2 commits

Author	SHA1	Message	Date
Adam Moussa	1c6b2ee057	build(deps): migrate CDK app ts-node->tsx, adopt typescript 7 (INFRA-183) ... ts-node 10.x is incompatible with the TypeScript 7 compiler API (cdk synth fails with "Cannot read properties of undefined (reading 'fileExists')"). Switch the cdk.json app runner to tsx (pinned 4.23.0, matching sh-mcp) and bump typescript to ~7.0.2. Synthesized templates are byte-identical across all six stacks; toolchain-only change.	2026-07-08 17:20:01 -04:00
Adam Moussa	dc079edb93	Initial account-baseline stack with CloudTrail (audit C-1) ... Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside. IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS grant, now added (SourceArn + encryption-context scoped).	2026-05-29 17:44:55 -04:00