cloud security baseline — the foundation that needs to be right from day one

Security Hardening:          Cloud Security Baseline:
- Per-workload               - Per-account/subscription
- After deploy               - Before first workload
- Specific to service        - Universal for all resources
- Optional (best practice)   - Mandatory (non-negotiable floor)

flowchart LR
  subgraph csb [Cloud Security Baseline · CSB]
    direction TB
    S1["STATIC<br/>definition"]:::csb
    S2["What MUST<br/>exist"]:::csb
    S3["Setup once<br/>enforce always"]:::csb
    S4["Foundation<br/>floor"]:::csb
    S5["Checklist<br/>policy-as-code"]:::csb
  end
  subgraph cspm [Cloud Security Posture Management · CSPM]
    direction TB
    M1["CONTINUOUS<br/>monitoring"]:::cspm
    M2["Is it still<br/>there?"]:::cspm
    M3["Scan repeatedly<br/>alert on drift"]:::cspm
    M4["Ongoing<br/>visibility"]:::cspm
    M5["Tools<br/>Wiz · Defender · Orca"]:::cspm
  end
  classDef csb fill:#1e1b4b,stroke:#818cf8,color:#e0e7ff
  classDef cspm fill:#0f2a1c,stroke:#4ade80,color:#bbf7d0

✅ Root account MFA enabled
✅ Root account access keys DELETED (not disabled, deleted)
✅ MFA required for all human users
✅ Password policy: min 14 chars, complexity, no reuse for 24 passwords
✅ No inline policies (all managed policies)
✅ Principle of least privilege enforced
✅ No wildcard (*) in Action or Resource for production roles
✅ Access keys rotated every 90 days
✅ Inactive users/roles disabled after 90 days

✅ CloudTrail enabled — ALL regions, ALL management events
✅ CloudTrail log file validation enabled
✅ CloudTrail logs sent to S3 + CloudWatch Logs
✅ S3 bucket for CloudTrail: private, versioning on, MFA delete
✅ VPC Flow Logs enabled for all VPCs
✅ Config Rules enabled (AWS Config)
✅ GuardDuty enabled in all regions
✅ Security Hub enabled + CIS benchmark enabled

✅ No Security Group with inbound 0.0.0.0/0 to port 22 (SSH)
✅ No Security Group with inbound 0.0.0.0/0 to port 3389 (RDP)
✅ Default VPC not used for production workloads
✅ VPC endpoints for S3 and DynamoDB (prevent traffic to internet)
✅ Network ACLs reviewed, no allow-all rules

✅ S3 Block Public Access enabled — account level
✅ S3 bucket versioning enabled for critical data
✅ EBS encryption by default enabled
✅ RDS encryption at rest enabled
✅ S3 Server-Side Encryption (SSE-S3 minimum, SSE-KMS for sensitive)
✅ Secrets in Secrets Manager / Parameter Store, not plaintext

✅ Billing alerts configured (threshold not a big number)
✅ Budget alerts configured
✅ Cost anomaly detection enabled
✅ Resource tagging policy enforced (Owner, Environment, CostCenter)
✅ AWS Organizations SCPs (Service Control Policies) to restrict regions

# Terraform — deploy CIS-aligned Config Rules
resource "aws_config_config_rule" "mfa_enabled_for_iam_console" {
  name = "mfa-enabled-for-iam-console-access"

  source {
    owner             = "AWS"
    source_identifier = "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS"
  }
}

resource "aws_config_config_rule" "root_mfa_enabled" {
  name = "root-account-mfa-enabled"

  source {
    owner             = "AWS"
    source_identifier = "ROOT_ACCOUNT_MFA_ENABLED"
  }
}

resource "aws_config_config_rule" "s3_block_public" {
  name = "s3-account-level-public-access-blocks"

  source {
    owner             = "AWS"
    source_identifier = "S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS"
  }
}

# csb_baseline.rego — enforce CSB in CI/CD pipeline
package csb.baseline

# DENY: S3 bucket with public access
deny[msg] {
    resource := input.resource.aws_s3_bucket[name]
    resource.acl == "public-read"
    msg := sprintf("CSB VIOLATION: S3 bucket '%v' must be private", [name])
}

# DENY: Security group allowing SSH from anywhere
deny[msg] {
    resource := input.resource.aws_security_group[name]
    rule := resource.ingress[_]
    rule.from_port <= 22
    rule.to_port >= 22
    rule.cidr_blocks[_] == "0.0.0.0/0"
    msg := sprintf("CSB VIOLATION: Security group '%v' allows SSH from 0.0.0.0/0", [name])
}

# DENY: IAM user without MFA
deny[msg] {
    resource := input.resource.aws_iam_user[name]
    not resource.force_destroy
    not input.resource.aws_iam_user_login_profile[name]
    msg := sprintf("CSB VIOLATION: IAM user '%v' has no MFA configured", [name])
}

flowchart LR
  T0["Time 0<br/>S3 bucket private<br/>CSB compliant"]:::ok
  T1["Time 1<br/>Dev sets ACL public-read<br/>DRIFT EVENT"]:::drift
  T2["Time 2<br/>CSPM detects 5 min<br/>alert fired"]:::alert
  T3["Time 3<br/>Auto-remediation<br/>or manual fix"]:::fix
  T4["Time 4<br/>S3 bucket private<br/>compliant again"]:::ok
  T0 --> T1 --> T2 --> T3 --> T4
  classDef ok fill:#0f2a1c,stroke:#4ade80,color:#bbf7d0
  classDef drift fill:#2d1518,stroke:#f87171,color:#fecaca
  classDef alert fill:#2e2410,stroke:#fbbf24,color:#fde68a
  classDef fix fill:#0f2436,stroke:#38bdf8,color:#bae6fd

flowchart TB
  W1["Week 1 · Assess<br/>Checkov scan on Terraform<br/>AWS Security Hub + CIS benchmark<br/>Baseline gap report"]:::w1
  W2["Week 2 · Fix critical<br/>Root MFA · no public S3<br/>CloudTrail all regions<br/>Close open SSH/RDP"]:::w2
  W3["Week 3 · Automate<br/>Terraform Config Rules<br/>OPA / Rego in CI/CD<br/>Pre-commit Checkov hooks"]:::w3
  W4["Week 4+ · Continuous<br/>AWS Config + Security Hub<br/>Alert to Slack / PagerDuty<br/>Monthly CSB review"]:::w4
  W1 --> W2 --> W3 --> W4
  classDef w1 fill:#1e1b4b,stroke:#818cf8,color:#e0e7ff
  classDef w2 fill:#2d1518,stroke:#f87171,color:#fecaca
  classDef w3 fill:#2e2410,stroke:#fbbf24,color:#fde68a
  classDef w4 fill:#0f2a1c,stroke:#4ade80,color:#bbf7d0