不想要的流量可以在它進入我們的孟擬基礎架構前被濾掉
我要　配置對外的 IaaS 防火牆，以只允許特定的流量

動態環境 Dynamic environments
As a web operations engineer working on the service
So that we are not constrained by a fixed number of environments
And so we can easy run full stack tests or experiments
I want to be able to easily provision an environment running the full service
作為　一名服務的網站營運工程師
為了　不被固定數量的環境所限制
並且　可以輕鬆運行全端的測試或實驗
我要　能夠輕鬆地開通一個運行整個服務的環境

彈性縮放 Elastic scaling
As a web operations engineer working on the service
So that the service can automatically deal with unexpected increases in traffic
I want to configure tooling to automatically scale the number of instances based on load
作為　一名服務的網站營運工程師
為了　該服務可以自動應對突發的流量增長
我要　配置工具組合來根據負荷自動縮放伺服器實例的數量

資安控制 Security controls

作業系統強化 Operating system hardening
As a web operations engineer
So that we are making use of built-in operating system security controls
I want to automate a default set of hardening rules for our chosen operating system
作為　一名網站營運工程師
為了　利用內建的作業系統的資安控制
我要　為所選擇的作業系統自動套用一組預設的強化規則

惡意軟體檢測 Malware detection
As a web operations engineer
So that instances which may be compromised can be dealt with quickly
I want to automate the detection of potential malware
作為　一名網站營運工程師
為了　可能被被入侵的伺服器實例能夠被快速地處理
我要　自動化潛在惡意軟體的檢測

入侵檢測 Intrusion detection
As a web operations engineer
So that instances which are being attacked or probed can defend themselves
I want to configure an intrusion detection and prevention system
作為　一名網站營運工程師
為了　讓正在受到攻擊或探測的伺服器實例可以保護自己
我要　配置一個入侵檢測和預防系統

病毒掃描 Virus scanning
As a web operations engineer
So we can be sure that files in the system don’t have viruses
I want to install virus scanning for files passing a network boundary
作為　一名網站營運工程師
為了　可以確定 在系統裡的檔案沒有病毒
我要　為通過網路邊界的文件 安裝病毒掃描

主機防火牆 Host firewalls
As a web operations engineer
So that the surface area for attack is limited
And so that services which should only be available locally aren’t exposed on the internet
I want to install and configure a local firewall
作為　一名網站營運工程師
為了　會被攻擊的接觸面積能被限制
並且　原本只提供給本地的服務不被暴露在網際網路上
我要　安裝和配置一個本地防火牆

伺服器實例上的事件審計 On instance event auditing
As a web operations engineer
So that I know when things like logins or other sensitive events happen on instances
I want to set-up some auditing of events
作為　一名網站營運工程師
為了　知道何時有像是登入或其他敏感事件等的事情發生在伺服器實例上
我要　設立一些 事件的審計

速度/連線數量限制 Rate/connection limiting
As a web operations engineer
So that large spikes in traffic from a single source don’t overwhelm application
I want to configure some level of rate and connection limiting for web requests
作為　一名網站營運工程師
為了　從單一來源的流量高峰不會癱瘓應用程式
我要　為 Web 請求配置某個程度上的速度和連線數量限制

對金鑰資料的安全存儲 Secure storage of key material
As a web operations engineer
So that any highly sensitive cryptographic keys are not lost, resulting in a compromise
I want to have a mechanism in place to securely store key material
作為　一名網站營運工程師
為了　任何高度敏感的加密金鑰不被丟失、從而導致一種危害
我要　有到位的機制得以安全地存儲金鑰資料

第三方的 DDoS 防護 Third party DDoS protection
As a web operations engineer
So that a the site does not go down under a denial of service attack
I want to purchase and/or configure a level of DDoS protection
作為　一名網站營運工程師
為了　一個站台不會在阻斷式攻擊之下掛掉
我要　購買和/或配置一級的 DDoS 保護

測試 Testing

效能測試 Performance testing
As the service manager responsible for the service
So that we know the service will be fast and responsive under realistic traffic
I want to be able to run a comprehensive performance test suite against the service
作為　為服務負責的服務管理者
為了　知道該服務在真實的流量下將能快速且反應靈敏
我要　能夠對服務跑一個綜合效能測試套件

As a developer working on the service
So that we know changes to the code do not negatively affect performance
I want the performance test suite to run as part of the continuous integration system
作為　一名服務的開發人員
為了　可以知道修改程式碼不會對性能產生負面影響
我要　性能測試套件，以作為執行持續整合系統的一部分

負載測試 Load testing
As the service manager responsible for the service
So that we know the service will still be working under larger amounts of traffic than are expected
I want to be able to run a comprehensive load test suite against the service
作為　為服務負責的服務管理者
為了　知道該服務在超出預期交易量時仍能正常提供服務
我要　能夠對服務執行的全面負載測試套件

應用程式滲透測試 Application penetration testing
As the service manager responsible for the service
So that the service does not get compromised due to a vulnerability
And so we meet our accreditation obligations
I want to run a suitable number of penetration tests against the applications under development
作為　負責此服務的服務管理者
為了　該服務不會因為漏洞而妥協
並且　滿足我們的認可義務
我要　對正在開發的應用程式執行適當數目的滲透測試

As the service manager responsible for the service
So that the service does not get compromised due to a vulnerability
And so we meet our accreditation obligations
I want to run a suitable number of penetration tests against third party installed applications used as part of the service
作為　負責此服務的服務管理者
為了　該服務不會因為漏洞而妥協
並且　針對作為服務的一部份所安裝第三方應用程式，執行適當數量的滲透測試

基礎設施的滲透測試 Infrastructure penetration testing
As the service manager responsible for the service
So that the service does not get compromised due to a vulnerability
And so we meet our accreditation obligations
I want to run a suitable number of penetration tests against the infrastructure configuration
作為　負責此服務的服務管理者
為了　該服務不會因為漏洞而妥協
並且　滿足我們的認可義務
我要　對基礎設施的配置執行適當數量的滲透測試

作業系統 Operating system

作業系統的選擇 Operation system selection
As a web operations engineer working on the service
So that we have a clear path to receiving security updates
And so we can more easily find support for our systems
I want to select and install a suitable default operating system for the service
作為　一名服務的網站營運工程師
為了　有清楚的方式來接收安全更新
並且　可以更容易得到系統支援
我要　為服務選擇和安裝合適的預設作業系統

文件系統 File systems
As a web operations engineer working on the service
So that we get the best possible performance and reliability from the disk
I want to select a suitable file system and partition layout
作為　一名服務的網站營運工程師
為了　由磁碟中得到最佳的性能和可靠性
我要　選擇一個合適的檔案系統和分區佈局

資源隔離 Resource isolation
As a web operations engineer working on the service
So that noisy applications cannot affect other applications on the instance
I want to be able to isolate running applications from each other in terms of memory and CPU
作為　一名服務的網站營運工程師
為了　讓有問題的應用程式不能影響到該實體的其他應用程式
我要　就記憶體及CPU而言，能夠獨立執行的應用程式

只可讀取的檔案系統 Read-only file systems
As a web operations engineer working on the service
So that I can protect against files being changed due to compromises in the application
I want to be able to configure a read-only file system if appropriate.
作為　一名服務的網站營運工程師
為了　防止檔案因為在應用程式中妥協而被變更
我要　能夠適當配置僅供讀取的檔案系統。

譯者：Sharon Wang、盧紀憲
校稿者：Sharon Wang
原始出處：https://www.gov.uk/service-manual/operations/web-operations-stories.html