Security posture summary
This page lists the security controls the AWS Baseline and the blueprints put in place, with the default state of each, so a security reviewer can answer a questionnaire from one page. Every row names a mechanism in the code. Controls marked "off" are built and switched on with one setting whose price is stated beside it.
Account structure and preventive controls
| Control | Default | Mechanism |
|---|---|---|
| Single-purpose accounts | On | 14 accounts: a management account, nine shared core accounts, four plat workload accounts, one per stage |
| Management account kept empty | On | Organizations, billing, state and the organization trail only; access limited to Platform Leads through a dedicated permission set |
| No IAM users or access keys | On | acme-security-guardrails SCP denies creating users, login profiles and access keys |
| S3 public access block protected | On | Same SCP: deleting or changing the block is denied except for platform automation and SSO roles; automated remediation re-blocks public buckets outside the public account |
| MFA for all human activity | On | Enforced in IAM Identity Center; the SCP denies any action without MFA by principals that are not SSO sessions, acme-* automation roles, service principals or roles tagged mfa-exempt |
| Region restriction | On | acme-region-restriction SCP allows the home region, regions with folders and us-east-1; global services exempt |
| Audit protection | On | acme-audit-protection SCP denies stopping, deleting or updating CloudTrail and stopping or deleting the Config recorder and delivery channel |
| Account baseline | On | Default EBS encryption, account-wide S3 public access block, AWS Config recording and the CI deployer role in every account |
| Tag policy | Report-only | Pins tag keys and values organization-wide; enforcement is one switch |
Identity and access
| Control | Default | Mechanism |
|---|---|---|
| One identity plane for people | On | IAM Identity Center, delegated to the identity account; eleven permission sets assigned by ACME_* group |
| Least privilege by environment | On | Engineers hold PowerUser in sandbox, dev and staging and ReadOnly in prod; only Platform Leads and DevOps Leads can change prod |
| Auditors cannot read data | On | Auditor permission sets add an explicit deny on S3 objects, parameters, secrets, database data and log events |
| Keyless CI | On | GitHub OIDC into the auto account; one deployer role per repository; blueprint roles reach workload accounts only |
| Deployer role trust | On | acme-terraform-deployer in every account trusts only acme-*-deployer roles in the auto account (and the secrets syncer in workload accounts) |
| Purpose-built cross-account roles | On | State access, Route 53 record writing, SSM read; each expresses one relationship |
| Unused access review | On | IAM Access Analyzer unused-access analyzer, 90 days |
| Workload identity | On | EKS Pod Identity for controllers and the application; IRSA only for Fluent Bit |
Network
| Control | Default | Mechanism |
|---|---|---|
| Private subnets have no internet route | On | Spokes have no NAT; private traffic goes to the Transit Gateway and out through the hub |
| Public subnets only for load balancers | On | Spoke internet gateways serve internet-facing ALB subnets only |
| Separate route tables for production and non-production | On | Transit Gateway route table per isolation domain: prod and nonprod, each blackholing the other's address ranges; every spoke reaches the hub and the runner VPC |
| One address plan | On | Every CIDR from the VPC map through IPAM; CI rejects any other IP literal |
| Web application firewall | On | Firewall Manager attaches a baseline AWS WAF web ACL (Common, Known Bad Inputs, SQL injection, IP reputation) to every ALB in workload accounts |
| DDoS protection | Shield Standard on; Shield Advanced off | enable_shield_advanced, $3,000 per month with a one-year commitment |
| Egress inspection | Off | AWS Network Firewall in the hub, enable_network_firewall, about $865 per month for three AZs plus $0.065 per GB |
| Remote access | Off until configured | Single Client VPN endpoint, SAML-federated with Identity Center, per-group access matrix, split tunnel, connection logs kept 365 days |
| Kubernetes network policy | On | Default-deny NetworkPolicy with an explicit allow-list, enforced by the VPC CNI agent |
| Public DNS integrity | On | DNSSEC and query logging on the apex, prod and staging zones |
Encryption
| Control | Default | Mechanism |
|---|---|---|
| At rest | On | Customer-managed KMS keys with annual rotation for the audit bucket, CloudTrail and the per-stage SOPS keys; EBS default encryption; SSE-KMS on state and the data lake; DocumentDB and ElastiCache encrypted |
| In transit | On | TLS 1.2 or later enforced by bucket policy on state and audit buckets; CloudFront TLSv1.2_2021; HTTPS-only ALB listeners; DocumentDB and ElastiCache TLS |
| Secrets | On | SOPS-encrypted in Git per application per stage, synced to SSM SecureStrings on merge, delivered by the External Secrets Operator; engineers can decrypt only sandbox and dev |
| Generated credentials never in state | On | DocumentDB master password generated in the module and written with write-only arguments |
Detection and response
| Control | Default | Mechanism |
|---|---|---|
| Threat detection | On | GuardDuty with S3, EKS audit log and EBS malware protection, delegated to security |
| Posture management | On | Security Hub with GuardDuty and Access Analyzer integrated; CIS v5, FSBP, PCI DSS v4.0.1 and tagging standards off until required |
| Configuration compliance | On | AWS Config in every account, organization aggregator, the SOC 2 baseline conformance pack; 28 further packs off |
| Vulnerability scanning | Off | Inspector for EC2, ECR and Lambda, enable_inspector |
| Sensitive data discovery | Off | Macie, enable_macie |
| High-signal alerting | On | Seven CIS metric filters and cross-account alarms; GuardDuty severity 7 and above; selected Config findings; all to an encrypted SNS topic |
| Automated remediation | On | EventBridge rule runs an SSM Automation document to remove public read and write from a bucket Security Hub reports public |
Evidence
| Control | Default | Mechanism |
|---|---|---|
| Organization audit trail | On | One multi-region organization CloudTrail with log file validation, KMS encryption, delivery to the audit bucket and a 365-day CloudWatch log group |
| Network flow evidence | On | VPC Flow Logs for all traffic from every VPC to the audit bucket |
| Tamper-resistant archive | On | Dedicated log-archive account; versioned, KMS-encrypted, TLS-only bucket; current objects never deleted |
| Cross-account observability | On | CloudWatch OAM sink in security, read-only links from the management, audit, network and four workload accounts |
| Change history | On | Every change is a pull request with a plan, a review and an apply run; drift detection opens an issue for anything else |
Supply chain
| Control | Default | Mechanism |
|---|---|---|
| Infrastructure scanning | On | tofu fmt, tflint, Checkov and Trivy in pre-commit and CI before every plan |
| Image scanning | On | Trivy in the code repositories' CI, failing on fixable HIGH and CRITICAL vulnerabilities |
| Immutable artifacts | On | ECR tag immutability; images built once and promoted by tag; no latest |
| Non-root containers | On | Fixed UID 10001, read-only root filesystem, all capabilities dropped, seccomp RuntimeDefault |
| Pinned dependencies | On | Every GitHub Action pinned to a commit SHA; every registry module and tool pinned to an exact version |
Reading further
The Secure and Compliant pillar pages explain each group of controls; the defense in depth page explains why they are layered; the security FAQ answers the questions reviewers ask most.