Secure

A Secure system protects identities, data, workloads and supply chains by default, not by checklist. In the AWS Baseline that means controls that hold even against an account administrator, one identity plane for people with no long-lived keys anywhere, encryption everywhere data rests or moves, and detection that is on from the first day.

How the layers fit

Each layer catches what the previous one cannot. The defense in depth page explains the principle; the sections below name what implements it.

Preventive controls

Three service control policies (SCPs) are attached to both organizational units and apply to every member account. They cannot be overridden from inside an account.

SCP	What it denies
acme-security-guardrails	Creating IAM users, login profiles and access keys; deleting or changing the S3 public-access block except by platform automation and SSO roles; any action without MFA by a principal that is not an SSO session, an acme-* automation role, a service principal or a role tagged mfa-exempt
acme-region-restriction	Any action outside the home region, the regions with folders in the repository and us-east-1; global services are exempt
acme-audit-protection	Stopping, deleting or updating CloudTrail; stopping or deleting the AWS Config recorder and delivery channel

Every account also gets the account baseline: default EBS encryption, an account-wide S3 public-access block and AWS Config recording. Public S3 buckets are expected only in the public account, and automated remediation leaves that account alone.

Identity: people and pipelines

• People sign in through IAM Identity Center only. Eleven permission sets are assigned by ACME_* group, and write access narrows toward production: engineers hold PowerUser in sandbox, dev and staging and ReadOnly in prod; only Platform Leads and DevOps Leads can change prod. Auditor permission sets carry an explicit deny on reading data: S3 objects, parameters, secrets, database data and log events.
• Pipelines authenticate through GitHub OpenID Connect into the auto account. Each repository has its own deployer role there (acme-aws-platform-baseline-deployer, acme-aws-blueprint-webapp-infra-deployer and so on), which chains into acme-terraform-deployer in the target account. Blueprint roles can reach only the workload accounts; the landing-zone role can reach every account. No AWS key is stored in GitHub.
• Kubernetes workloads get AWS permissions through EKS Pod Identity (the load balancer controller, ExternalDNS, External Secrets and the application service account), with IRSA only for Fluent Bit.

The least privilege page shows the access matrix; the IAM Identity Center and GitHub OIDC explainers cover the two mechanisms.

Encryption and secrets

• Customer-managed KMS keys with annual rotation protect the audit log bucket, CloudTrail and one SOPS key per stage; EBS default encryption is on in every account; the state bucket and data lake use SSE-KMS; DocumentDB and ElastiCache are encrypted at rest.
• Bucket policies on the state and audit buckets deny requests that are not TLS 1.2 or later; CloudFront enforces TLSv1.2_2021; application load balancers listen on HTTPS only; DocumentDB and ElastiCache encrypt in transit.
• Application secrets live SOPS-encrypted in the secrets repository, one file per application per stage, encrypted with that stage's KMS key from the security account. A merge syncs them to SSM Parameter Store SecureStrings in the target account; the External Secrets Operator delivers them to Kubernetes. Leads can use every stage key; engineers only sandbox and dev.
• The DocumentDB master password is generated inside the module and written with write-only arguments, so it never appears in a plan or in state.

Network boundaries

Spoke VPCs keep an internet gateway only for public load balancer subnets; private subnets route to the Transit Gateway and leave through the hub's NAT. Isolation domains give prod and nonprod separate Transit Gateway route tables that never learn each other's routes; every spoke reaches the hub and the runner VPC. Firewall Manager attaches a baseline AWS WAF web ACL (Common, Known Bad Inputs, SQL injection and IP reputation managed rule groups) to every application load balancer in the workload accounts. AWS Network Firewall egress inspection and Shield Advanced are built and off by default, each behind a switch that states its price. The application chart runs pods as a fixed non-root user with a read-only root filesystem, all capabilities dropped, and a default-deny NetworkPolicy enforced by the VPC CNI.

Detection and response

environments/core/security/security.hcl switches every detective service for the whole organization:

Service	Default	What it does
GuardDuty	On	Threat detection with S3 data events, EKS audit logs and EBS malware protection
Security Hub	On	Posture checks and finding aggregation; CIS v5, FSBP, PCI DSS v4.0.1 and tagging standards available
IAM Access Analyzer	On	External-access analyzer in the management account; unused-access analyzer (90 days) in security
Inspector	Off	EC2, ECR and Lambda vulnerability scanning
Macie	Off	S3 sensitive-data discovery
Shield Advanced	Off	DDoS protection for listed resources

EventBridge rules in the security account send GuardDuty findings of severity 7 and above to the acme-security-alerts SNS topic, run an SSM Automation document that removes public read and write from an S3 bucket that Security Hub reports as public, and forward EC2, VPC and selected Config non-compliance findings. Seven CIS metric filters on the CloudTrail log group raise alarms on root use, unauthorized calls, IAM and network changes.

Supply chain

Every infrastructure repository runs tofu fmt, tflint, Checkov and Trivy in pre-commit and again in CI before a plan. Code repositories lint, test, build and scan the image with Trivy, failing on fixable HIGH and CRITICAL vulnerabilities. GitHub Actions are pinned to commit SHAs, registry modules to exact versions, and ECR tags are immutable.

How you verify it

• Organizations console in the management account: three SCPs attached to the core and plat OUs.
• IAM console in any member account: no IAM users; acme-terraform-deployer present with a trust policy limited to acme-*-deployer roles in the auto account.
• Security Hub summary in the security account: findings from every enrolled account, with GuardDuty and Access Analyzer as integrated products.
• security.hcl in your landing-zone repository: the switches above with their prices, and the org_auto_enable flags that show whether organization-wide enrollment has completed.
• The security posture summary is the same material condensed into one page for a reviewer.