cloud security baseline — asas posture yang kena betul dari hari pertama

Security Hardening:         Cloud Security Baseline:
- Per-workload               - Per-account/subscription
- Selepas deploy             - Sebelum workload pertama
- Specific to service        - Universal untuk semua resource
- Optional (best practice)   - Mandatory (non-negotiable floor)

flowchart LR
  subgraph csb [Cloud Security Baseline · CSB]
    direction TB
    S1["Definisi<br/>STATIC"]:::csb
    S2["Apa yang<br/>MESTI ada"]:::csb
    S3["Setup sekali<br/>enforce selalu"]:::csb
    S4["Foundation<br/>floor"]:::csb
    S5["Checklist<br/>policy-as-code"]:::csb
  end
  subgraph cspm [Cloud Security Posture Management · CSPM]
    direction TB
    M1["Monitoring<br/>BERTERUSAN"]:::cspm
    M2["Adakah ia<br/>masih ada?"]:::cspm
    M3["Scan berulang<br/>alert bila drift"]:::cspm
    M4["Ongoing<br/>visibility"]:::cspm
    M5["Tools<br/>Wiz · Defender · Orca"]:::cspm
  end
  classDef csb fill:#1e1b4b,stroke:#818cf8,color:#e0e7ff
  classDef cspm fill:#0f2a1c,stroke:#4ade80,color:#bbf7d0

✅ Root account MFA enabled
✅ Root account access keys DELETED (bukan disabled, deleted)
✅ MFA required untuk semua human users
✅ Password policy: min 14 chars, complexity, no reuse 24x
✅ Tiada inline policies (semua managed policies)
✅ Principle of least privilege enforced
✅ No wildcard (*) dalam Action atau Resource untuk production roles
✅ Access keys rotate setiap 90 hari
✅ Inactive users/roles disabled selepas 90 hari

✅ CloudTrail enabled — ALL regions, ALL management events
✅ CloudTrail log file validation enabled
✅ CloudTrail logs dihantar ke S3 + CloudWatch Logs
✅ S3 bucket untuk CloudTrail: private, versioning on, MFA delete
✅ VPC Flow Logs enabled untuk semua VPC
✅ Config Rules enabled (AWS Config)
✅ GuardDuty enabled semua region
✅ Security Hub enabled + CIS benchmark enabled

✅ Tiada Security Group dengan inbound 0.0.0.0/0 ke port 22 (SSH)
✅ Tiada Security Group dengan inbound 0.0.0.0/0 ke port 3389 (RDP)
✅ Default VPC tidak digunakan untuk production workload
✅ VPC endpoints untuk S3 dan DynamoDB (elak traffic keluar internet)
✅ Network ACLs reviewed, no allow-all rules

✅ S3 Block Public Access enabled — account level
✅ S3 bucket versioning enabled untuk critical data
✅ EBS encryption by default enabled
✅ RDS encryption at rest enabled
✅ S3 Server-Side Encryption (SSE-S3 minimum, SSE-KMS untuk sensitive)
✅ Secrets dalam Secrets Manager / Parameter Store, bukan plaintext

✅ Billing alerts configured (threshold bukan nombor besar)
✅ Budget alerts configured
✅ Cost anomaly detection enabled
✅ Resource tagging policy enforced (Owner, Environment, CostCenter)
✅ AWS Organizations SCPs (Service Control Policies) untuk restrict regions

# Terraform — deploy CIS-aligned Config Rules
resource "aws_config_config_rule" "mfa_enabled_for_iam_console" {
  name = "mfa-enabled-for-iam-console-access"

  source {
    owner             = "AWS"
    source_identifier = "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS"
  }
}

resource "aws_config_config_rule" "root_mfa_enabled" {
  name = "root-account-mfa-enabled"

  source {
    owner             = "AWS"
    source_identifier = "ROOT_ACCOUNT_MFA_ENABLED"
  }
}

resource "aws_config_config_rule" "s3_block_public" {
  name = "s3-account-level-public-access-blocks"

  source {
    owner             = "AWS"
    source_identifier = "S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS"
  }
}

# csb_baseline.rego — enforce CSB dalam CI/CD pipeline
package csb.baseline

# DENY: S3 bucket yang ada public access
deny[msg] {
    resource := input.resource.aws_s3_bucket[name]
    resource.acl == "public-read"
    msg := sprintf("CSB VIOLATION: S3 bucket '%v' kena private", [name])
}

# DENY: Security group yang allow SSH dari mana-mana
deny[msg] {
    resource := input.resource.aws_security_group[name]
    rule := resource.ingress[_]
    rule.from_port <= 22
    rule.to_port >= 22
    rule.cidr_blocks[_] == "0.0.0.0/0"
    msg := sprintf("CSB VIOLATION: Security group '%v' allow SSH dari 0.0.0.0/0", [name])
}

# DENY: IAM user tanpa MFA
deny[msg] {
    resource := input.resource.aws_iam_user[name]
    not resource.force_destroy
    not input.resource.aws_iam_user_login_profile[name]
    msg := sprintf("CSB VIOLATION: IAM user '%v' tiada MFA configured", [name])
}

flowchart LR
  T0["Masa 0<br/>S3 bucket private<br/>CSB compliant"]:::ok
  T1["Masa 1<br/>Dev set ACL public-read<br/>DRIFT EVENT"]:::drift
  T2["Masa 2<br/>CSPM detect 5 minit<br/>alert fired"]:::alert
  T3["Masa 3<br/>Auto-remediation<br/>atau manual fix"]:::fix
  T4["Masa 4<br/>S3 bucket private<br/>compliant semula"]:::ok
  T0 --> T1 --> T2 --> T3 --> T4
  classDef ok fill:#0f2a1c,stroke:#4ade80,color:#bbf7d0
  classDef drift fill:#2d1518,stroke:#f87171,color:#fecaca
  classDef alert fill:#2e2410,stroke:#fbbf24,color:#fde68a
  classDef fix fill:#0f2436,stroke:#38bdf8,color:#bae6fd

flowchart TB
  W1["Minggu 1 · Assess<br/>Checkov scan atas Terraform<br/>AWS Security Hub + CIS benchmark<br/>Baseline gap report"]:::w1
  W2["Minggu 2 · Fix critical<br/>Root MFA · no public S3<br/>CloudTrail semua region<br/>Close SSH/RDP terbuka"]:::w2
  W3["Minggu 3 · Automate<br/>Terraform Config Rules<br/>OPA / Rego dalam CI/CD<br/>Pre-commit Checkov hooks"]:::w3
  W4["Minggu 4+ · Continuous<br/>AWS Config + Security Hub<br/>Alert ke Slack / PagerDuty<br/>Monthly CSB review"]:::w4
  W1 --> W2 --> W3 --> W4
  classDef w1 fill:#1e1b4b,stroke:#818cf8,color:#e0e7ff
  classDef w2 fill:#2d1518,stroke:#f87171,color:#fecaca
  classDef w3 fill:#2e2410,stroke:#fbbf24,color:#fde68a
  classDef w4 fill:#0f2a1c,stroke:#4ade80,color:#bbf7d0