1041a157da
Parameterize baseline constructs for multi-account reuse
...
DetectiveControls, FlowLogs, and GovernanceToggles were forked into
seahaven-external-dev-baseline with only physical-name and VPC-sourcing
differences. Prefix/name props let one implementation serve both
accounts; synthesized templates are unchanged (verified: empty cdk diff
against all deployed stacks).
2026-07-14 13:27:38 -04:00
Adam Moussa
3ba90ddc40
Add monitoring + logging layer (audit Day 2: H-1/H-14/M-13) ( #6 )
...
Deploy / deploy (push) Waiting to run
- H-1: 15 CIS Section 4 metric filters (4.1-4.15) on the CloudTrail log group,
each alarming to a new SSE SNS topic seahaven-cis-alarms (email to adam).
ALARM-only actions per Sea Haven preference. 4.16 = Security Hub (Day 1).
- H-14: VPC flow logs (ALL traffic) on all 5 VPCs → hardened S3 bucket. Delivery
bucket policy cross-reviewed; kept the AWS-required s3:x-amz-acl condition +
logs:*:* source-ARN (cross-reviewer wrongly flagged these; verified against
AWS flow-logs-s3-permissions docs), dropped the unneeded s3:ListBucket.
- M-13: SES configuration set seahaven-email-events capturing bounce/complaint/
reject to CloudWatch for reputation visibility.
L-4 (log retention) and L-5 (alarm action) applied via CLI, documented in README.
2026-06-02 15:16:24 -04:00
