adam/seahaven-account-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-account-baseline.git synced 2026-08-04 16:56:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add seahaven-security member baseline (Phase 3)

Browse source 
Account 001520130573 is the org's delegated security administrator.
Same member-baseline construct set as external-dev; own CD job under
its own OIDC role. Created at org root pending manual root hardening
before the OU move (deny-root-user invariant).
This commit is contained in:
Adam Moussa 2026-07-14 15:09:19 -04:00
parent 57fd67324e
commit 69dd0d87b5
No known key found for this signature in database
3 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
.github/workflows/deploy.yaml vendored
View file

@ -32,3 +32,11 @@ jobs:
stacks: "external-dev-baseline"
secrets:
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN_EXTDEV }}
deploy-security:
uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@3cde673b9d05c0e68aac4d997d582f2543853d20 # main
with:
node-version: "24"
stacks: "security-baseline"
secrets:
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN_SECURITY }}

2
README.md
View file

@ -29,6 +29,7 @@ Stacks (deployed by the CD workflow — one job per target account):
| `seahaven-backup` | 328440206208 | us-east-1 | Primary AWS Backup vault + plan + role (C-7) |
| `seahaven-backup-offsite` | 328440206208 | us-west-2 | Governance-locked offsite copy vault (C-7) |
| `seahaven-external-dev-baseline` | 396287094661 | us-east-1 | Member-account baseline: Config, GuardDuty, Security Hub (FSBP + CIS v3.0), Access Analyzer, flow logs, budget |
| `seahaven-security-baseline` | 001520130573 | us-east-1 | Member-account baseline for the delegated security-admin account (same construct set) |
## CDK app
@ -57,6 +58,7 @@ the TypeScript source — no separate compile step needed for `cdk synth` /
| `backup-offsite` | `seahaven-backup-offsite` | 328440206208 | us-west-2 | `lib/backup-offsite-stack.ts` |
| `backup` | `seahaven-backup` | 328440206208 | us-east-1 | `lib/backup-stack.ts` |
| `external-dev-baseline` | `seahaven-external-dev-baseline` | 396287094661 | us-east-1 | `lib/member-baseline-stack.ts` |
| `security-baseline` | `seahaven-security-baseline` | 001520130573 | us-east-1 | `lib/member-baseline-stack.ts` |
The member-account stack (`external-dev-baseline`) deploys with credentials for
**396287094661** — the CD workflow runs it as a separate job assuming that

18
bin/app.ts
View file

@ -11,6 +11,7 @@ import { OrgGovernanceStack } from "../lib/org-governance-stack";
const ACCOUNT = "328440206208";
const EXTERNAL_DEV_ACCOUNT = "396287094661";
const SECURITY_ACCOUNT = "001520130573";
// All 5 VPCs in 328440206208 / us-east-1 (4 custom + default), audit Agent 7.
// Index-derived logical IDs — append only, never reorder.
@ -72,6 +73,23 @@ new MemberBaselineStack(app, "external-dev-baseline", {
managedByTag: "seahaven-external-dev-baseline",
});
// ── Member-account baseline: seahaven-security (Phase 3) ────────────────────
// The org's delegated security administrator (GuardDuty / Security Hub / IAM
// Access Analyzer / Config aggregator / Inspector2 — delegation itself is CLI
// + README runbook, no CFN types). Created 2026-07-14 at org ROOT; moves into
// the security OU only after manual root hardening (deny-root-user invariant,
// see lib/org-governance-stack.ts).
new MemberBaselineStack(app, "security-baseline", {
stackName: "seahaven-security-baseline",
env: { account: SECURITY_ACCOUNT, region: "us-east-1" },
namePrefix: "seahaven-security",
monthlyBudgetUsd: 50,
budgetAlertEmail: "aws@seahaven.com",
ownerEmail: "adam@seahaven.com",
flowLogVpcIds: [],
managedByTag: "seahaven-org-baseline",
});
// ── Shared DynamoDB CMK (INFRA-95 / M-3) ─────────────────────────────────────
// Dedicated, standalone stack so the customer-managed key for sensitive
// finance/PII DynamoDB tables is an independent shared dependency for the owning